Guide

Check email deliverability with a free API

You can check whether a domain will deliver email without opening a browser or creating an account. Inboxproof exposes four free REST endpoints that run the same checks the web audit runs: MX, SPF, DKIM, DMARC, TLS, reverse DNS and IP blocklists. No API key, no signup. They are rate-limited per IP, so they are meant for development, CI and light monitoring rather than a high-volume production pipeline. Here is each endpoint, what it returns, and how to use it.

The four endpoints

All four take a single query parameter and return JSON. The base URL is https://inboxproof.email. The domain endpoints accept a bare domain like example.com; the blocklist endpoint takes an IPv4 address.

1. spam-check: the full audit

The spam-check endpoint runs all seven checks and returns a risk score, a 0-100 deliverability score, a letter grade and a plain-English verdict.

curl "https://inboxproof.email/api/spam-check?domain=example.com"

Response:

{
  "domain": "example.com",
  "risk": 52,
  "riskLabel": "High",
  "deliver": 48,
  "grade": "D",
  "verdict": "This domain has real spam-filter risk. Fix the failing items before sending volume.",
  "failing": [
    { "id": "dkim", "name": "DKIM", "status": "fail", "detail": "No DKIM key found for the published selector.", "fix": "Publish a DKIM record and sign outbound mail." }
  ]
}

The failing array is the part you want to automate on. Each item has an id, a status, a human-readable detail and a suggested fix. If failing is empty, the domain passes all seven checks.

2. dmarc-check: the four authentication checks

The dmarc-check endpoint runs MX, SPF, DKIM and DMARC and returns a 0-100 score. Use it when you only care about the authentication layer and want a single number.

curl "https://inboxproof.email/api/dmarc-check?domain=example.com"

Response:

{
  "domain": "example.com",
  "score": 75,
  "grade": "C",
  "checks": [
    { "id": "mx", "status": "pass" },
    { "id": "spf", "status": "pass" },
    { "id": "dkim", "status": "warn" },
    { "id": "dmarc", "status": "pass" }
  ]
}

3. mx-check: does the domain receive mail

The mx-check endpoint looks up the MX records, resolves each mail server to an IP and checks reverse DNS. It is the fastest way to confirm a domain is actually set up to receive mail.

curl "https://inboxproof.email/api/mx-check?domain=example.com"

Response:

{
  "domain": "example.com",
  "hasMx": true,
  "mxCount": 2,
  "mx": [
    { "exchange": "mail.example.com", "priority": 10 }
  ],
  "allResolve": true
}

If hasMx is false, the domain has no MX record and falls back to the A record. That is the most basic deliverability failure: fix it before anything else.

4. blocklist-check: is an IP listed

The blocklist-check endpoint tests an IPv4 address against nine major blocklists, including the Spamhaus SBL, PBL and XBL. If you omit the ip parameter it checks the caller's own IP, which is useful for a quick "am I listed?" check from a server.

curl "https://inboxproof.email/api/blocklist-check?ip=203.0.113.7"

Response:

{
  "ip": "203.0.113.7",
  "listedCount": 0,
  "listed": [],
  "clean": ["Spamhaus SBL", "SpamCop", "Barracuda", "CBL", "UCEPROTECT L1", "UCEPROTECT L2", "SORBS"],
  "results": [
    { "label": "Spamhaus SBL", "listed": false, "code": null, "fp": false }
  ]
}

The fp flag marks a result that is a known false positive (a resolver returning a non-listing code). Treat only listed: true as a real hit.

Rate limits and how to use it responsibly

Each endpoint is rate-limited to 20 checks per hour per IP. When you hit the limit you get a 429 with a short error. For CI and development that is plenty: a single domain audit is one request. If you are monitoring many domains, batch them and space the requests out, or move to the Pro monitoring plan, which is built for continuous checks.

A pre-send validation example

Here is a small Node example that gates a send on the domain passing the full audit. It exits non-zero if the risk is above the threshold, so it drops straight into a CI step.

const domain = process.env.SENDER_DOMAIN;
const r = await fetch(`https://inboxproof.email/api/spam-check?domain=${domain}`);
const data = await r.json();

if (data.risk > 35) {
  const failing = data.failing.map(f => f.id).join(', ');
  console.error(`Deliverability risk ${data.risk} (${data.riskLabel}). Failing: ${failing}`);
  process.exit(1);
}
console.log(`Deliverability ${data.deliver}/100 (${data.grade}). Clear to send.`);

When to use the API and when to use the audit

The API is for when you need the result in code: a CI gate, a pre-send check, a monitoring script, or a quick lookup from a terminal. The web audit is for when you want to see the results, read the fixes and share a report. They run the same checks. The full endpoint reference, including error codes and the authenticated audit API, is on the developers page.

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →

Related Guides