DOMAIN & EMAIL SECURITY

Turn DNS and email policies into structured checks.

Inspect a domain's public configuration through one API. Use individual findings in setup assistants, agency reports and technical support tools, with the checked coverage included in every response.

Start with 25 free domain audits

Checks and their boundaries

Check	Current coverage
DNS and MX	Public records and mail-routing configuration.
SPF	Record configuration and bounded include traversal; not a sender-IP evaluation.
DKIM	Published keys for up to five supplied selectors, or one automatic default-selector lookup when omitted; not message-signature verification.
DMARC	Direct-domain policy syntax; organizational-domain discovery and message alignment are not evaluated.
BIMI	Record syntax, not logo, VMC or CMC validation.
MTA-STS and TLS-RPT	Published records and HTTPS policy.
DNSSEC	Resolver authentication evidence, plus authenticated DS denial at a confirmed zone apex to identify an unsigned delegation. Ambiguous results remain unknown.
HTTPS certificate	Public port 443, hostname, trust and expiry checks; not SMTP/STARTTLS.

Tell the API which DKIM selectors to inspect

POST https://api.apivect.com/v1/domains/audit
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
Idempotency-Key: domain-audit-example-0001

{"domain":"apivect.com","dkimSelectors":["default"]}

Selector names are supplied by the domain's mail provider. Without a selector, the API checks only default. If no key is found there, DKIM is marked not_tested; this does not prove that another selector is absent.

Interpret findings individually

Check statuses include pass, warning, fail, unknown, not_tested and not_configured. Missing optional BIMI/MTA-STS/TLS reporting records use not_configured. Each check includes a plain-language summary, an optional recommendation and bounded observed DNS records. A soft-fail SPF policy is a review item, not a claim that an actual email failed. A completed audit counts as one operation even when configuration problems are found. A wholly inconclusive operation consumes zero units. Exact idempotent retries within 24 hours do not add usage.

Bounded public network access

ApiVect rejects IP literals, local names and nonpublic destinations. HTTPS checks use fixed paths, port 443, certificate validation and no redirects. DNS queries go to Cloudflare's public DNS-over-HTTPS resolver. No SMTP messages are sent.

This endpoint provides an on-demand configuration audit. Scheduled monitoring, inbox-placement testing, domain ownership verification and deliverability guarantees are not included. Read the quickstart, API schemas and usage plans.

ILLUSTRATIVE EXAMPLE · SYNTHETIC DATA

See what a result looks like.

This fixed example explains the response format. It is not a live check of a company, invoice or domain.

SPF: Review the soft-fail policy; identify legitimate senders before making it stricter.
DKIM: Not tested conclusively: no key at the default selector. Supply known selectors to check them.
Optional policies: BIMI, MTA-STS and TLS-RPT are not configured in this example.
Certificate: Hostname and trust check passed; 60 days remaining at the example's check time.

Read the status and recommendation for each check. Optional settings, inconclusive evidence and confirmed failures have different meanings.

View the example JSON response

{
  "domain": "example.com",
  "checkedAt": "2026-09-16T12:00:00+00:00",
  "status": "warning",
  "checks": [
    {
      "check": "dns",
      "status": "pass",
      "code": "domain_resolves",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "The domain has a published IPv4 or IPv6 address.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "mx",
      "status": "pass",
      "code": "mx_published",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "Incoming mail servers are published in DNS.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "spf",
      "status": "warning",
      "code": "softfail_policy",
      "detail": "Configuration analysis only; no sender IP, HELO or MAIL FROM was evaluated.",
      "records": [
        "example.com TXT v=spf1 mx ~all"
      ],
      "evidenceLimited": false,
      "summary": "SPF is published with ~all (soft fail). Unlisted senders are treated as suspicious, rather than given an SPF hard fail.",
      "recommendation": "Confirm every legitimate sender is authorized before considering -all. Do not change this solely to make the report green.",
      "optional": false
    },
    {
      "check": "dmarc",
      "status": "pass",
      "code": "direct_policy_quarantine",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "DMARC requests quarantine for messages that fail aligned SPF and DKIM.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "dkim",
      "status": "not_tested",
      "code": "selector_required",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No DKIM key was found at the default selector. A different selector may be in use.",
      "recommendation": "Enter the selector supplied by your mail provider, or the s= value from a DKIM-Signature header. The d= domain in that header must match the domain you check.",
      "optional": false
    },
    {
      "check": "bimi",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No BIMI record is published. BIMI is an optional inbox-logo feature.",
      "recommendation": "Configure this only if you want supported mailboxes to display a verified brand logo. It is not required for ordinary email.",
      "optional": true
    },
    {
      "check": "mta_sts",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No MTA-STS record is published. This optional policy can strengthen encrypted mail delivery.",
      "recommendation": "An MTA-STS rollout needs a valid HTTPS policy and verified MX coverage. Start with testing before enforcing delivery requirements.",
      "optional": true
    },
    {
      "check": "tls_rpt",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No TLS reporting record is published. This optional feature reports mail encryption problems.",
      "recommendation": "Publish TLS reporting only after choosing and preparing the report destination.",
      "optional": true
    },
    {
      "check": "dnssec",
      "status": "unknown",
      "code": "no_authenticated_answer",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "DNSSEC validation could not be established for this answer.",
      "recommendation": "Try a new check later; this result does not by itself justify changing DNS.",
      "optional": false
    },
    {
      "check": "certificate",
      "status": "pass",
      "code": "hostname_and_chain_valid",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "The HTTPS certificate matches the hostname and has a trusted certificate chain.",
      "recommendation": null,
      "optional": false
    }
  ],
  "certificate": {
    "status": "pass",
    "expiresAt": "2026-11-15T12:00:00+00:00",
    "daysRemaining": 60,
    "reason": null,
    "revocation": "not_checked"
  },
  "resolver": "Cloudflare DNS over HTTPS",
  "version": "2026-09-2"
}

Download synthetic JSON example · Run your own check →