API Reference
Integrate MailAudit into your own application: DNS, blacklist and reputation checks, and full email deliverability tests over a REST API.
API key required
Free — create one on the dashboardRate limit
60 requests / minute, 1,000 / day per key
Base URL
https://api.mailaudit.io/api/v1
Authentication
Every request needs an API key. Send it in the Authorization header as a Bearer token (or in the X-API-Key header). Keep your key secret — do not embed it in browser code.
curl -H "Authorization: Bearer ma_live_xxxxxxxxxxxx" \
"https://api.mailaudit.io/api/v1/tools/mx-check?domain=example.com"Every response includes X-RateLimit-Remaining and X-RateLimit-Daily-Remaining headers. When a limit is exceeded you get HTTP 429 with a Retry-After header.
Endpoints
MX record check
/tools/mx-checkQuery a domain's MX records, as well as SPF and DMARC settings.
Parameters
domainstringrequiredExample request
curl -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
"https://api.mailaudit.io/api/v1/tools/mx-check?domain=gmail.com"Response example
1{
2 "domain": "gmail.com",
3 "hasMx": true,
4 "records": [
5 {
6 "exchange": "gmail-smtp-in.l.google.com",
7 "priority": 5,
8 "ip": ["142.250.150.27"]
9 },
10 {
11 "exchange": "alt1.gmail-smtp-in.l.google.com",
12 "priority": 10,
13 "ip": ["142.250.141.26"]
14 }
15 ],
16 "hasSpf": true,
17 "spfRecord": "v=spf1 redirect=_spf.google.com",
18 "hasDmarc": true,
19 "dmarcRecord": "v=DMARC1; p=none; sp=quarantine; rua=mailto:..."
20}Blacklist check
/tools/blacklist-checkCheck if an IP address or domain is on major spam blocklists (32 DNSBLs).
Parameters
querystringrequiredExample request
curl -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
"https://api.mailaudit.io/api/v1/tools/blacklist-check?query=8.8.8.8"Response example
1{
2 "query": "8.8.8.8",
3 "queryType": "ip",
4 "totalChecked": 32,
5 "totalListed": 0,
6 "results": [
7 {
8 "name": "Spamhaus ZEN",
9 "zone": "zen.spamhaus.org",
10 "listed": false,
11 "responseTime": 45
12 },
13 {
14 "name": "Barracuda",
15 "zone": "b.barracudacentral.org",
16 "listed": false,
17 "responseTime": 32
18 }
19 // ...
20 ]
21}Domain reputation check
/tools/reputationComprehensive domain reputation score calculation. Checks SPF, DKIM, DMARC, MX records, blacklist status, STARTTLS support, domain age, and reverse DNS.
Parameters
domainstringrequiredExample request
curl -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
"https://api.mailaudit.io/api/v1/tools/reputation?domain=gmail.com"Grading Scale
Response example
1{
2 "domain": "gmail.com",
3 "ip": "142.250.150.27",
4 "score": 100,
5 "grade": "A+",
6 "factors": [
7 { "name": "SPF", "status": "pass", "detail": "Policy: present", "impact": 15 },
8 { "name": "DKIM", "status": "warn", "detail": "Not found", "impact": 0 },
9 { "name": "DMARC", "status": "warn", "detail": "Policy: none", "impact": 5 },
10 { "name": "MX Records", "status": "pass", "detail": "5 record(s)", "impact": 10 },
11 { "name": "Blacklists", "status": "pass", "detail": "Clean (39 checked)", "impact": 20 },
12 { "name": "STARTTLS", "status": "pass", "detail": "Supported", "impact": 10 },
13 { "name": "Domain Age", "status": "pass", "detail": "30.3 years", "impact": 10 },
14 { "name": "Reverse DNS", "status": "pass", "detail": "wa-in-f27.1e100.net", "impact": 5 }
15 ],
16 "details": {
17 "mx": { "valid": true, "count": 5, "primary": "gmail-smtp-in.l.google.com" },
18 "spf": { "valid": true, "record": "v=spf1 redirect=_spf.google.com" },
19 "dkim": { "valid": false, "selectors": [] },
20 "dmarc": { "valid": true, "policy": "none", "rua": ["mailto:..."] },
21 "blacklists": { "checked": 10, "listed": 0, "clean": true },
22 "tls": { "valid": true, "starttls": true },
23 "domainAge": { "valid": true, "years": 30.3, "registrationDate": "1995-08-13" },
24 "rdns": { "valid": true, "hostname": "wa-in-f27.1e100.net" }
25 },
26 "checkedAt": "2025-12-03T07:05:46.232Z",
27 "cached": false
28}Email deliverability test
Create a test address, send your email to it from the server you want to test, then poll the result until the status is completed (usually within a minute). Test addresses expire after one hour.
/test/generateCreate a new test email address.
Example request
curl -X POST -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
"https://api.mailaudit.io/api/v1/test/generate"Response example
1{
2 "testId": "k3v9x2m1qa",
3 "email": "[email protected]",
4 "expiresAt": "2026-09-24T18:44:14.762Z",
5 "checkUrl": "/test/k3v9x2m1qa"
6}/test/{testId}Get the status and results of a test. Status: pending → processing → completed (or expired / error). The score is 0–10.
Parameters
testIdstringrequiredExample request
curl -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
"https://api.mailaudit.io/api/v1/test/k3v9x2m1qa"Response example
1{
2 "testId": "k3v9x2m1qa",
3 "status": "completed",
4 "score": 9.2,
5 "createdAt": "2026-09-24T17:44:14.763Z",
6 "receivedAt": "2026-09-24T17:45:02.118Z",
7 "expiresAt": "2026-09-24T18:44:14.762Z",
8 "email": {
9 "from": "[email protected]",
10 "subject": "Our September newsletter",
11 "bounceAddress": null
12 },
13 "checks": {
14 "spf": { "status": "pass", ... },
15 "dkim": { "status": "pass", ... },
16 "dmarc": { "status": "pass", ... },
17 "blacklist": { "status": "pass", ... },
18 "spamassassin": { "status": "pass", ... }
19 }
20}/test/{testId}/recheckRe-run all checks on an email that has already been received, without sending a new one.
Parameters
testIdstringrequiredResponse example
1{
2 "success": true,
3 "testId": "k3v9x2m1qa",
4 "message": "Recheck initiated - checks are running"
5}Dev inbox
Every account has its own disposable address ([email protected], any +tag). Mail sent to it is kept for 24 hours and can be read over the API, on the dashboard or via a share link. Use it in end-to-end tests instead of a real mailbox.
/inbox/waitWaits (long-poll, up to 60 s) until a matching message arrives and returns it with text, HTML, links and one-time codes. Returns 408 if nothing arrives in time.
Parameters
tagstringtimeoutnumbersinceISO 8601Example request
1curl -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
2 "https://api.mailaudit.io/api/v1/inbox/address?tag=signup-42"
3# → { "address": "[email protected]", … }
4
5curl -H "Authorization: Bearer $MAILAUDIT_API_KEY" \
6 "https://api.mailaudit.io/api/v1/inbox/wait?tag=signup-42&timeout=60"Also available:
- GET /inbox · GET /inbox/address · GET /inbox/messages?tag=&since=
- GET /inbox/messages/{id} · GET /inbox/messages/{id}/raw · DELETE /inbox/messages/{id}
Response example
1{
2 "id": "81ab56fe-9546-41a1-b7d1-b0f1a594ad37",
3 "to": "[email protected]",
4 "tag": "signup-42",
5 "from": { "address": "[email protected]", "name": "YourApp" },
6 "subject": "Confirm your email address",
7 "receivedAt": "2026-09-24T19:53:43.624Z",
8 "expiresAt": "2026-09-25T19:53:43.624Z",
9 "links": ["https://yourapp.dev/confirm?t=abc"],
10 "codes": ["482913"],
11 "shareUrl": "https://mailaudit.io/m/UjKgBYNGYXjTaGLe…",
12 "text": "Your code: 482 913 …",
13 "html": "<p>Your code: <b>482 913</b></p>…",
14 "headers": { "subject": "Confirm your email address", … }
15}Use it from an AI agent (MCP)
The same inbox is an MCP server, so Claude Code, Cursor and other MCP clients can create addresses, wait for mail and read it on their own:
claude mcp add --transport http mailaudit https://api.mailaudit.io/mcp \
--header "Authorization: Bearer $MAILAUDIT_API_KEY"Tools: new_address, wait_for_message, list_messages, get_message, extract, share_link, delete_message.
HTTP Status Codes
| Code | Status | Description |
|---|---|---|
| 200 | OK | Successful request |
| 400 | Bad Request | Missing or invalid parameter |
| 401 | Unauthorized | Missing, invalid or revoked API key |
| 404 | Not Found | Test not found |
| 429 | Too Many Requests | Rate limit exceeded (60/minute or 1,000/day) |
| 500 | Internal Server Error | Server side error |
Error Responses
In case of error, the response contains an error field with the error description:
{
"error": "Domain is required"
}Code Examples
JavaScript / Node.js
1// Query MX records
2const response = await fetch(
3 'https://api.mailaudit.io/api/v1/tools/mx-check?domain=example.com',
4 { headers: { Authorization: `Bearer ${process.env.MAILAUDIT_API_KEY}` } }
5);
6const data = await response.json();
7
8if (data.hasMx) {
9 console.log('MX records:', data.records);
10 console.log('SPF:', data.hasSpf ? data.spfRecord : 'None');
11 console.log('DMARC:', data.hasDmarc ? data.dmarcRecord : 'None');
12}Python
1import os
2import requests
3
4# Blacklist check
5response = requests.get(
6 'https://api.mailaudit.io/api/v1/tools/blacklist-check',
7 params={'query': '192.168.1.1'},
8 headers={'Authorization': f"Bearer {os.environ['MAILAUDIT_API_KEY']}"},
9)
10data = response.json()
11
12print(f"Checked: {data['totalChecked']} lists")
13print(f"Listed on: {data['totalListed']} places")
14
15for result in data['results']:
16 if result['listed']:
17 print(f"⚠️ {result['name']}: LISTED")Python - Reputation Check
1import os
2import requests
3
4# Domain reputation check
5response = requests.get(
6 'https://api.mailaudit.io/api/v1/tools/reputation',
7 params={'domain': 'example.com'},
8 headers={'Authorization': f"Bearer {os.environ['MAILAUDIT_API_KEY']}"},
9)
10data = response.json()
11
12print(f"Score: {data['score']}/100 ({data['grade']})")
13print("\nFactors:")
14for factor in data['factors']:
15 icon = "✅" if factor['status'] == 'pass' else "⚠️" if factor['status'] == 'warn' else "❌"
16 print(f" {icon} {factor['name']}: {factor['detail']} ({factor['impact']:+d})")Python - Email deliverability test
1import os
2import time
3import requests
4
5# Full deliverability test
6api = 'https://api.mailaudit.io/api/v1'
7headers = {'Authorization': f"Bearer {os.environ['MAILAUDIT_API_KEY']}"}
8
9test = requests.post(f'{api}/test/generate', headers=headers).json()
10print('Send your email to:', test['email'])
11
12while True:
13 result = requests.get(f"{api}/test/{test['testId']}", headers=headers).json()
14 if result['status'] in ('completed', 'expired', 'error'):
15 break
16 time.sleep(10)
17
18print(f"Status: {result['status']}, score: {result['score']}/10")PHP
1<?php
2// MX check
3$domain = 'example.com';
4$url = "https://api.mailaudit.io/api/v1/tools/mx-check?domain=" . urlencode($domain);
5
6$context = stream_context_create(['http' => [
7 'header' => 'Authorization: Bearer ' . getenv('MAILAUDIT_API_KEY'),
8]]);
9$response = file_get_contents($url, false, $context);
10$data = json_decode($response, true);
11
12if ($data['hasMx']) {
13 foreach ($data['records'] as $mx) {
14 echo "MX: {$mx['exchange']} (priority: {$mx['priority']})\n";
15 }
16}
17?>Want to try the API?
Try our tools on the web interface, or start developing with the API.