Name: Email Security API - SPF/DKIM/DMARC Checker
Brand: quotalink
SKU: api-quotalink-email-security
Availability: InStock
Author: API Market

李乐

# Email Security API — SPF, DKIM & DMARC Checker

**Email Security API** inspects a domain's published DNS records and reports how its email authentication is configured. One GET request returns the domain's **SPF**, **DKIM**, and **DMARC** state, a **0–100 security score**, an **A–F grade**, and per-check issues and recommendations.

Everything is read from public DNS, so no mailbox access, no domain ownership proof, and no agent installation is needed — you can check any domain, including ones you do not control.

The API is **synchronous**: a single `GET /check` returns the full analysis in roughly **1–3 seconds**. There is no job to submit and no result to poll.

---

## Why email authentication matters

Three DNS records decide whether receiving mail servers trust mail claiming to come from your domain:

- **SPF** (Sender Policy Framework) — a TXT record listing which servers may send on the domain's behalf.
- **DKIM** (DomainKeys Identified Mail) — a public key published under a *selector*, used to verify a cryptographic signature on each message.
- **DMARC** (Domain-based Message Authentication, Reporting & Conformance) — a policy record saying what a receiver should do when SPF and DKIM fail, plus where to send reports.

Gaps in these records are the usual reason legitimate mail lands in spam, and the usual reason a domain can be spoofed in phishing.

---

## Features

- **SPF analysis** — detects the domain's SPF TXT record, returns the raw record, a sub-score, issues, and recommendations (for example, suggesting `-all` over `~all` for a stricter policy).
- **DKIM detection** — probes common publisher selectors and reports the selector it matched along with the published key record.
- **DMARC analysis** — returns the raw DMARC record and evaluates the policy (`p=none` / `quarantine` / `reject`) and reporting configuration.
- **Overall score and grade** — one 0–100 number and an A–F letter for dashboards and reports.
- **Per-check sub-scores** — SPF, DKIM, and DMARC are each scored separately, so you can see which one is dragging the domain down.
- **Actionable issues and recommendations** — plain-language strings, ready to surface to a user.
- **Boolean summary block** — `spf_configured`, `dkim_configured`, `dmarc_configured`, and `total_issues` for quick conditional logic without parsing the detail.
- **Tolerant input** — a full URL such as `https://microsoft.com` is normalised to the bare domain.
- **Synchronous** — one request, one complete answer, typically in 1–3 seconds.
- **Single-header auth** — one `x-api-market-key` header. No provider account, no OAuth, no second credential.
- **Up to 10 requests/second.**

---

## Use Cases

- **Email deliverability triage** — when a customer reports mail going to spam, check SPF, DKIM, and DMARC first before digging into content or reputation.
- **Onboarding checks for email platforms** — verify a new tenant's sending domain is correctly configured before you let them send, and show them exactly what to fix.
- **Domain security auditing** — score a portfolio of owned domains and find the parked or legacy ones with no DMARC policy protecting them from spoofing.
- **Phishing and brand-protection research** — assess whether a lookalike domain is configured to send mail, and how exposed your own brand is to spoofing.
- **M&A and vendor due diligence** — quickly gauge the email hygiene of an acquisition target or a supplier without any access to their systems.
- **Security posture dashboards** — the numeric score and letter grade drop straight into a compliance or risk widget.
- **Continuous monitoring** — re-check your domains on a schedule and alert when a record changes or disappears.
- **Compliance evidence** — record a timestamped configuration snapshot for frameworks that expect email authentication controls.
- **Sales and marketing tooling** — qualify prospects by their email infrastructure, or show a prospect their own gaps as a conversation starter.

---

## Pricing

| Plan | Price | Included | Limit type | Overage | Rate limit |
|:-----|:------|:---------|:-----------|:--------|:-----------|
| **Free Trial** | **$0** | **150 API units**, valid **7 days** | Hard — requests stop at the cap | — | 10 req/sec |
| **Basic** | **$9 / month** | **1,000 calls / month** | Soft — traffic above the cap is billed | **$0.01** per additional call | 10 req/sec |

The Free Trial needs no card and is there to let you evaluate the API against your own domains before committing. Because it is **hard-limited**, calls are rejected once the 150 units are used or the 7 days elapse, rather than billing you.

Basic works out to **$0.009 per included call**, with additional calls at $0.01. It is **soft-limited**, so a traffic spike is billed rather than blocked.

> Every request through the proxy counts as one billable call, including requests for domains that turn out to have no records at all.

---

## API Documentation

### Base URL

```
https://prod.api.market/api/v1/quotalink/email-security
```

### Authentication

Add your API.market key to every request:

```
x-api-market-key: YOUR_API_KEY
```

Get your key at [api.market](https://api.market/account/apiKeys). This is the only credential you need.

### Endpoints

| Method | Path | Description |
|:-------|:-----|:------------|
| `GET` | `/check` | Analyse SPF, DKIM, and DMARC for one domain |

---

### GET `/check`

**Query parameters**

| Name | Type | Required | Description |
|:-----|:-----|:---------|:------------|
| `domain` | string | **Yes** | Domain to check, e.g. `google.com`. A full URL such as `https://google.com` is accepted and normalised to the bare domain. |

**Example**

```bash
curl "https://prod.api.market/api/v1/quotalink/email-security/check?domain=google.com" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example response** (`200`)

```json
{
  "domain": "google.com",
  "overall_score": 72,
  "grade": "B",
  "spf": {
    "exists": true,
    "record": "v=spf1 include:_spf.google.com ~all",
    "analysis": {
      "score": 60,
      "issues": [],
      "recommendations": ["Consider using '-all' for stricter policy"]
    }
  },
  "dkim": [
    {
      "exists": false,
      "record": null,
      "selector": "default",
      "analysis": { "score": 0, "issues": ["No DKIM record found"] }
    }
  ],
  "dmarc": {
    "exists": true,
    "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
    "analysis": { "score": 85, "issues": [], "recommendations": [] }
  },
  "summary": {
    "spf_configured": true,
    "dkim_configured": false,
    "dmarc_configured": true,
    "total_issues": 1
  }
}
```

### Response fields

| Field | Type | Description |
|:------|:-----|:------------|
| `domain` | string | The normalised domain that was analysed. |
| `overall_score` | integer | Composite score, 0–100. |
| `grade` | string | `A`, `B`, `C`, `D`, or `F`. |
| `spf.exists` | boolean | Whether an SPF record was detected. |
| `spf.record` | string \| null | The raw SPF TXT record, or `null` when none was detected. |
| `spf.analysis.score` | integer | SPF sub-score, 0–100. |
| `spf.analysis.issues` | string[] | Problems found with the SPF record. |
| `spf.analysis.recommendations` | string[] | Suggested improvements. |
| `dkim` | array | One entry per selector probed. |
| `dkim[].exists` | boolean | Whether a DKIM key was found for that selector. |
| `dkim[].selector` | string | The selector checked, e.g. `default`, `google`, `selector2`. |
| `dkim[].record` | string \| null | The raw DKIM TXT record, or `null`. |
| `dkim[].analysis.score` | integer | DKIM sub-score, 0–100. |
| `dmarc.exists` | boolean | Whether a DMARC record was detected. |
| `dmarc.record` | string \| null | The raw DMARC TXT record, or `null`. |
| `dmarc.analysis.score` | integer | DMARC sub-score, 0–100. |
| `summary.spf_configured` | boolean | Convenience mirror of `spf.exists`. |
| `summary.dkim_configured` | boolean | True when at least one selector matched. |
| `summary.dmarc_configured` | boolean | Convenience mirror of `dmarc.exists`. |
| `summary.total_issues` | integer | Count of issues across all three checks. |

> **`dkim` is an array**, not an object — read `dkim[0]`, or prefer `summary.dkim_configured` for a simple yes/no. Because DKIM keys live under arbitrary selectors, a `false` here means *none of the probed selectors matched*, not that the domain has no DKIM at all. If you know your own selector, verify it directly rather than relying on selector probing.

### Domains with no records

A domain that does not exist, or has no email authentication at all, is **not an error**. You get a normal `200` with every check false, a score of `0`, grade `F`, and the DNS failure reported in the issues array:

```json
{
  "domain": "thisdomaindoesnotexist-zzz123.com",
  "overall_score": 0,
  "grade": "F",
  "summary": {
    "spf_configured": false,
    "dkim_configured": false,
    "dmarc_configured": false,
    "total_issues": 3
  }
}
```

Treat grade `F` with a DNS-failure issue as "domain not resolvable", and grade `F` with clean DNS as "resolvable but unprotected".

---

## Status Codes

| Code | Meaning | What to do |
|:-----|:--------|:-----------|
| `200` | Success | Read the analysis. Also returned for unresolvable domains — check `grade` and `summary`, not just the status code. |
| `400` | Missing, invalid, or absent API key, or an unsupported path/method | Read `message`. Send `x-api-market-key`, and use `GET` on `/check`. |
| `429` | Rate limited | You exceeded 10 requests/second — back off and retry. |
| `5xx` | Upstream or gateway error | Retry with backoff. |

Authentication problems come back as **`400`**, not `401` or `403`, with a JSON body such as:

```json
{ "message": "No x-api-market-key or x-magicapi-key defined in headers" }
```

```json
{ "message": "Invalid x-api-market-key or x-magicapi-key defined in headers" }
```

Using the wrong method or path returns `{ "message": "API Path invalid or doesn't exist" }`, also with a `400`.

---

## Rate Limits

Both plans allow up to **10 requests per second**. Requests above that return `429`.

The Free Trial is **hard-limited** to 150 units over 7 days — once exhausted, requests are refused rather than billed. Basic is **soft-limited** at 1,000 calls a month, so traffic beyond the quota is billed at $0.01 per call instead of being blocked.

Each check performs several DNS lookups, so responses typically take **1–3 seconds**. Size any bulk job around that latency, not around the request-rate ceiling.

---

## Error Handling

- **Do not rely on the status code alone.** An unresolvable domain returns `200` with grade `F`. Branch on `grade` and `summary`, not on `response.ok`.
- **Guard against the no-parameter response.** Calling `/check` without a `domain` returns `200` with a service banner — `{"message": "...", "status": "ok"}` — not the analysis object and not a `400`. Always validate that `domain` is non-empty before sending, and check that `overall_score` is present before reading the result.
- **Read `message` on `400`.** It distinguishes a missing key from an invalid key from a bad path.
- **Retry `429` and `5xx` with exponential backoff**, starting at 1 second and capping around 30 seconds. Never retry a `400`.
- **Set a client timeout of at least 10 seconds.** DNS lookups against slow or unresponsive authoritative nameservers dominate the response time.
- **Cache results.** DNS records change rarely — caching for hours to a day cuts cost substantially with no loss of accuracy.

---

## Implementation Guide

### Python

```python
import requests

BASE = "https://prod.api.market/api/v1/quotalink/email-security"
HEADERS = {"x-api-market-key": "YOUR_API_KEY"}

def check_domain(domain):
    if not domain or not domain.strip():
        raise ValueError("domain is required")

    r = requests.get(f"{BASE}/check", params={"domain": domain}, headers=HEADERS, timeout=15)
    if r.status_code == 400:
        raise RuntimeError(r.json().get("message", "bad request"))
    r.raise_for_status()

    data = r.json()
    if "overall_score" not in data:          # service banner, not an analysis
        raise RuntimeError(f"unexpected response: {data}")
    return data

result = check_domain("google.com")
print(f"{result['domain']}: {result['overall_score']}/100 (grade {result['grade']})")

for name in ("spf", "dkim", "dmarc"):
    print(f"  {name.upper():5} configured: {result['summary'][f'{name}_configured']}")

for issue in result["spf"]["analysis"].get("issues", []):
    print(f"  SPF issue: {issue}")
for rec in result["spf"]["analysis"].get("recommendations", []):
    print(f"  SPF tip:   {rec}")
```

### Node.js — audit a list of domains

```javascript
const BASE = "https://prod.api.market/api/v1/quotalink/email-security";
const HEADERS = { "x-api-market-key": process.env.API_MARKET_KEY };

const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

async function checkDomain(domain) {
  if (!domain?.trim()) throw new Error("domain is required");

  const url = `${BASE}/check?domain=${encodeURIComponent(domain)}`;
  const res = await fetch(url, { headers: HEADERS });
  const body = await res.json();

  if (res.status === 400) throw new Error(body.message);
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  if (body.overall_score === undefined) throw new Error("unexpected response");

  return body;
}

async function audit(domains) {
  const rows = [];
  for (const d of domains) {
    try {
      const r = await checkDomain(d);
      rows.push({
        domain: r.domain,
        score: r.overall_score,
        grade: r.grade,
        spf: r.summary.spf_configured,
        dkim: r.summary.dkim_configured,
        dmarc: r.summary.dmarc_configured,
        issues: r.summary.total_issues,
      });
    } catch (err) {
      rows.push({ domain: d, error: err.message });
    }
    await sleep(150); // stay well under 10 req/sec
  }
  rows.sort((a, b) => (a.score ?? -1) - (b.score ?? -1)); // worst first
  console.table(rows);
  return rows;
}

audit(["google.com", "github.com", "example.com"]);
```

### Practical tips

- **Check the apex domain.** SPF and DMARC are normally published at the organisational domain (`yahoo.com`), not at a mail subdomain (`mail.yahoo.com`), which will often look unconfigured.
- **Confirm your own DKIM selector separately.** Selector probing only finds keys under common names; a custom selector will read as missing.
- **Cache by domain.** These records change on the order of months. A day-long cache is safe and cuts spend sharply.
- **Sort by score, act on issues.** For portfolio auditing, rank ascending by `overall_score` and work the `issues` arrays — they are already written as user-facing text.
- **Re-check on a schedule.** A record silently removed during a DNS migration is a common and expensive failure; a weekly job catches it.
- **Alert on DMARC policy, not just presence.** `p=none` is monitoring only and offers no spoofing protection. Read `dmarc.record` for the actual policy rather than trusting `dmarc_configured` alone.

---

## FAQ

**What does this API actually check?**

Public DNS records only — the SPF TXT record, DKIM keys at probed selectors, and the `_dmarc` TXT record. It does not send test mail, connect to your mail server, or need any access to your domain.

**Can I check domains I do not own?**

Yes. Everything it reads is public DNS, so any domain can be checked. That is what makes it usable for vendor due diligence and phishing research.

**Is it synchronous?**

Yes. One `GET /check` returns the complete analysis, typically in 1–3 seconds. There is no job id and nothing to poll.

**Why is `dkim` an array?**

DKIM keys are published under selectors, and a domain can have many. The array holds one entry per selector probed, each with its own `exists`, `record`, and `selector`. Use `summary.dkim_configured` for a simple yes/no.

**DKIM shows as missing but we definitely have it. Why?**

The check probes common selector names. If your provider uses a custom selector, it will not be found. Verify your specific selector directly.

**What does a grade of F mean?**

Either the domain does not resolve, or it has none of the three records. Check the `issues` arrays — a DNS failure message means unresolvable; clean DNS with everything `false` means resolvable but unprotected.

**Does a domain with no records return an error?**

No. It returns `200` with all checks `false`, a score of `0`, and grade `F`. Always branch on `grade` and `summary`, not on the status code.

**What happens if I omit `domain`?**

You get `200` with a short service banner instead of an analysis. Validate the parameter client-side and check that `overall_score` is present before using the response.

**Why do authentication failures return 400 instead of 401?**

That is how the gateway reports them. Read the `message` field to tell a missing key from an invalid one.

**How fresh are the results?**

Each call performs live DNS lookups, so results reflect current DNS subject to normal resolver TTL caching. There is no stored snapshot.

**What is the rate limit?**

10 requests per second on both plans. Each call takes 1–3 seconds, so DNS latency rather than the rate limit will usually bound a bulk job.

**Which plan should I choose?**

Start on the Free Trial — 150 units over 7 days, no card — and run it against your own domains. Move to Basic at $9/month for 1,000 calls once you are integrating for real.

**What happens when the Free Trial runs out?**

It is hard-limited, so requests are refused rather than billed. Subscribe to Basic to continue.

---

## Contact Us

If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.


Check email security configuration for any domain. Detect SPF, DKIM, DMARC records and get security scores.