AGPC Domain Check API
Free email authentication API with no key: grades a domain's SPF, DKIM, DMARC and MX setup and lists the concrete gaps it found. Tested example included.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the AGPC Domain Check API?
AGPC Domain Check is a free, key-free API that inspects a domain's SPF, DKIM, DMARC and MX records in one request and returns a letter grade plus a plain-English list of what is missing. It runs four checks and reports which selectors it probed for DKIM.
Most email-authentication checkers hand you a wall of raw DNS text and leave you to work out whether it is any good. This one does the interpretation. A single GET returns a letter grade, the raw SPF and DMARC strings it found, the MX hosts, and an `issues` array that spells out what is wrong in sentences a non-specialist can act on.
The DKIM handling is the part worth knowing about. DKIM keys live under an arbitrary selector name, so there is no way to enumerate them from DNS alone — the scanner probes a fixed list of about thirty common selectors (`default`, `google`, `selector1`, `protonmail`, `amazonses` and so on) and tells you exactly which ones it tried. A clean report therefore means "no DKIM under any common selector", not "no DKIM anywhere", and the response says so rather than pretending otherwise.
Quick facts
- Base URL
https://guild.tradeuniquecapital.com/api- Authentication
- No API key and no account. The endpoint reads public DNS only, so there is nothing to authorise.
- Rate limit
- No published limit. Each call performs several live DNS lookups and takes a couple of seconds, so it is not built for bulk scanning.
- Pricing
- Free.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the AGPC Domain Check API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. Grade the email authentication setup of a domain
GET https://guild.tradeuniquecapital.com/api/check?domain=example.com
curl 'https://guild.tradeuniquecapital.com/api/check?domain=example.com'const res = await fetch("https://guild.tradeuniquecapital.com/api/check?domain=example.com");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://guild.tradeuniquecapital.com/api/check?domain=example.com", timeout=20)
res.raise_for_status()
print(res.json()){
"domain": "example.com",
"grade": "B",
"checks_completed": 4,
"checks_total": 4,
"complete": true,
"findings": {
"spf": "\"v=spf1 -all\"",
"dmarc": "\"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s\"",
"mx": [
"0 ."
],
"dkim_selectors_found": [],
"cross_domain_dmarc_authorised": null,
"effectiveness_gaps": [],
"issues": [
"No DKIM record with a non-empty key found under common selectors (checked: default, selector1, selector2, google, k1, k2, s1, s2, mail, smtp, mandrill, zoho, zmail, dkim, mx, email, key1, key2, fm1, fm2, fm3, protonmail, protonmail2, mailjet, sendgrid, sib, mc1, amazonses, postmark, pm, hs1, hs2, 20230601, 20240101). Either DKIM is not configured, the key has been revoked (a record with an empty p= value, which this scan correctly does NOT count as configured), or it uses a non-standard selector this scan didn't check.",
"No rua= aggregate-report address in the DMARC record — there is no visibility into who is failing SPF/DKIM checks for this domain."
]
},
"seconds": 2.5,
"honesty_note": "Anything this could not resolve is reported as unknown, never as a failure. A DNS timeout and a missing record mean different things and only one needs fixing.",
"free_tier": {
"domains_per_call": 1,
"calls_per_hour": 20,
"what_the_paid_audit_adds": [
"up to five domains in one order",
"DKIM probed across 34 known provider selectors",
"prioritised remediation with the exact records to publish",
"a written report you can hand to whoever runs the DNS"
],
"priParameters
| Parameter | Type | Required | Description |
|---|---|---|---|
domain | query | Required | The domain to inspect. Bare domain, no scheme and no www. example.com |
Response fields
gradestring- Letter grade for the overall setup, A through F.
checks_completed / checks_totalinteger- How many of the four checks finished. Compare them before trusting the grade — a partial run can under-report.
completeboolean- True when every check ran to completion.
findings.spfstring- The raw SPF TXT record as published, quotes included, or null when there is none.
findings.dmarcstring- The raw DMARC record. Look for `p=` (policy) and `rua=` (reporting address).
findings.mxarray- MX hosts with their priorities. A single `0 .` entry is the null MX that says the domain sends no mail.
findings.dkim_selectors_foundarray- Selectors that returned a usable key. Empty means none of the probed selectors matched.
findings.issuesarray- Human-readable problems, each naming the record and why it matters.
secondsfloat- Wall-clock time the scan took, typically two to four seconds.
What you can build with the AGPC Domain Check API
- Audit your own domains before a deliverability push
- Show a prospect the state of their email authentication during onboarding
- Add a pre-flight check to a transactional email setup wizard
- Monitor for a DMARC policy that has quietly been downgraded to p=none
Common errors and how to fix them
Missing `domain`
The query parameter was omitted.
Fix: It is required. Send the bare registrable domain, not a full URL or an email address.
`complete: false`
One or more checks timed out against slow authoritative nameservers.
Fix: Retry once. Treat the grade as provisional whenever `checks_completed` is below `checks_total`.
Empty dkim_selectors_found on a domain you know signs mail
The provider uses a selector outside the probed list.
Fix: This is expected for custom setups. Verify manually with a TXT lookup on `<selector>._domainkey.<domain>`.
Slow response
Every call performs live DNS resolution across several record types.
Fix: Cache results per domain for hours, not seconds. DNS records rarely change within a day.
AGPC Domain Check API — frequently asked questions
Is the AGPC Domain Check API free?
Yes, free with no API key and no account. It only reads public DNS records, so there is nothing to authenticate.
Why does it say no DKIM when my domain definitely has DKIM?
DKIM keys are published under an arbitrary selector name that cannot be enumerated from DNS. The scanner probes about thirty common selectors and lists them in the response; a custom selector will not be found and the report says as much rather than claiming DKIM is absent.
What does an MX record of `0 .` mean?
That is the null MX from RFC 7505, an explicit statement that the domain accepts no mail at all. It is the correct configuration for a domain used only for a website.
Can I use it to check other people's domains?
Yes. Every record it reads is public DNS, and looking up someone's SPF or DMARC record is no different from any other DNS query.
Tools that pair with this API
SPF Record Generator
Create a valid SPF TXT record from your sending IPs, includes and mail servers — with live DNS-lookup counting against the 10-lookup limit. Free and private.
DMARC Record Generator
Generate a DMARC TXT record with policy, subdomain policy, pct, rua/ruf reporting and alignment options — each tag explained in plain English. 100% in-browser.
DNS Record Generator
Generate correctly formatted zone-file lines for A, AAAA, CNAME, MX, TXT, NS, SRV and CAA records — with FQDN dots, priorities and TXT chunking handled for you.
Email Header Analyzer
Paste raw email headers to trace the delivery path hop by hop, see where mail stalled, and read the SPF, DKIM and DMARC verdicts — all offline.
AGPC Domain Check is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.