Email Security API — SPF, DMARC, and DKIM in one call.
SPF and DMARC presence and records, plus DKIM keys found by probing 29 common selectors. You don't need to know the selector.
// Run a lookup to see the JSON response
Long arrays are shortened here. The API returns them in full.
curl "https://domain-intelligence-api.p.rapidapi.com/domain/example.com/email-security" \
-H "X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com" \
-H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY"
import requests
domain = "example.com"
r = requests.get(
f"https://domain-intelligence-api.p.rapidapi.com/domain/{domain}/email-security",
headers={
"X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
},
timeout=15,
)
data = r.json()
if not data["spf"]["present"]:
print(f"WARN: {domain} has no SPF record")
if not data["dmarc"]["present"]:
print(f"WARN: {domain} has no DMARC record")
if data["dkim"]["found"]:
print(f"OK: DKIM selectors {data['dkim']['found']}")
else:
print(f"WARN: no DKIM key on the 29 common selectors")
// Node 18+ (built-in fetch)
const res = await fetch(
"https://domain-intelligence-api.p.rapidapi.com/domain/example.com/email-security",
{ headers: {
"X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
} }
);
console.log(await res.json());
<?php
$ch = curl_init("https://domain-intelligence-api.p.rapidapi.com/domain/example.com/email-security");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key: YOUR_RAPIDAPI_KEY",
]);
$data = json_decode(curl_exec($ch), true);
print_r($data);
What you get
DKIM without the selector
29 selectors checked, including google (Google Workspace), selector1/selector2 (Microsoft 365), k1–k3 (Mailchimp), s1/s2 (SendGrid), pm (Postmark), mandrill, klaviyo, mailgun and generic names.
Raw SPF and DMARC
present says whether a record exists; records gives the exact text to check includes or the DMARC policy.
Provider fingerprint
Matching selectors hint at the mail providers a domain uses.
31 lookups, one call
1 SPF, 1 DMARC and 29 DKIM queries, run in parallel. Cached for 1 hour.
Response fields
GET/domain/{domain}/email-security returns one JSON object. The same object is the email_security key of /lookup/{domain}.
| Field | Type | Meaning |
|---|---|---|
| spf.present / spf.records | boolean, string[] | SPF record from the domain's TXT records |
| dmarc.present / dmarc.records | boolean, string[] | Record at _dmarc.<domain> |
| dkim.found | string[] | Selectors that returned a DKIM key |
| dkim.records | {selector, records}[] | The public key records |
| dkim.note | string | Reminder that custom selectors can't be discovered |
Example response for stripe.com (arrays shortened)
{
"spf": {
"present": true,
"records": [
"v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all"
]
},
"dmarc": {
"present": true,
"records": [
"v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;"
]
},
"dkim": {
"found": [
"google",
"s1",
"s2",
"mandrill",
"intercom",
"m1"
],
"records": [
{
"selector": "google",
"records": [
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4T1…"
]
}
],
"note": "Probed common selectors (Google, Microsoft 365, Mailchimp, SendGrid, etc.). Custom or hash-based selectors aren't auto-discoverable."
}
}
What people build with it
Deliverability audits
Check your sending domains for missing SPF includes, a weak DMARC policy or broken DKIM.
SaaS onboarding checks
Verify a customer's sending domain before letting them send through your platform.
Anti-phishing
Flag sender domains with missing or weak email authentication.
DMARC rollout tracking
Track the move from p=none to quarantine to reject across your domains.
Provider fingerprinting
DKIM selectors show which mail providers a company uses.
Compliance evidence
Record SPF, DMARC and DKIM status for SOC 2 or ISO 27001 audits.
Pricing
One key covers every endpoint, including /lookup with all five signals in one call. Billed monthly through RapidAPI.
Frequently asked questions
Is your Email Security API free?
Yes. The free tier includes 1,000 requests a month with no credit card. Paid plans start at $9.99/mo for 50,000 requests.
What does DKIM 'auto-probed across 29 selectors' mean?
DKIM keys live at names like google._domainkey.example.com, and DNS has no way to list a domain's selectors. The API checks 29 common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Postmark, Mandrill, Klaviyo, Mailgun and generic names), so you don't need to know the selector.
What if my domain uses a custom DKIM selector?
It won't be found by probing, and the note field says so. Hash-based selectors, such as Amazon SES ones, have to be queried directly at <selector>._domainkey.<domain>.
Does this validate SPF/DMARC syntax?
No. It returns whether each record exists and the raw record text. Parse mechanisms or policy in your code or with an SPF/DMARC library.
How fresh is the data?
An uncached request resolves live. Successful responses are cached for 1 hour.
What's the rate limit?
Limits are monthly, per plan: 1,000 requests on BASIC, 50,000 on PRO, 500,000 on ULTRA and 5,000,000 on MEGA. On paid plans, requests over the quota are billed at the overage rate.
Does this check BIMI, MTA-STS, or DNSBL?
No. The scope is SPF, DMARC and DKIM. DNS blocklist checks are better served by dedicated abuse-tracking services.
Can I use this to audit email deliverability for outbound mail?
Yes. Run it on your sending domains to confirm SPF includes, an enforced DMARC policy (p=quarantine or p=reject) and DKIM signing. Run it regularly to catch DNS drift.