API

Free API for email checks

One call, one JSON: the open Postwacht API checks a domain for SPF, DKIM, DMARC, MX, STARTTLS, MTA-STS and blocklists. No sign-up, no application, with a key from the free account for a higher limit.

Your first call

curl https://postwacht.de/api/v1/check/example.com

The response contains the overall result and every single check:

{
  "domain": "example.com",
  "overall": "warn",
  "checks": [
    {"id": "spf",   "status": "ok",   "title": "SPF record", "detail": "…", "data": {…}},
    {"id": "dmarc", "status": "warn", "title": "DMARC record", "detail": "p=none …", "data": {…}}
  ],
  "access": {"level": "anonymous", "limit_per_hour": 1, "remaining": 0}
}

overall and every status are ok, warn, fail or info. With the header Accept-Language: en titles and findings come in English.

Limits

Access	Limit	What you need
Without a key	1 query/queries per hour and network	nothing
With a key	60 queries per hour and account	a free account, key under API in one click

Every response contains X-RateLimit-Limit and X-RateLimit-Remaining. When the limit is reached, the API answers with 429 and Retry-After in seconds. Cached answers (five minutes per domain) also count towards the limit.

With a key

Create a free account, generate a key under API and send it in the header:

curl https://postwacht.de/api/v1/check/example.com \
  -H "Authorization: Bearer pwk_…"

Examples

Shell: fail the pipeline on errors

STATUS=$(curl -s https://postwacht.de/api/v1/check/example.com \
  -H "Authorization: Bearer $POSTWACHT_KEY" | jq -r .overall)
[ "$STATUS" != "fail" ] || exit 1

Python

import requests

r = requests.get("https://postwacht.de/api/v1/check/example.com",
                 headers={"Authorization": "Bearer pwk_…"}, timeout=30)
r.raise_for_status()
for check in r.json()["checks"]:
    print(check["status"], check["title"], "-", check["detail"])

JavaScript

const res = await fetch("https://postwacht.de/api/v1/check/example.com", {
  headers: { Authorization: "Bearer pwk_…" },
});
const { overall, checks } = await res.json();

What is checked

MX and STARTTLS: which servers accept email, whether they encrypt, certificate and validity
SPF: syntax, number of DNS lookups, networks that are too wide
DKIM: key with the common selectors, key length
DMARC: policy, report addresses, alignment
MTA-STS and TLS-RPT: enforced encryption and reports
Domain blocklists: Spamhaus DBL and more

The check reads public DNS data only and briefly connects to the domain's mail servers. No email is sent. How to read each check is explained in the tools.

Fair use

The API is free and comes without an availability guarantee. The limits may change.
Not allowed: bulk queries of third-party domains, circumventing the limits with several accounts and passing on keys. We block keys and accounts in case of abuse.
We do not keep a list of who queried which domain. More in the privacy policy; the terms are in the terms.

The test, domain and webhook interfaces (creating tests by test email, monitoring domains) are enabled on request. Everything about them is in the full documentation.