Zactonz Developers
Status Console Get an API key

Domain Email Health

API key v1

MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and disposable-domain checks with a score.

Audits everything a receiving mail server looks at before trusting mail from a domain: MX records and their reachability, SPF syntax and the ten-lookup limit, DKIM keys under common or supplied selectors with key sizes, DMARC policy and reporting, MTA-STS and TLS-RPT, BIMI, and whether the domain is a known disposable or free provider. Returns a 0 to 100 score, a letter grade and a findings list with codes and severities.

GET https://api.zactonz.com/email/domain/

Parameters

NameTypeDescription
domainrequired string

Domain to audit. An email address is accepted and reduced to its domain.
selectors string

Comma-separated DKIM selectors to check in addition to the common ones, up to 20.
probe boolean

1 connects to the primary MX to read its banner and STARTTLS support.

Default

Send parameters in the query string.

Response

OK

FieldTypeDescription
status integer

200 on success.
data object

The result.
data.domain string

Domain audited.
data.score integer

0 to 100.
data.grade string

A to F.
data.disposable boolean

Known disposable-address provider.
data.free_provider boolean

Consumer webmail provider.
data.mx array of object

MX hosts with priority, exchange, addresses and, with probe=1, smtp (reachable, banner, starttls).
data.spf object

present, record, valid, all qualifier, DNS lookups, mechanisms.
data.dkim array of object

Keys found: selector, key_type, key_bits, revoked, testing.
data.dmarc object

present, record, policy, subdomain_policy, pct, rua, ruf, adkim, aspf.
data.mta_sts object

present, record, fetched policy.
data.tls_rpt object

present, record.
data.bimi object

present, record.
data.findings array of object

Each with code, severity (critical, warning, info) and message.
data.checked_selectors array of string

Selectors that were queried.
data.checked_at string

Timestamp.

Status codes

The outcome is reported in the JSON status field. See Errors & status codes for the general rules.

400 Bad request

domain is missing or not a domain name.
401 Unauthorized

The Authorization header is missing or the key is not recognised.
403 Forbidden

The key is not licensed for this product.
429 Too many requests

The per-minute rate or the plan quota is exhausted. Retry after the seconds given in Retry-After.

Notes

Complements Mail Verifier, which checks individual mailboxes. Answers are cached for ten minutes. probe=1 connects to the primary MX on port 25 to read the banner and STARTTLS support.