Email Authentication Checker runs the full SPF + DKIM + DMARC audit on a single domain in one query. Pulls the SPF record and expands its include chain, queries DKIM at known selectors, parses the DMARC policy and alignment modes, scores the overall posture (none / partial / strong), surfaces the failures that actually break deliverability, and tells you the next concrete step to take. The combined view that DMARC dashboards and standalone checkers don't give you.
All three pillars in a single audit. Each underlying check is the same rigorous analysis as the standalone tools — combined here so you see how they interact, not just whether each one technically exists.
Pulls the SPF TXT, parses every mechanism, recursively expands all `include:` chains to terminal IPs, and counts DNS lookups against the 10-limit. Lookup overrun is the single most common silent SPF failure; surfaced here as part of the combined view.
Probes the known-default selector list (Google, Microsoft 365, Mailchimp, SendGrid, SES, Postmark, Mailgun, and 30+ more) plus any selector you provide. Reports active selectors, key strength per selector, and any selectors stuck in test mode (`t=y`).
Parses the DMARC record at `_dmarc.<domain>` — `p`, `sp`, `pct`, `rua`, `ruf`, `adkim`, `aspf`. Scores effective enforcement (policy × pct). Identifies misalignment between DMARC's strict/relaxed settings and how SPF/DKIM are actually deployed.
Verifies that SPF and DKIM are deployed consistent with what DMARC expects. Common mismatch: DMARC published at `p=reject` but SPF is `~all` and DKIM keys are 1024-bit — the policy is strict but the underlying authentication is weak.
Single number summarizing email-authentication health. None (no SPF, no DKIM, no DMARC) → 0. Standard (SPF strict, DKIM 2048+, DMARC at quarantine or reject) → 80+. Strong (all three deployed, DMARC at reject pct=100, DKIM rotated recently) → 95+.
Severity-ranked recommendations: 'Rotate DKIM key — 1024-bit is too weak', 'Move DMARC from p=none to p=quarantine', 'SPF has 11 lookups — exceeds the limit'. Each is a concrete action with a one-line rationale.
The standalone checkers tell you whether one mechanism is configured. The combined check tells you whether the three pieces actually work together. Five things the composite view reveals that single checks don't:
All three lookups fire in parallel. Once the results come back, the cross-correlation layer compares them and surfaces composite-only findings.
Three mechanisms, three different things. Knowing what each contributes makes the composite analysis easier to interpret:
Google and Yahoo's 2024 bulk-sender requirements, followed by Microsoft's 2025 alignment, raised the floor for senders above 5,000 messages per day to the same recipient domain. The requirements are composite — they only make sense as a combined SPF + DKIM + DMARC posture:
All three results plus the cross-correlation and posture score are available as JSON. Useful for vendor onboarding, M&A diligence, bulk-sender-compliance automation, and continuous email-security monitoring.
curl 'https://api.domainscan.in/v1/security/email?domain=microsoft.com'const res = await fetch(
'https://api.domainscan.in/v1/security/email?domain=microsoft.com'
);
const email = await res.json();
console.log(email.posture.score); // 88
console.log(email.posture.rating); // 'strong'
console.log(email.SPF.parsed.qualifier); // '-all'
console.log(email.SPF.parsed.lookupCount); // 7
console.log(email.DKIM.selectors.length); // 3
console.log(email.DMARC.parsed.p); // 'reject'
console.log(email.DMARC.parsed.pct); // 100
// Top fixes
email.AiAnalysis.recommendations
.slice(0, 3)
.forEach(r => console.log(`[${r.severity}] ${r.title} — ${r.action}`));{
"domain": "microsoft.com",
"posture": {
"score": 88,
"rating": "none | partial | standard | strong",
"bulkSenderCompliant": true
},
"SPF": {
"present": true,
"raw": "v=spf1 include:... -all",
"parsed": { /* full SPF parse */ },
"lookupCount": 7,
"qualifier": "-all"
},
"DKIM": {
"selectors": [
{ "selector": "selector1", "present": true, "keyBits": 2048, "strength": "standard" },
{ "selector": "selector2", "present": true, "keyBits": 2048, "strength": "standard" }
]
},
"DMARC": {
"present": true,
"raw": "v=DMARC1; p=reject; rua=...; pct=100",
"parsed": { /* full DMARC parse */ }
},
"AiAnalysis": {
"recommendations": [
{
"severity": "high | medium | low",
"title": "string",
"description": "string",
"action": "string",
"impact": "deliverability | security | compliance"
}
]
}
}Six patterns we see most often:
Verify every domain in your sending portfolio meets Google, Yahoo, and Microsoft's 2024–2025 bulk-sender requirements. The composite posture score directly answers compliance, then drill into each pillar to fix gaps.
Acquiring a company. Run the composite check on every domain they own. Posture scores reveal the depth of post-acquisition email-security work needed. Most acquisitions inherit weak DMARC and old DKIM keys.
Your domain is being spoofed. Composite check confirms whether your SPF, DKIM, and DMARC actually defend against the spoofing — or whether the policy is theoretical and would let the spoofed mail through anyway.
Before raising DMARC from `p=none` to `p=quarantine` or `p=reject`, run the composite check. Posture rating tells you whether the underlying SPF and DKIM are strong enough to support enforcement without breaking legitimate mail.
Evaluating an ESP, marketing platform, or any vendor that will send mail on your behalf. Their existing email-auth posture (on their own marketing domain) is a credible signal of how seriously they take deliverability.
Cron the composite check against your domains weekly. Alert on posture regressions — SPF newly broken, DKIM selector expired, DMARC pct dropped. Catches the slow drift that erodes email security over months.