Attest tools · email_domain_auth
a task needs to know whether a domain is set up to send email that inboxes accept: MX, SPF (with the 10-lookup limit), DKIM keys, DMARC policy, MTA-STS, TLS-RPT and BIMI, with a 0-100 score and plain-English fixes.
Bearer key · JSON
curl -s -X POST https://getattest.com.au/api/v1/email/domain-auth \
-H "authorization: Bearer $ATTEST_API_KEY" \
-H "content-type: application/json" \
-d '{}'Send the key as a bearer token in the authorization header. One key and one credit balance cover every service, including Attest Capture. A failed call is refunded automatically. No key yet? POST /api/v1/keys issues one with 25 free credits and no signup — see the key guide.
For agents
Use this when a task needs to know whether a domain is set up to send email that inboxes accept: MX, SPF (with the 10-lookup limit), DKIM keys, DMARC policy, MTA-STS, TLS-RPT and BIMI, with a 0-100 score and plain-English fixes.
Not documented yet: a captured example response. This page only shows what the module publishes about itself, so the missing parts are absent rather than guessed at.
3 fields
Scroll the table horizontally to see all fields.
| Field | Type | Required | What it does |
|---|---|---|---|
domain | string | Optional | The sending domain to check. Required unless email is sent. |
email | string | Optional | An address to take the domain from. Refused if it disagrees with domain. |
dkim_selectors | array | Optional | Extra DKIM selectors to look up, on top of the common ones this service tries. |
HTTP 200
Every successful response also carries call_id (your receipt for the charge), credits_charged and credits_remaining.
Scroll the table horizontally to see all fields.
| Field | What it holds |
|---|---|
domain | The domain that was checked. |
mx | MX records, including a null MX (RFC 7505). |
spf | The SPF record, its mechanisms and its count against the 10-lookup limit. |
dkim | The DKIM keys found, per selector. |
dmarc | The DMARC record and its policy. |
mta_sts | The MTA-STS record and the policy file when one is advertised. |
tls_rpt | The TLS-RPT record. |
bimi | The BIMI record. |
score | A 0-100 score for the published configuration. |
score_breakdown | What each section contributed to the score. |
score_unchecked | Sections that could not be checked, so a low score is not read as a failure. |
recommendations | Plain-English fixes for what is missing. |
Machine-readable failures
Errors return JSON such as {"error":"invalid_api_key"}. A failed call is refunded automatically.
Scroll the table horizontally to see all fields.
| Code | Status | Meaning |
|---|---|---|
domain_required | 400 | Neither domain nor email was sent. |
invalid_domain | 400 | domain is not a domain name. |
invalid_email | 400 | email is not an address a domain can be taken from. |
domain_email_mismatch | 400 | domain and email name different domains. |
invalid_dkim_selectors | 400 | dkim_selectors is not a list of selector names. |
too_many_dkim_selectors | 400 | More selectors were supplied than this service looks up. |
dns_lookup_failed | 502 | The DNS lookup did not answer. Not charged. |
Scroll the table horizontally to see all fields.
| Code | Status | Meaning |
|---|---|---|
invalid_api_key | 401 | The authorization header is missing or the key is unknown. |
insufficient_credits | 402 | The balance is below this call's cost. The response carries credits_required and credits_remaining. |
rate_limit_exceeded | 429 | Free keys share 10 calls a minute across every service. The response carries limit and window_seconds. |
services_unavailable | 503 | The credit store could not be reached. Retry once after 30 seconds. |
Where the answer comes from
Public DNS, queried live, and the domain's own MTA-STS policy file when one is advertised. Read against RFC 5321, 7208, 6376, 7489, 8461 and 8460.
Attest reports what it read, with the source it read it from. It is general information, not advice, and not a legal record.
Same key as every Attest tool
Issue a free key, then use it here, on Attest Capture and on every other tool in the box.
Get a free key