Email Security API — SPF, DMARC, and DKIM in one call.

SPF and DMARC presence and records, plus DKIM keys found by probing 29 common selectors. You don't need to know the selector.

1,000 requests a month freeNo credit cardDKIM on 29 selectors
Try
5 free live lookups left today
Loading an example…
Loading a cached example…
Live lookups run the same API your key calls.
Get the same JSON in your code. 1,000 requests a month free.Get free API key

What you get

DKIM without the selector

29 selectors checked, including google (Google Workspace), selector1/selector2 (Microsoft 365), k1–k3 (Mailchimp), s1/s2 (SendGrid), pm (Postmark), mandrill, klaviyo, mailgun and generic names.

Raw SPF and DMARC

present says whether a record exists; records gives the exact text to check includes or the DMARC policy.

Provider fingerprint

Matching selectors hint at the mail providers a domain uses.

31 lookups, one call

1 SPF, 1 DMARC and 29 DKIM queries, run in parallel. Cached for 1 hour.

Response fields

GET/domain/{domain}/email-security returns one JSON object. The same object is the email_security key of /lookup/{domain}.

FieldTypeMeaning
spf.present / spf.recordsboolean, string[]SPF record from the domain's TXT records
dmarc.present / dmarc.recordsboolean, string[]Record at _dmarc.<domain>
dkim.foundstring[]Selectors that returned a DKIM key
dkim.records{selector, records}[]The public key records
dkim.notestringReminder that custom selectors can't be discovered
Example response for stripe.com (arrays shortened)
{
  "spf": {
    "present": true,
    "records": [
      "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all"
    ]
  },
  "dmarc": {
    "present": true,
    "records": [
      "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;"
    ]
  },
  "dkim": {
    "found": [
      "google",
      "s1",
      "s2",
      "mandrill",
      "intercom",
      "m1"
    ],
    "records": [
      {
        "selector": "google",
        "records": [
          "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4T1…"
        ]
      }
    ],
    "note": "Probed common selectors (Google, Microsoft 365, Mailchimp, SendGrid, etc.). Custom or hash-based selectors aren't auto-discoverable."
  }
}

What people build with it

Deliverability audits

Check your sending domains for missing SPF includes, a weak DMARC policy or broken DKIM.

SaaS onboarding checks

Verify a customer's sending domain before letting them send through your platform.

Anti-phishing

Flag sender domains with missing or weak email authentication.

DMARC rollout tracking

Track the move from p=none to quarantine to reject across your domains.

Provider fingerprinting

DKIM selectors show which mail providers a company uses.

Compliance evidence

Record SPF, DMARC and DKIM status for SOC 2 or ISO 27001 audits.

Pricing

One key covers every endpoint, including /lookup with all five signals in one call. Billed monthly through RapidAPI.

BASIC$01,000 requests/mo, no card
PRO$9.9950,000 requests/mo
ULTRA$39.99500,000 requests/mo
MEGA$149.995,000,000 requests/mo

Frequently asked questions

Is your Email Security API free?

Yes. The free tier includes 1,000 requests a month with no credit card. Paid plans start at $9.99/mo for 50,000 requests.

What does DKIM 'auto-probed across 29 selectors' mean?

DKIM keys live at names like google._domainkey.example.com, and DNS has no way to list a domain's selectors. The API checks 29 common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Postmark, Mandrill, Klaviyo, Mailgun and generic names), so you don't need to know the selector.

What if my domain uses a custom DKIM selector?

It won't be found by probing, and the note field says so. Hash-based selectors, such as Amazon SES ones, have to be queried directly at <selector>._domainkey.<domain>.

Does this validate SPF/DMARC syntax?

No. It returns whether each record exists and the raw record text. Parse mechanisms or policy in your code or with an SPF/DMARC library.

How fresh is the data?

An uncached request resolves live. Successful responses are cached for 1 hour.

What's the rate limit?

Limits are monthly, per plan: 1,000 requests on BASIC, 50,000 on PRO, 500,000 on ULTRA and 5,000,000 on MEGA. On paid plans, requests over the quota are billed at the overage rate.

Does this check BIMI, MTA-STS, or DNSBL?

No. The scope is SPF, DMARC and DKIM. DNS blocklist checks are better served by dedicated abuse-tracking services.

Can I use this to audit email deliverability for outbound mail?

Yes. Run it on your sending domains to confirm SPF includes, an enforced DMARC policy (p=quarantine or p=reject) and DKIM signing. Run it regularly to catch DNS drift.