DEV Community

xusteve
xusteve

Posted on

How to Check SPF, DKIM and DMARC for Any Domain with a Free API

#api

How to Check SPF, DKIM and DMARC for Any Domain with a Free API

Email authentication is one of those things that only becomes urgent when a password reset, invoice, or onboarding email lands in spam.

SPF, DKIM, and DMARC are the three records that decide whether a receiving server can trust your domain. The hard part is not remembering the acronyms; it is checking all three quickly, from code, without sending a test email.

What each record does

  • SPF lists the servers allowed to send mail for your domain.
  • DKIM adds a cryptographic signature so the message can be verified as unaltered.
  • DMARC tells receivers what to do when SPF or DKIM alignment fails, and where to send reports.

A domain can have SPF and DKIM and still fail DMARC if the records are not aligned with the visible From domain. That is why checking them separately is useful.

A quick check from the terminal

Mailers.email exposes a free anonymous scan API. No API key is required, and the same-domain response is cached for 24 hours.

curl -s https://api.mailers.email/v1/scan \
  -H 'content-type: application/json' \
  -d '{"domain":"example.com"}'
Enter fullscreen mode Exit fullscreen mode

The response gives you the result of the domain checks rather than a single “pass” or “fail”. For a human-readable report, use the web scanner:

https://mailers.email/scan/
Enter fullscreen mode Exit fullscreen mode

The scanner also checks MX, reverse DNS, and blacklist status, which is useful when SPF and DKIM look correct but delivery still fails.

What to check before you send

  1. SPF exists, stays under the DNS lookup limit, and includes every sending service.
  2. DKIM is configured with a selector your provider actually signs with.
  3. DMARC exists and has a reporting address.
  4. The From domain aligns with the authenticated domain.
  5. Transactional and marketing mail do not share a damaged sending reputation.

Rate limits and scope

The public API is intentionally small:

  • POST /v1/scan
  • 60 requests per hour per IP
  • 24-hour cache per domain
  • no API key
  • no blacklist checks in the API (the web scanner includes them)

That makes it suitable for a quick health check, a CI smoke test, or an AI-agent tool — not for high-volume list validation.

Using it from an AI agent

The same service is available as an MCP server:

https://mcp.mailers.email/mcp
Enter fullscreen mode Exit fullscreen mode

The tool is called scan_domain. An agent can check a domain before drafting a deliverability recommendation instead of guessing from a static checklist.

The practical takeaway

Do not wait for a customer to report a missing email. Check the domain before launch, add the check to your release checklist, and re-check after changing an email provider or DNS record.

Free scanner: https://mailers.email/scan/

API and MCP docs: https://mailers.email/api/scan/

Top comments (0)