Email authentication API: SPF, DMARC and DKIM

Reference

Parameters

Name	Type	Required	Description
`domain`	string	yes	The sending domain, for example globus.studio.
`selector`	string	no	DKIM selectors, comma separated, up to five. Default: default.

Example request

curl -s "https://api2.globus.studio/v2/mail-auth?domain=globus.studio"

Open documentation

A message that fails authentication still gets delivered somewhere, usually to spam. Three DNS records decide whether receivers trust the sender: SPF lists the servers allowed to send, DKIM signs the message, and DMARC tells the receiver what to do when either check fails. This endpoint reads all three in one call and adds the MX records.

One verdict instead of three lookups

The SPF record is parsed into mechanisms, and the terms that cost a DNS query are counted, including nested includes and redirects. The RFC 7208 limit of ten is applied, so a chain that quietly breaks at the eleventh lookup shows up in verdict.issues. A record that ends in +all is reported as a failure, because any host on the internet may then send mail as the domain.

curl -s "https://api2.globus.studio/v2/mail-auth?domain=globus.studio&selector=default,google"

Selectors and keys

DKIM lives at selector._domainkey.domain, and the selector is chosen by the sender, not by the domain owner alone. Pass up to five selectors; default is checked when the parameter is missing. For RSA keys the endpoint reports the key size in bits, and it flags testing mode and revoked keys.

The DMARC block carries the policy, the subdomain policy, the percentage, the alignment modes and the report addresses. Missing report addresses matter more than they look: without rua the domain owner never sees which senders fail.

What counts as a problem

No MX records or a null MX means the domain does not receive mail at all, and the verdict says so. Missing SPF, missing DMARC, p=none, a partial pct, and no DKIM key among the selectors are listed as issues without failing the whole request. The level stays ok, warn or fail, so a monitor can alert on one field.

Answers are cached for fifteen minutes and the lookup has a five second budget.

The full parameter table, every error code and a live request are on the documentation page. It opens in the same language as this page and needs no account.

A longer walkthrough, with the checks that matter and the limits worth planning for: SPF, DMARC and DKIM: one check before the next campaign.