Every API, one clean contract.

Full email-health audit: SPF + DKIM + DMARC + MX + BIMI + MTA-STS + TLS-RPT + DNSSEC + blacklist, plus a 0-100 deliverability score and letter grade.

{
  "domain": "google.com"
}

Parse + validate the SPF record: follow include:/redirect=, count the ≤10 DNS-lookup mechanisms, flag +all and void lookups, report the all-qualifier policy.

{
  "domain": "google.com"
}

Parse the DMARC policy at _dmarc.<domain>: p/sp/pct/rua/ruf/adkim/aspf/fo + enforcement verdict.

{
  "domain": "paypal.com"
}

DKIM selector lookup (<selector>._domainkey.<domain>): key type, public-key presence, RSA key-bit estimate, revocation. Autoscans ~30 common selectors if none given.

{
  "domain": "paypal.com",
  "selector": "pp2"
}

MX records (sorted by preference) + a mail-provider guess from the exchange hostnames.

{
  "domain": "github.com"
}

DNSBL reputation: reverse the domain's A + MX-host IPs against live-proven public DNSBLs (SpamCop, Barracuda, UCEPROTECT, PSBL, Mailspike, GBUdb, DroneBL, s5h). Spamhaus/CBL are flagged as paid-key-required (public-resolver refused), not queried.

{
  "domain": "github.com"
}

MTA-STS: the _mta-sts.<domain> TXT (id) plus the fetched https://mta-sts.<domain>/.well-known/mta-sts.txt policy (mode, mx[], max_age).

{
  "domain": "google.com"
}

BIMI brand-logo record at <selector>._bimi.<domain>: the published logo (SVG) URL and the VMC (Verified Mark Certificate) URL, plus whether a VMC is present. Standalone lookup (MXToolbox SuperTool exposes BIMI on its own — no full audit needed).

{
  "domain": "cnn.com"
}

SMTP TLS Reporting (RFC 8460) record at _smtp._tls.<domain>: the rua= report destination(s) that receive aggregate TLS-negotiation failure reports. Standalone lookup.

{
  "domain": "google.com"
}

DNSSEC signing status: the DoH AD (Authenticated-Data) flag = the resolver cryptographically validated the answer, plus a DS record at the parent = the delegation is signed. Standalone lookup.

{
  "domain": "cloudflare.com"
}

DANE for SMTP (RFC 7672): TLSA records at _25._tcp.<mx-host> for every MX host, with per-host DNSSEC validation (DANE is only effective on a signed TLSA RRset). Value-add: MXToolbox has NO TLSA/DANE lookup.

{
  "domain": "internet.nl"
}

Run the full 'check' audit on up to 25 domains in one call (each with score + grade).