Name: MailSec API — SPF, DMARC, DKIM & Deliverability Audit
Brand: fivetag-systems
SKU: api-fivetag-systems-mailsec
Availability: InStock
Author: API Market

Łukasz Gogolin

# MailSec — Email Security & Deliverability Audit

**MailSec** turns a single domain name into a complete picture of how that domain handles email. In one request you get the state of every record that mail providers actually look at — SPF, DMARC, DKIM, DNSSEC, MX, BIMI, MTA-STS, TLS-RPT — plus Spamhaus blacklist status, a numeric security score, an A–F letter grade, and a plain-language deliverability verdict (`READY`, `CAUTION`, or `BLOCKED`).

If you have ever shipped a feature that sends transactional email, onboarded a B2B customer who later complained about Gmail putting their notifications in spam, or tried to debug why DMARC reports were missing — MailSec replaces a ten-tab dig/whois/mxtoolbox session with a single JSON response.

---

## What it checks

Every endpoint is backed by live DNS lookups (no stale third-party scrapes) with an internal cache that respects each record's TTL.

- **SPF** — Parses the TXT record, counts recursive lookups against the RFC 7208 limit of 10, flags soft/hard failures, missing `all` mechanisms, and over-permissive policies.
- **DMARC** — Returns the policy (`none` / `quarantine` / `reject`), subdomain policy, percentage tag, alignment modes (`adkim` / `aspf`), and the list of `rua` / `ruf` reporting addresses.
- **DKIM** — Auto-probes a curated list of common selectors (`google`, `selector1`, `s1`, `mail`, `k1`, …) so callers don't need to know which one a domain uses. Pass `?selector=` to force a specific one.
- **DNSSEC** — Verifies the chain of trust from the domain's DS record up to the parent zone.
- **MX** — Returns priorities, hostnames, detected provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho, etc.), and whether the domain has redundant MX hosts.
- **BIMI** — Parses the `default._bimi` TXT record, returns the SVG logo URL and Verified Mark Certificate (VMC) URL.
- **MTA-STS** — Checks the `_mta-sts` TXT record and fetches the HTTPS policy file (RFC 8461). Returns mode (`enforce` / `testing` / `none`), MX patterns, max_age, and cross-references MX patterns against actual MX records.
- **TLS-RPT** — Parses the `_smtp._tls` TXT record (RFC 8460). Returns the reporting URIs (`mailto:` or `https:`) so senders can report TLS negotiation failures.
- **Blacklists** — Queries Spamhaus DBL (domain) and ZEN (IPs of every MX host) and returns return codes for each hit.
- **Disposable / throwaway domains** — Suffix-walks an embedded blocklist of 100k+ disposable email providers (Mailinator, Guerrilla Mail, 10MinuteMail, etc.) so probing `xyz.mailinator.com` correctly returns `mailinator.com` as the matched parent.

---

## Why this exists

Email infrastructure is fiddly: SPF has a hard 10-lookup limit that silently breaks at scale; DMARC enforcement requires `quarantine` or `reject` to actually do anything; DKIM keys rotate; BIMI requires a paid VMC; and Spamhaus listings can land you in spam folders for days. Most teams discover these problems _after_ a customer complains.

**Build MailSec into your product to:**

- **Validate B2B signups** — verify a corporate domain is real, has working email, and isn't disposable, before provisioning a trial.
- **Pre-flight transactional sends** — block sends to domains where deliverability would clearly fail.
- **Onboarding & domain verification flows** — give customers a one-click "Check my domain" button that explains exactly what's misconfigured.
- **Internal email security reviews** — audit subsidiaries, acquired companies, or partners.
- **DMARC rollout dashboards** — track whether `p=none` policies have been moved to `quarantine` or `reject`.
- **Security posture monitoring** — detect when a domain's MX or DMARC quietly changes.

---

## Endpoints

| Method | Path | What it returns |
|--------|------|-----------------|
| `GET` | `/v1/audit/{domain}` | Full audit: every check + score + grade + verdict |
| `POST` | `/v1/audit/bulk` | Up to 10 domains audited in parallel; per-item success/error |
| `GET` | `/v1/spf/{domain}` | SPF record + parse + lookup count |
| `GET` | `/v1/dmarc/{domain}` | DMARC record + policy + alignment + reporting URIs |
| `GET` | `/v1/dkim/{domain}` | DKIM presence (auto-probes selectors; `?selector=` to override) |
| `GET` | `/v1/dnssec/{domain}` | DNSSEC chain status |
| `GET` | `/v1/mx/{domain}` | MX hosts, priorities, detected provider, redundancy |
| `GET` | `/v1/bimi/{domain}` | BIMI logo + VMC URL |
| `GET` | `/v1/mta-sts/{domain}` | MTA-STS policy check (DNS + HTTPS policy file) |
| `GET` | `/v1/tlsrpt/{domain}` | TLS-RPT record + reporting URIs |
| `GET` | `/v1/deliverability/{domain}` | 4-component score + verdict (READY / CAUTION / BLOCKED) |
| `GET` | `/v1/email/disposable/{domain}` | Disposable-domain check |
| `GET` | `/v1/email/validate?email=` | Strict email validation: syntax + IDN + DNS + disposable |

---

## Scoring & verdicts

The full audit (`/v1/audit/{domain}`) uses a 5-component scale out of 100:

| Check | Max points |
|-------|-----------|
| SPF | 20 |
| DMARC | 30 |
| DKIM | 20 |
| DNSSEC | 20 |
| MX | 10 |

| Score | Grade |
|-------|-------|
| 90+ | A |
| 70+ | B |
| 50+ | C |
| 30+ | D |
| <30 | F |

The deliverability endpoint (`/v1/deliverability/{domain}`) uses a tighter 4-component scale (no DNSSEC) since DNSSEC isn't required for inbox placement, and produces a verdict:

- `BLOCKED` — domain in Spamhaus DBL **or** an MX IP in Spamhaus ZEN
- `CAUTION` — not blacklisted, but SPF invalid / DMARC missing or `p=none` / MX missing
- `READY` — not blacklisted, SPF valid, DMARC at `quarantine` or `reject`, MX present

`p=none` deliberately doesn't count as `READY` — it doesn't actually enforce anything, and treating it as production-ready is the most common DMARC misconfiguration we see.

**MTA-STS, TLS-RPT, and BIMI** are included in the audit response for visibility but are **informational only** — they do not affect the score, grade, or verdict. Adoption is still low enough that penalizing domains without them would be unfair.

---

## Example responses

All examples below are live production responses.

### `GET /v1/audit/cloudflare.com` — Full audit

```json
{
  "domain": "cloudflare.com",
  "spf": {
    "present": true,
    "valid": true,
    "record": "v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all",
    "lookupCount": 7
  },
  "dmarc": {
    "present": true,
    "valid": true,
    "record": "v=DMARC1; p=reject; pct=100; rua=mailto:...@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com",
    "policy": "reject",
    "subdomainPolicy": "reject",
    "pct": 100,
    "rua": [
      "mailto:...@dmarc-reports.cloudflare.net",
      "mailto:rua@cloudflare.com"
    ]
  },
  "dkim": { "present": true, "selector": "k1", "valid": true },
  "dnssec": { "enabled": true, "valid": true },
  "mx": {
    "present": true,
    "redundant": true,
    "records": [
      { "host": "mxa-canary.global.inbound.cf-emailsecurity.net.", "priority": 5 },
      { "host": "mxb-canary.global.inbound.cf-emailsecurity.net.", "priority": 5 },
      { "host": "mxa.global.inbound.cf-emailsecurity.net.", "priority": 10 },
      { "host": "mxb.global.inbound.cf-emailsecurity.net.", "priority": 10 }
    ]
  },
  "score": 100,
  "grade": "A",
  "blacklists": { "dblListed": false, "zenListed": false },
  "verdict": "READY",
  "mtaSts": {
    "present": false,
    "issues": ["mta-sts: no DNS record found"]
  },
  "tlsRpt": {
    "present": false,
    "issues": ["tlsrpt: no record found"]
  }
}
```

### `GET /v1/spf/cloudflare.com` — SPF check

```json
{
  "present": true,
  "valid": true,
  "record": "v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all",
  "lookupCount": 7
}
```

### `GET /v1/dmarc/cloudflare.com` — DMARC policy

```json
{
  "present": true,
  "valid": true,
  "record": "v=DMARC1; p=reject; pct=100; rua=mailto:...@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com",
  "policy": "reject",
  "subdomainPolicy": "reject",
  "pct": 100,
  "rua": [
    "mailto:...@dmarc-reports.cloudflare.net",
    "mailto:rua@cloudflare.com"
  ]
}
```

### `GET /v1/dkim/cloudflare.com` — DKIM presence

```json
{
  "present": true,
  "selector": "k1",
  "valid": true
}
```

### `GET /v1/dnssec/cloudflare.com` — DNSSEC chain

```json
{
  "enabled": true,
  "valid": true
}
```

### `GET /v1/mx/cloudflare.com` — MX records & provider

```json
{
  "present": true,
  "redundant": true,
  "records": [
    { "host": "mxa-canary.global.inbound.cf-emailsecurity.net.", "priority": 5 },
    { "host": "mxb-canary.global.inbound.cf-emailsecurity.net.", "priority": 5 },
    { "host": "mxa.global.inbound.cf-emailsecurity.net.", "priority": 10 },
    { "host": "mxb.global.inbound.cf-emailsecurity.net.", "priority": 10 }
  ]
}
```

### `GET /v1/bimi/cloudflare.com` — BIMI record

```json
{
  "present": true,
  "raw": "v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem",
  "version": "BIMI1",
  "logoUrl": "https://www.cloudflare.com/cloudflare_1171114652.svg",
  "vmcUrl": "https://www.cloudflare.com/cloudflare_1171114652.pem",
  "vmcPresent": true
}
```

### `GET /v1/mta-sts/google.com` — MTA-STS policy

```json
{
  "present": true,
  "version": "STSv1",
  "id": "20210803T010101",
  "raw": "v=STSv1; id=20210803T010101;",
  "mode": "enforce",
  "mxPatterns": [
    "smtp.google.com",
    "aspmx.l.google.com",
    "*.aspmx.l.google.com"
  ],
  "maxAge": 86400
}
```

### `GET /v1/tlsrpt/google.com` — TLS-RPT record

```json
{
  "present": true,
  "version": "TLSRPTv1",
  "raw": "v=TLSRPTv1;rua=mailto:sts-reports@google.com",
  "rua": [
    "mailto:sts-reports@google.com"
  ]
}
```

### `GET /v1/deliverability/cloudflare.com` — Deliverability verdict

```json
{
  "domain": "cloudflare.com",
  "spf": {
    "present": true,
    "valid": true,
    "record": "v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all",
    "lookupCount": 7
  },
  "dmarc": {
    "present": true,
    "valid": true,
    "record": "v=DMARC1; p=reject; pct=100; rua=mailto:...@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com",
    "policy": "reject",
    "subdomainPolicy": "reject",
    "pct": 100,
    "rua": [
      "mailto:...@dmarc-reports.cloudflare.net",
      "mailto:rua@cloudflare.com"
    ]
  },
  "dkim": { "present": true, "selector": "k1", "valid": true },
  "mx": {
    "present": true,
    "redundant": true,
    "records": [
      { "host": "mxa-canary.global.inbound.cf-emailsecurity.net.", "priority": 5 },
      { "host": "mxb-canary.global.inbound.cf-emailsecurity.net.", "priority": 5 },
      { "host": "mxa.global.inbound.cf-emailsecurity.net.", "priority": 10 },
      { "host": "mxb.global.inbound.cf-emailsecurity.net.", "priority": 10 }
    ]
  },
  "blacklists": { "dblListed": false, "zenListed": false },
  "score": 100,
  "grade": "A",
  "verdict": "READY"
}
```

### `GET /v1/email/disposable/mailinator.com` — Disposable check

```json
{
  "domain": "mailinator.com",
  "disposable": true,
  "matchedAs": "mailinator.com"
}
```

### `GET /v1/email/validate?email=test@cloudflare.com` — Email validation

```json
{
  "email": "test@cloudflare.com",
  "domain": "cloudflare.com",
  "syntaxValid": true,
  "domainExists": true,
  "mxPresent": true,
  "spfPresent": true,
  "dmarcPresent": true,
  "disposable": false,
  "deliverable": true
}
```

---

## Performance

- **Stateless Go service** — every request is a fresh, independent DNS audit.
- **In-process cache with singleflight** — repeat queries for the same domain within its TTL collapse to a single upstream lookup.
- **Negative caching** — `NXDOMAIN` and `NoData` are cached so probing made-up subdomains doesn't hammer your quota.
- **Parallel sub-checks** — the full audit fans out SPF / DMARC / DKIM / DNSSEC / MX / blacklist queries concurrently via `errgroup`.
- **Typical latency** — 200–800 ms for a cold domain; <50 ms when cached.
- **Bulk endpoint** — up to 10 domains audited in parallel in a single request.

---

## Conventions

- All responses are `application/json`.
- All errors return `{ "error": "<message>" }` with a meaningful HTTP status (400 for input errors, 500 for upstream DNS failures).
- Domain inputs are normalised (lowercase, trailing-dot stripped, IDN punycode-ready).
- Email inputs are validated via `net/mail.ParseAddress` plus IDN `idna.Lookup`.

Built in Go. Backed by `miekg/dns` for raw DNS, Spamhaus DBL/ZEN for blacklist data, and a curated 100k+ disposable-domain list updated regularly.


Audit SPF, DMARC, DKIM, DNSSEC, MX & Spamhaus blacklists for any domain. A–F grade, deliverability verdict, disposable-email check — JSON REST API.

MailSec API — SPF, DMARC, DKIM & Deliverability Audit