Developers

The deliverability API

One REST call returns a full 7-check email deliverability audit for any domain: MX, SPF, DKIM, DMARC, TLS, reverse-DNS, and blocklists, scored the same way the free audit and Pro monitoring are.

No SDK to install. Bearer auth, JSON in, JSON out. 100 audits/day per key on Pro and Agency.

Try it live

No account, no API key. Pick a check, enter a domain, and see the real JSON the API returns, plus the exact call to drop into your code.

Pick a check and press Run to see the live response.
Use it in your code
curl "https://inboxproof.email/api/spam-check?domain=example.com"
Try it
curl -H "Authorization: Bearer <your-api-key>" \
  "https://inboxproof.email/api/v1/audit?domain=yourdomain.com"
Your API key is on your dashboard once you're on Pro.
CLI tool

Prefer the terminal? The free inboxproof-cli runs the same 7 checks locally and prints a 0-100 score with the exact record to fix. No account, no API key.

npx github:jtc268/inboxproof-cli yourdomain.com
Open source, zero dependencies. View on GitHub.

Create a Pro or Agency checkout

Pro is $14.50 USD/month for 5 domains. Agency is $49.50 USD/month for 25 domains. Both are billed monthly. Read pricing.json for features and limitations.

POST /api/checkout accepts JSON. Required: plan (pro or agency), email. Optional: domain. No API key is required to create a payment URL. There is no Pro trial in the current checkout.

curl --request POST 'https://inboxproof.email/api/checkout' \
  --header 'Content-Type: application/json' \
  --cookie-jar checkout-cookies.txt \
  --data '{"plan":"pro","email":"buyer@example.com","domain":"example.com"}'

Example only. Running it creates an unpaid Stripe Checkout Session and an account record. It does not activate monitoring. With the buyer's authorization, open the returned URL and complete payment in Stripe.

{"url":"https://checkout.stripe.com/<session>","sessionId":"cs_<session>"}

HTTP 200 returns url and sessionId. Errors: 400 invalid email/domain, 409 existing subscription, 429 too many requests, 503 unavailable. There is no public idempotency guarantee; do not blindly retry checkout creation.

Get the paid API key after payment

The response sets an HttpOnly checkout cookie. Automatic browser sign-in on return requires the same browser to retain that cookie. A curl cookie jar is not shared with your browser. Otherwise, sign in with the checkout email after payment, then copy the key from your dashboard. Email access is required. There is no public endpoint that returns a paid key before payment or skips sign-in.

No verified project Stripe Payment Link is published here. Use this API or the pricing page. See llms.txt for agent instructions, the comparison matrix and buying guide.

Endpoint

GET /api/v1/audit?domain={domain}
AuthAuthorization: Bearer <key> (or ?key=<key>)
domainRequired. The domain to audit, e.g. yourdomain.com
Rate limit100 audits/day per key on Pro and Agency

Response

{
  "ok": true,
  "domain": "yourdomain.com",
  "at": "2026-02-14T09:30:00.000Z",
  "score": 82,
  "grade": "B",
  "checks": [
    { "id": "mx",    "name": "MX & mail routing", "status": "pass" },
    { "id": "spf",   "name": "SPF",               "status": "pass" },
    { "id": "dkim",  "name": "DKIM",              "status": "warn" },
    { "id": "dmarc", "name": "DMARC",             "status": "pass" },
    { "id": "tls",   "name": "TLS",               "status": "pass" },
    { "id": "ptr",   "name": "Reverse DNS (PTR)", "status": "warn" },
    { "id": "rbl",   "name": "Blocklists",        "status": "pass" }
  ]
}
Each status is pass, warn, or fail. The score is the weighted sum (DMARC and MX carry the most), 0–100. The same engine powers the free audit and Pro daily monitoring.

Errors

401Missing, invalid, or non-Pro API key.
400Missing or malformed domain.
429Rate limit exceeded for the day.

Free public endpoints

Four check endpoints are open with no API key, rate-limited to 20 calls/hour per IP. Good for quick lookups, scripts, and prototyping.

GET /api/spam-check?domain={d}Full 7-check audit with a spam-risk verdict and the failing items to fix.
GET /api/dmarc-check?domain={d}MX, SPF, DKIM, DMARC checks with a 0-100 score.
GET /api/mx-check?domain={d}MX records and whether each mail server resolves.
GET /api/blocklist-check?ip={ip}Checks an IP against 9 blocklists (defaults to your IP).
curl "https://inboxproof.email/api/spam-check?domain=yourdomain.com"
No auth, no account. For high volume or daily monitoring, use the Pro API above.
Related
Transactional email API deliverability Deliverability for developers SPF, DKIM, DMARC explained How to check email deliverability SPF record checker DMARC record checker

Put it to work

Wire a daily deliverability check into your deploy pipeline, monitor client domains from your agency dashboard, or gate cold-email sends on a passing score.

Get Pro: $14.50/mo
No lock-in. Cancel anytime.