Email Auth Checker

Email Auth Checker API

GET /v1/email-auth?domain=example.com for the full report (SPF+DMARC+DKIM+MX+MTA-STS+TLS-RPT+BIMI+bulk-sender readiness). GET /v1/spf for the SPF lookup tree only, GET /v1/dmarc for DMARC only, GET /v1/domain-expiry for RDAP registration/expiry. All take a bare domain; deterministic DNS-over-HTTPS and RDAP, no AI.

How to pay

Every /v1 endpoint answers an unpaid request with HTTP 402 and a PAYMENT-REQUIRED header (x402 v2, scheme exact, network eip155:8453, USDC, payTo 0x076e653F4f458201B866B6B46A50F5796C345fb7, facilitator https://facilitator.payai.network, fallback https://facilitator.xpay.sh). Any x402 client (for example @x402/fetch) pays and retries automatically. No API key or account.

Machine-readable: /openapi.json · /.well-known/x402

GET /v1/email-auth — $0.003 USDC

Full email-auth report for a domain: SPF (recursive 10-lookup count, void lookups, +all/?all, terms after all), DMARC (policy, pct, alignment, rua authorization), DKIM (keys and RSA key bits at common selectors or your own via selectors=), MX/null MX, MTA-STS policy, TLS-RPT, BIMI, and a Gmail/Yahoo/Outlook bulk-sender readiness verdict. Deterministic DNS-over-HTTPS, no AI.

ParamRequiredDescription
domainyesDomain (or email address) to check Example: github.com
selectorsnoOptional comma list of DKIM selectors to probe (max 10) Example: google,selector1

Example request: https://email-auth-check.quietworklabs.workers.dev/v1/email-auth?domain=github.com&selectors=google%2Cselector1

Example response
{
  "domain": "example.com",
  "checks": [
    {
      "id": "spf",
      "status": "pass",
      "detail": "valid, 6/10 DNS lookups"
    },
    {
      "id": "dmarc",
      "status": "pass",
      "detail": "p=reject"
    },
    {
      "id": "dkim",
      "status": "pass",
      "detail": "key(s) at selector(s) google (2048-bit)"
    }
  ],
  "bulkSenderReadiness": {
    "verdict": "likely_compliant"
  },
  "spf": {
    "domain": "example.com",
    "record": "v=spf1 include:_spf.google.com include:sendgrid.net ~all",
    "status": "valid",
    "lookupCount": 6,
    "lookupLimit": 10,
    "voidLookups": 0,
    "allQualifier": "~all",
    "problems": [],
    "warnings": [],
    "tree": {
      "domain": "example.com",
      "lookups": 6,
      "terms": [
        {
          "term": "include:_spf.google.com",
          "lookups": 4
        },
        {
          "term": "include:sendgrid.net",
          "lookups": 2
        }
      ]
    }
  },
  "dmarc": {
    "domain": "example.com",
    "record": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
    "status": "valid",
    "policy": "reject",
    "subdomainPolicy": "reject",
    "pct": 100,
    "alignment": {
      "dkim": "relaxed",
      "spf": "relaxed"
    },
    "problems": [],
    "warnings": []
  }
}

GET /v1/spf — $0.001 USDC

Expands a domain's SPF record recursively (include/redirect) like a receiver does and counts DNS-querying terms against the RFC 7208 limit of 10 and void lookups against the limit of 2. Returns per-term lookup costs, problems (permerror causes) and warnings. Deterministic, no AI.

ParamRequiredDescription
domainyesDomain to check Example: github.com

Example request: https://email-auth-check.quietworklabs.workers.dev/v1/spf?domain=github.com

Example response
{
  "domain": "example.com",
  "record": "v=spf1 include:_spf.google.com include:sendgrid.net ~all",
  "status": "valid",
  "lookupCount": 6,
  "lookupLimit": 10,
  "voidLookups": 0,
  "allQualifier": "~all",
  "problems": [],
  "warnings": [],
  "tree": {
    "domain": "example.com",
    "lookups": 6,
    "terms": [
      {
        "term": "include:_spf.google.com",
        "lookups": 4
      },
      {
        "term": "include:sendgrid.net",
        "lookups": 2
      }
    ]
  }
}

GET /v1/dmarc — $0.001 USDC

Finds and validates a domain's DMARC record (falls back to the organizational domain): policy, subdomain policy, pct, alignment modes, rua/ruf, and whether external report domains authorized reports (RFC 7489 7.1). Deterministic, no AI.

ParamRequiredDescription
domainyesDomain to check Example: github.com

Example request: https://email-auth-check.quietworklabs.workers.dev/v1/dmarc?domain=github.com

Example response
{
  "domain": "example.com",
  "record": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
  "status": "valid",
  "policy": "reject",
  "subdomainPolicy": "reject",
  "pct": 100,
  "alignment": {
    "dkim": "relaxed",
    "spf": "relaxed"
  },
  "problems": [],
  "warnings": []
}

GET /v1/domain-expiry — $0.002 USDC

Registration data for a domain from the registry's RDAP server (IANA bootstrap): registrar, created/updated/expiry dates, days until expiry with ok/expiring_soon/expired status, EPP status codes, nameservers and DNSSEC. Works for gTLDs and ccTLDs that publish RDAP. Deterministic, no AI.

ParamRequiredDescription
domainyesDomain name Example: example.com

Example request: https://email-auth-check.quietworklabs.workers.dev/v1/domain-expiry?domain=example.com

Example response
{
  "domain": "example.com",
  "registered": true,
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "created": "1995-08-14T04:00:00Z",
  "expires": "2027-08-13T04:00:00Z",
  "daysUntilExpiry": 300,
  "expiryStatus": "ok",
  "status": [
    "client delete prohibited"
  ],
  "nameservers": [
    "a.iana-servers.net",
    "b.iana-servers.net"
  ],
  "dnssec": true
}