Developer Tools

Email Deliverability & DNS Health API API

The Email Deliverability & DNS Health API returns a domain's email authentication and DNS posture as clean JSON.

12 actionsLive JSON1,000 free creditsMCP-ready

🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.

The primary check endpoint returns an overall score and grade with a breakdown, plus per-record results for SPF, DKIM, DMARC, MX, BIMI, MTA-STS, TLS-RPT, DNSSEC and DANE. It is built for deliverability tools, security audits and onboarding checks that need a complete email-DNS health signal without running a dozen separate lookups. One ReefAPI key, one shared credit pool, the standard envelope.

Live example

Real request and response JSON

Captured from the indexed primary action, check, on Jul 18, 2026, 5:19 PM UTC.

Captured request

{
  "method": "POST",
  "url": "https://api.reefapi.com/email-health/v1/check",
  "headers": {
    "x-api-key": "$REEF_KEY",
    "content-type": "application/json"
  },
  "body": {
    "domain": "google.com"
  }
}

Captured response

{
  "ok": true,
  "meta": {
    "api": "email-health",
    "endpoint": "check",
    "mode": "live",
    "latency_ms": 7173.5,
    "record_count": 3,
    "bytes": 72303,
    "cache_hit": false,
    "method": "doh:cloudflare+google",
    "score": 80,
    "grade": "B"
  },
  "data": {
    "domain": "google.com",
    "score": {
      "score": 80,
      "max": 100,
      "grade": "B",
      "breakdown": {
        "mx": {
          "score": 20,
          "max": 20,
          "note": "1 MX record(s) — Google Workspace"
        },
        "spf": {
          "score": 22,
          "max": 22,
          "note": "valid SPF, 1/10 lookups, all=~"
        },
        "dmarc": {
          "score": 22,
          "max": 22,
          "note": "p=reject pct=100"
        },
        "dkim": {
          "score": 0,
          "max": 16,
          "note": "no DKIM for tested selector(s)"
        },
        "blacklist": {
          "score": 10,
          "max": 10,
          "note": "clean across 15 DNSBLs"
        },
        "mta_sts": {
          "score": 4,
          "max": 4,
          "note": "enforce"
        },
        "dnssec": {
          "score": 0,
          "max": 3,
          "note": "unsigned"
        },
        "tls_rpt": {
          "score": 2,
          "max": 2,
          "note": "present"
        },
        "bimi": {
          "score": 0,
          "max": 1,
          "note": "absent"
        }
      }
    },
    "summary": {
      "has_spf": true,
      "spf_valid": true,
      "has_dmarc": true,
      "dmarc_enforced": true,
      "has_dkim": false,
      "has_mx": true,
      "mx_provider": "Google Workspace",
      "has_bimi": false,
      "mta_sts_enforced": true,
      "dnssec_signed": false,
      "has_tls_rpt": true,
      "has_dane": false,
      "blacklisted": false,
      "blacklist_listings": 0
    },
    "issues": [
      "DKIM record(s) present but all have an empty p= (revoked) — no usable signing key",
      "selector '20230601' has an empty p= (key revoked)",
      "selector '20161025' has an empty p= (key revoked)"
    ],
    "spf": {
      "domain": "google.com",
      "found": true,
      "record": "v=spf1 include:_spf.google.com ~all",
      "valid": true,
      "dns_lookups": 1,
      "void_lookups": 0,
      "policy": "softfail (recommended)",
      "mechanisms": [
        "include:_spf.google.com",
        "~all"
      ],
      "includes": [
        "_spf.google.com"
      ],
      "all_qualifier": "~",
      "issues": [],
      "include_tree": [
        {
          "target": "_spf.google.com",
          "record": "v=spf1 ip4:[redacted-phone]/16 ip4:[redacted-phone]/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all",
          "lookups": 0,
          "void": 0
        }
      ]
    },
    "dkim": {
      "domain": "google.com",
      "found": false,
      "record_exists": true,
      "wildcard_revoke": false,
      "selectors_tested": [
        "google",
        "20230601",
        "20161025"
      ],
      "selectors_found": [],
      "selectors_with_record": [
        "20230601",
        "20161025"
      ],
      "records": [
        {
          "selector": "google",
          "found": false,
          "usable": false,
          "name": "google._domainkey.google.com",
          "record": null,
          "_bytes": 509
        },
        {
          "selector": "20230601",
          "found": true,
          "usable": false,
          "name": "20230601._domainkey.google.com",
          "record": "v=DKIM1; k=rsa; p=",
          "_bytes": 236,
          "key_type": "rsa",
          "public_key_present": false,
          "revoked": true,
          "flags": null
        },
        {
          "selector": "20161025",
          "found": true,
          "usable": false,
          "name": "20161025._domainkey.google.com",
          "record": "k=rsa; p=",
          "_bytes": 227,
          "key_type": "rsa",
          "public_key_present": false,
          "revoked": true,
          "flags": null
        }
      ],
      "issues": [
        "DKIM record(s) present but all have an empty p= (revoked) — no usable signing key",
        "selector '20230601' has an empty p= (key revoked)",
        "selector '20161025' has an empty p= (key revoked)"
      ]
    },
    "dmarc": {
      "domain": "google.com",
      "found": true,
      "record": "v=DMARC1; p=reject; rua=mailto:[redacted-email]",
      "valid": true,
      "policy": "reject",
      "subdomain_policy": "reject",
      "pct": 100,
      "rua": [
        "mailto:[redacted-email]"
      ],
      "ruf": [],
      "adkim": "r",
      "aspf": "r",
      "fo": "0",
      "issues": [],
      "tags": {
        "v": "DMARC1",
        "p": "reject",
        "rua": "mailto:[redacted-email]"
      },
      "enforced": true
    },
    "mx": {
      "domain": "google.com",
      "found": true,
      "count": 1,
      "records": [
        {
          "preference": 10,
          "exchange": "smtp.google.com"
        }
      ],
      "hosts": [
        "smtp.google.com"
      ],
      "provider": "Google Workspace",
      "issues": []
    },
    "bimi": {
      "domain": "google.com",
      "found": false,
      "record": null,
      "selector": "default",
      "logo_url": null,
      "vmc_url": null
    },
    "mta_sts": {
      "domain": "google.com",
      "found": true,
      "record": "v=STSv1; id=20210803T010101;",
      "id": "20210803T010101",
      "policy": null,
      "mode": "enforce",
      "mx": [
        "smtp.google.com",
        "aspmx.l.google.com",
        "*.aspmx.l.google.com"
      ],
      "max_age": 86400,
      "policy_fetched": true,
      "issues": [],
      "policy_url": "https://mta-sts.google.com/.well-known/mta-sts.txt",
      "enforced": true
    },
    "tls_rpt": {
      "domain": "google.com",
      "found": true,
      "record": "v=TLSRPTv1;rua=mailto:[redacted-email]",
      "rua": [
        "mailto:[redacted-email]"
      ]
    },
    "dnssec": {
      "domain": "google.com",
      "validated_ad_flag": false,
      "has_ds_record": false,
      "signed": false
    },
    "dane": {
      "domain": "google.com",
      "found": false,
      "mx_hosts_checked": [
        "smtp.google.com"
      ],
      "hosts": [
        {
          "mx_host": "smtp.google.com",
          "name": "_25._tcp.smtp.google.com",
          "found": false,
          "records": [],
          "dnssec_validated": false
        }
      ],
      "record_count": 0,
      "issues": []
    },
    "blacklist": {
      "domain": "google.com",
      "checked_ips": [
        "[redacted-phone]",
        "[redacted-phone]",
        "[redacted-phone]"
      ],
      "ptr_records": {
        "142.251.163.100": "wv-in-f100.1e100.net",
        "142.251.163.101": "wv-in-f101.1e100.net",
        "142.251.163.102": "wv-in-f102.1e100.net",
        "142.251.163.113": "wv-in-f113.1e100.net",
        "142.251.163.138": "wv-in-f138.1e100.net",
        "142.251.163.139": "wv-in-f139.1e100.net",
        "172.253.115.26": "bg-in-f26.1e100.net",
        "172.253.122.26": "bh-in-f26.1e100.net",
        "172.253.139.26": "yuiadsk-in-f26.1e100.net",
        "172.253.63.26": "bi-in-f26.1e100.net",
        "172.253.63.27": "bi-in-f27.1e100.net"
      },
      "listings": [],
      "listed_count": 0,
      "clean": true,
      "checks_run": 165,
      "resolver_refused_count": 0,
      "zones_checked": [
        "bl.spamcop.net",
        "b.barracudacentral.org",
        "dnsbl-1.uceprotect.net"
      ],
      "paid_key_zones": [
        {
          "zone": "zen.spamhaus.org",
          "name": "[redacted-name]",
          "reason": "returns [redacted-phone] on public resolvers — needs a Spamhaus DQS (Data Query Service) key"
        },
        {
          "zone": "cbl.abuseat.org",
          "name": "[redacted-name]",
          "reason": "served via Spamhaus infra — same public-resolver refusal"
        }
      ],
      "issues": []
    }
  }
}

Actions

What the Email Deliverability & DNS Health API API does

Action	Description	Concrete use case	Key params
check	Full email-health audit: SPF + DKIM + DMARC + MX + BIMI + MTA-STS + TLS-RPT + DNSSEC + blacklist, plus a 0-100 deliverability score and letter grade.	Ops teams call check to get full email-health audit.	domain, selector, selectors, bimi_selector, skip_blacklist
spf	Parse + validate the SPF record: follow include:/redirect=, count the ≤10 DNS-lookup mechanisms, flag +all and void lookups, report the all-qualifier policy.	Developer tools call spf to parse + validate the SPF record.	domain
dmarc	Parse the DMARC policy at _dmarc.<domain>: p/sp/pct/rua/ruf/adkim/aspf/fo + enforcement verdict.	Validation workflows call dmarc to parse the DMARC policy at _dmarc.<domain>.	domain
dkim	DKIM selector lookup (<selector>._domainkey.<domain>): key type, public-key presence, RSA key-bit estimate, revocation. Autoscans ~30 common selectors if none given.	Data-quality teams call dkim to get dKIM selector lookup (<selector>._domainkey.<domain>).	domain, selector, selectors
mx	MX records (sorted by preference) + a mail-provider guess from the exchange hostnames.	Ops teams call mx to get mX records (sorted by preference) + a mail-provider guess from the exchange hostnames..	domain
blacklist	DNSBL reputation: reverse the domain's A + MX-host IPs against live-proven public DNSBLs (SpamCop, Barracuda, UCEPROTECT, PSBL, Mailspike, GBUdb, DroneBL, s5h). Spamhaus/CBL are flagged as paid-key-required (public-resolver refused), not queried.	Developer tools call blacklist to get dNSBL reputation.	domain, ips
mta_sts	MTA-STS: the _mta-sts.<domain> TXT (id) plus the fetched https://mta-sts.<domain>/.well-known/mta-sts.txt policy (mode, mx[], max_age).	Validation workflows call mta_sts to get mTA-STS.	domain
bimi	BIMI brand-logo record at <selector>._bimi.<domain>: the published logo (SVG) URL and the VMC (Verified Mark Certificate) URL, plus whether a VMC is present. Standalone lookup (MXToolbox SuperTool exposes BIMI on its own — no full audit needed).	Data-quality teams call bimi to get bIMI brand-logo record at <selector>._bimi.<domain>.	domain, selector
tls_rpt	SMTP TLS Reporting (RFC 8460) record at _smtp._tls.<domain>: the rua= report destination(s) that receive aggregate TLS-negotiation failure reports. Standalone lookup.	Ops teams call tls_rpt to get sMTP TLS Reporting (RFC 8460) record at _smtp._tls.<domain>.	domain
dnssec	DNSSEC signing status: the DoH AD (Authenticated-Data) flag = the resolver cryptographically validated the answer, plus a DS record at the parent = the delegation is signed. Standalone lookup.	Developer tools call dnssec to get dNSSEC signing status.	domain
dane	DANE for SMTP (RFC 7672): TLSA records at _25._tcp.<mx-host> for every MX host, with per-host DNSSEC validation (DANE is only effective on a signed TLSA RRset). Value-add: MXToolbox has NO TLSA/DANE lookup.	Validation workflows call dane to get dANE for SMTP (RFC 7672).	domain
batch	Run the full 'check' audit on up to 25 domains in one call (each with score + grade).	Data-quality teams call batch to get run the full 'check' audit on up to 25 domains in one call (each with score + grade)..	domains, skip_blacklist

Code samples

Call check from your stack

curl -X POST https://api.reefapi.com/email-health/v1/check \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"domain":"google.com"}'

import requests

r = requests.post(
    "https://api.reefapi.com/email-health/v1/check",
    headers={"x-api-key": REEF_KEY},
    json={
  "domain": "google.com"
},
)
print(r.json()["data"])

const res = await fetch("https://api.reefapi.com/email-health/v1/check", {
  method: "POST",
  headers: {
    "x-api-key": process.env.REEF_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({
  "domain": "google.com"
}),
});
const { ok, data, meta, error } = await res.json();

MCP one-liner

Ask your MCP-connected assistant: call reefapi.email-health.check with {"domain":"google.com"}.

Use cases

Who uses this API and why

Deliverability tools call check to grade a sending domain's SPF, DKIM and DMARC before a campaign.
Security audits use dmarc and mta_sts to confirm a domain's anti-spoofing posture.
Onboarding flows use the overall score to warn customers about misconfigured email DNS.

FAQ

Questions developers ask before integrating

What is the Email Deliverability & DNS Health API API?

Email Deliverability & DNS Health API API is a ReefAPI endpoint group for email deliverability & dns health api It returns live JSON through POST requests under /email-health/v1.

Is the Email Deliverability & DNS Health API API free to try?

Yes. ReefAPI starts with 1,000 free credits, no card required. Email Deliverability & DNS Health API calls use the same shared credit balance as every other ReefAPI engine.

Do I need a Email Deliverability & DNS Health API login or account?

No login to Email Deliverability & DNS Health API is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.

How fresh is the Email Deliverability & DNS Health API data?

The page example is captured from a live check call, and production requests fetch live data through ReefAPI rather than a static sample.

How many credits does the Email Deliverability & DNS Health API API use?

Email Deliverability & DNS Health API actions currently cost 1 credit per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.

Can I call Email Deliverability & DNS Health API from an AI assistant or MCP client?

Yes. Connect ReefAPI once through MCP and your assistant can call email-health actions with the same key, credit pool and JSON envelope used by normal REST requests.

Is the Email Deliverability & DNS Health API API a Email Deliverability & DNS Health API scraper?

It is the managed alternative to a DIY Email Deliverability & DNS Health API scraper. Instead of building and maintaining your own scraper — proxies, headless browsers, captcha and constant breakage — you call one ReefAPI endpoint and get the same email deliverability & dns health api back as clean JSON.

Why does my Email Deliverability & DNS Health API scraper keep getting blocked?

Most Email Deliverability & DNS Health API scrapers break on anti-bot defenses, rate limits and IP bans that need rotating residential proxies and browser fingerprinting to clear. ReefAPI handles all of that for you — no proxies, no captchas, no maintenance — and returns live JSON. Blocked or failed calls are free.

docs / email-health

Email Deliverability & DNS Health API

base /email-health/v112 endpoints

post/email-health/v1/check1 credit

Full email-health audit: SPF + DKIM + DMARC + MX + BIMI + MTA-STS + TLS-RPT + DNSSEC + blacklist, plus a 0-100 deliverability score and letter grade.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).
selector	optional	—	DKIM selector (the label before ._domainkey, e.g. 'google', 'selector1', 'k1'). Omit to autoscan ~30 common ESP selectors. DKIM selectors are provider-specific — pass the exact one if you know it.
selectors	optional	—	Optional comma-separated list (or array) of DKIM selectors to test instead of the common-selector autoscan.
bimi_selector = default	optional	—	BIMI selector (default per the BIMI spec is 'default').
skip_blacklist = false	optional	—	If true, skip the DNSBL reputation lookups in 'check' (faster; blacklist is the slowest section — many IP×zone DoH queries).

Try in playground →

post/email-health/v1/spf1 credit

Parse + validate the SPF record: follow include:/redirect=, count the ≤10 DNS-lookup mechanisms, flag +all and void lookups, report the all-qualifier policy.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/dmarc1 credit

Parse the DMARC policy at _dmarc.<domain>: p/sp/pct/rua/ruf/adkim/aspf/fo + enforcement verdict.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/dkim1 credit

DKIM selector lookup (<selector>._domainkey.<domain>): key type, public-key presence, RSA key-bit estimate, revocation. Autoscans ~30 common selectors if none given.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).
selector	optional	—	DKIM selector (the label before ._domainkey, e.g. 'google', 'selector1', 'k1'). Omit to autoscan ~30 common ESP selectors. DKIM selectors are provider-specific — pass the exact one if you know it.
selectors	optional	—	Optional comma-separated list (or array) of DKIM selectors to test instead of the common-selector autoscan.

Try in playground →

post/email-health/v1/mx1 credit

MX records (sorted by preference) + a mail-provider guess from the exchange hostnames.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/blacklist1 credit

DNSBL reputation: reverse the domain's A + MX-host IPs against live-proven public DNSBLs (SpamCop, Barracuda, UCEPROTECT, PSBL, Mailspike, GBUdb, DroneBL, s5h). Spamhaus/CBL are flagged as paid-key-required (public-resolver refused), not queried.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).
ips	optional	—	Optional explicit IPv4 list (comma-separated or array) to check against the DNSBLs. Omit to auto-resolve the domain's A + MX-host IPs.

Try in playground →

post/email-health/v1/mta_sts1 credit

MTA-STS: the _mta-sts.<domain> TXT (id) plus the fetched https://mta-sts.<domain>/.well-known/mta-sts.txt policy (mode, mx[], max_age).

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/bimi1 credit

BIMI brand-logo record at <selector>._bimi.<domain>: the published logo (SVG) URL and the VMC (Verified Mark Certificate) URL, plus whether a VMC is present. Standalone lookup (MXToolbox SuperTool exposes BIMI on its own — no full audit needed).

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).
selector = default	optional	—	BIMI selector — the label before ._bimi (default per the BIMI spec is 'default'; large senders sometimes publish per-brand selectors).

Try in playground →

post/email-health/v1/tls_rpt1 credit

SMTP TLS Reporting (RFC 8460) record at _smtp._tls.<domain>: the rua= report destination(s) that receive aggregate TLS-negotiation failure reports. Standalone lookup.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/dnssec1 credit

DNSSEC signing status: the DoH AD (Authenticated-Data) flag = the resolver cryptographically validated the answer, plus a DS record at the parent = the delegation is signed. Standalone lookup.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/dane1 credit

DANE for SMTP (RFC 7672): TLSA records at _25._tcp.<mx-host> for every MX host, with per-host DNSSEC validation (DANE is only effective on a signed TLSA RRset). Value-add: MXToolbox has NO TLSA/DANE lookup.

Parameter		Allowed / range	Description
domain	required	—	The domain to inspect (a bare host like github.com; a full URL, a leading www., or a full email address are accepted and normalized to the registrable domain).

Try in playground →

post/email-health/v1/batch1 credit

Run the full 'check' audit on up to 25 domains in one call (each with score + grade).

Parameter		Allowed / range	Description
domains	required	—	Comma-separated list (or array) of up to 25 domains to run a full health check on in one call.
skip_blacklist = false	optional	—	If true, skip the DNSBL reputation lookups in 'check' (faster; blacklist is the slowest section — many IP×zone DoH queries).

Try in playground →

Example request · check

curl -X POST https://api.reefapi.com/email-health/v1/check \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"domain":"google.com"}'

Response shape

{
  "ok": true,
  "data": { /* the result */ },
  "meta": {
    "latency_ms": 240,
    "record_count": 12,
    "completeness_pct": 100
  },
  "error": null
}