SPF, DKIM, DMARC, MX, BIMI — every DNS record that affects inbox placement, in one call. With a 0-100 score so your dashboard can show it without parsing 4 records.
curl "https://api.sitetrace.it.com/api/email?domain=github.com" | jq{
"domain": "github.com",
"score": 95,
"risk": "low",
"issues": [],
"checks": [
{ "id": "spf", "pass": true, "value": "v=spf1", "message": "SPF record found." },
{ "id": "spf_strict", "pass": true, "value": "-all", "message": "SPF ends with -all (strict)." },
{ "id": "spf_lookups", "pass": true, "value": 4, "message": "SPF uses 4 mechanisms (within RFC limit)." },
{ "id": "dkim", "pass": true, "value": "github.com", "message": "DKIM found at google._domainkey.github.com." },
{ "id": "dmarc", "pass": true, "value": "v=DMARC1", "message": "DMARC record found." },
{ "id": "dmarc_policy", "pass": true, "value": "reject", "message": "DMARC policy is \"reject\" (strictest)." },
{ "id": "mx", "pass": true, "value": "1 host(s)", "message": "MX records found (1)." }
],
"records": { "spf": {...}, "dkim": {...}, "dmarc": {...}, "mx": {...}, "bimi": {...} }
}| Issue | Penalty |
|---|---|
| No SPF record at the apex | −30 |
SPF ends with anything other than -all | −15 |
| SPF uses more than 10 DNS lookups (RFC violation) | −10 |
| No DKIM on any common selector | −25 |
No DMARC at _dmarc | −25 |
DMARC policy is none (monitoring only) | −15 |
| No MX records (can't receive mail) | −15 |
Risk band: ≥80 low, ≥50 medium, <50 high.
DKIM uses a selector — a label before ._domainkey.. We probe 20 common selectors (default, google, k1, s1, s2, selector1, mail, dkim, mx, mandrill, mailjet, sendgrid, mailgun, postmark, smtp, email, sig1, sig2, cm). If your domain uses a custom selector, you'll see "DKIM not found" even if DKIM is actually configured. To find an unknown selector, look at your mail server's config or a sent message's raw headers.
If you run an ESP, SaaS, or transactional-mail product, score every sending domain daily. Alert the account owner if their score drops.
When a customer adds a new sending domain, run the check after they save it. Tell them what's missing before they send their first campaign.
Check that your own domains stay locked down. A misconfigured SPF (or no DMARC) means anyone can spoof you.