API documentation

Quick start

1. 1

   Try a check without a key — anonymous requests have lower limits per client address:

   curl -s "https://correct.email/api/v1/spf?domain=example.com"

2. 2

   Create an API key in your account and keep it in an environment variable, never in code: Create an API key

   export CORRECT_EMAIL_API_KEY=ce_live_…

3. 3

   Send it as a bearer token. Checks with a key count against your account’s daily quota:

   curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
     "https://correct.email/api/v1/dmarc?domain=example.com"

API keys

Keys look like ce_live_…; we store only a hash, so a key is shown once, when you create it. Send it in the Authorization header: Authorization: Bearer ce_live_….

Never put a key in a web page or mobile app. Requests a browser makes on behalf of another website (Sec-Fetch-Site: cross-site) are refused, with or without a key.

To replace a key without downtime, rotate it in your account: you get a new secret at once and the old one keeps working for 24 hours (0 to 168 hours via the API). If a key leaked, delete it — that takes effect immediately.

Your account shows API checks per day and per key and check for the last 30 days.

Responses

Every check answers 200 with the same envelope, also when it finds problems — HTTP errors are reserved for requests that could not be run.

result.status

result.findings lists what the check found. Each finding has a stable code (for example spf.too_many_lookups), a severity (error, warning, info, ok), a short English message and, for some codes, params. Match on the code; the message may be reworded.

Limits

Default limits (the operator can change them; the RateLimit-Policy header always has the current values):

Limit headers

Retrying after 429 or 503

# --retry honours Retry-After on 429 and 503
curl -s --retry 3 -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/mx?domain=example.com"

Errors

Errors use HTTP status codes and a JSON body {"error": {"code": "…", "message": "…"}}. The code is stable; the message is a short English explanation.

Endpoints

Base URL https://correct.email/api/v1. All checks are GET requests with query parameters, except the DMARC report analysis, which takes the file as the request body.

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/bimi?domain=example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/dkim?domain=example.com&selector=selector1"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/dmarc?domain=example.com"

curl -s -X POST \
  -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  -H "Content-Type: application/xml" \
  --data-binary @report.xml \
  "https://correct.email/api/v1/dmarc-report"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/dnsbl?target=mx.example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/mtasts?domain=example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/mx?domain=example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/propagation?domain=example.com&type=TXT"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/rdns?target=mx.example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/smtp?domain=example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/spf?domain=example.com"

curl -s -H "Authorization: Bearer $CORRECT_EMAIL_API_KEY" \
  "https://correct.email/api/v1/tlsrpt?domain=example.com"