SPF, DKIM and DMARC Checker API

The scan.mx API runs a full email and DNS deliverability check for a domain and returns a graded JSON report. No API key, no authentication, no signup. It is suited to pre-send checks in a pipeline, monitoring a domain over time, and bulk auditing.

Reports are cached (up to 30 days) and rate-limited per IP and per (IP, domain) for abuse prevention.

European by default. Scanning server in the Netherlands, reports stored in an EU database. How the data is handled.

Quick start

# Full graded report as JSON
curl "https://api.scan.mx/v1/check?domain=example.com"

Add &smtp=1 to also queue a live SMTP probe. The probe is non-blocking, so start it first, then stream its progress from the stream endpoint:

# 1. Queue the live SMTP probe
curl "https://api.scan.mx/v1/check?domain=example.com&smtp=1"

# 2. Stream the probe result over Server-Sent Events
curl -N "https://api.scan.mx/v1/check/stream?domain=example.com"

Endpoints

Response

Returned by GET /v1/check:

{
  "domain": "example.com",
  "grade": "B",
  "score": 82,
  "provider": "Google Workspace",
  "smtp_status": "n/a",
  "sections": {
    "spf": {
      "score": 90,
      "grade": "A"
    }
  },
  "checks": [
    {
      "id": "spf.all_qualifier",
      "section": "spf",
      "status": "pass",
      "severity": "info",
      "message": "SPF ends in -all (hard fail).",
      "rfc": "RFC 7208"
    }
  ],
  "permalink": "https://scan.mx/example.com",
  "expires_at": 1712027200
}

Error responses

A domain that resolves but has no email records at all still returns a 200 report with email_configured: false and the individual missing-record checks. The absence is the diagnosis, not an error.

Streaming events

GET /v1/check/stream emits named Server-Sent Events for the live SMTP probe. Start the probe first with GET /v1/check?domain=...&smtp=1.

Terms and policies

Use of the API is subject to the scan.mx Terms of Service and Privacy Policy. Domain owners can opt out, which also documents the SMTP probe and how to verify it.