BYTETOOLS

AGPC Domain Check API

Free email authentication API with no key: grades a domain's SPF, DKIM, DMARC and MX setup and lists the concrete gaps it found. Tested example included.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the AGPC Domain Check API?

AGPC Domain Check is a free, key-free API that inspects a domain's SPF, DKIM, DMARC and MX records in one request and returns a letter grade plus a plain-English list of what is missing. It runs four checks and reports which selectors it probed for DKIM.

Most email-authentication checkers hand you a wall of raw DNS text and leave you to work out whether it is any good. This one does the interpretation. A single GET returns a letter grade, the raw SPF and DMARC strings it found, the MX hosts, and an `issues` array that spells out what is wrong in sentences a non-specialist can act on.

The DKIM handling is the part worth knowing about. DKIM keys live under an arbitrary selector name, so there is no way to enumerate them from DNS alone — the scanner probes a fixed list of about thirty common selectors (`default`, `google`, `selector1`, `protonmail`, `amazonses` and so on) and tells you exactly which ones it tried. A clean report therefore means "no DKIM under any common selector", not "no DKIM anywhere", and the response says so rather than pretending otherwise.

Quick facts

Base URL
https://guild.tradeuniquecapital.com/api
Authentication
No API key and no account. The endpoint reads public DNS only, so there is nothing to authorise.
Rate limit
No published limit. Each call performs several live DNS lookups and takes a couple of seconds, so it is not built for bulk scanning.
Pricing
Free.
CORS
Enabled — callable directly from browser JavaScript
Official docs
Read the docs

How to use the AGPC Domain Check API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Grade the email authentication setup of a domain

GET https://guild.tradeuniquecapital.com/api/check?domain=example.com

curl
curl 'https://guild.tradeuniquecapital.com/api/check?domain=example.com'
JavaScript (fetch)
const res = await fetch("https://guild.tradeuniquecapital.com/api/check?domain=example.com");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.get("https://guild.tradeuniquecapital.com/api/check?domain=example.com", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200 (truncated)
{
  "domain": "example.com",
  "grade": "B",
  "checks_completed": 4,
  "checks_total": 4,
  "complete": true,
  "findings": {
    "spf": "\"v=spf1 -all\"",
    "dmarc": "\"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s\"",
    "mx": [
      "0 ."
    ],
    "dkim_selectors_found": [],
    "cross_domain_dmarc_authorised": null,
    "effectiveness_gaps": [],
    "issues": [
      "No DKIM record with a non-empty key found under common selectors (checked: default, selector1, selector2, google, k1, k2, s1, s2, mail, smtp, mandrill, zoho, zmail, dkim, mx, email, key1, key2, fm1, fm2, fm3, protonmail, protonmail2, mailjet, sendgrid, sib, mc1, amazonses, postmark, pm, hs1, hs2, 20230601, 20240101). Either DKIM is not configured, the key has been revoked (a record with an empty p= value, which this scan correctly does NOT count as configured), or it uses a non-standard selector this scan didn't check.",
      "No rua= aggregate-report address in the DMARC record — there is no visibility into who is failing SPF/DKIM checks for this domain."
    ]
  },
  "seconds": 2.5,
  "honesty_note": "Anything this could not resolve is reported as unknown, never as a failure. A DNS timeout and a missing record mean different things and only one needs fixing.",
  "free_tier": {
    "domains_per_call": 1,
    "calls_per_hour": 20,
    "what_the_paid_audit_adds": [
      "up to five domains in one order",
      "DKIM probed across 34 known provider selectors",
      "prioritised remediation with the exact records to publish",
      "a written report you can hand to whoever runs the DNS"
    ],
    "pri

Parameters

ParameterTypeRequiredDescription
domainqueryRequiredThe domain to inspect. Bare domain, no scheme and no www. example.com

Response fields

gradestring
Letter grade for the overall setup, A through F.
checks_completed / checks_totalinteger
How many of the four checks finished. Compare them before trusting the grade — a partial run can under-report.
completeboolean
True when every check ran to completion.
findings.spfstring
The raw SPF TXT record as published, quotes included, or null when there is none.
findings.dmarcstring
The raw DMARC record. Look for `p=` (policy) and `rua=` (reporting address).
findings.mxarray
MX hosts with their priorities. A single `0 .` entry is the null MX that says the domain sends no mail.
findings.dkim_selectors_foundarray
Selectors that returned a usable key. Empty means none of the probed selectors matched.
findings.issuesarray
Human-readable problems, each naming the record and why it matters.
secondsfloat
Wall-clock time the scan took, typically two to four seconds.

What you can build with the AGPC Domain Check API

  • Audit your own domains before a deliverability push
  • Show a prospect the state of their email authentication during onboarding
  • Add a pre-flight check to a transactional email setup wizard
  • Monitor for a DMARC policy that has quietly been downgraded to p=none

Common errors and how to fix them

Missing `domain`

The query parameter was omitted.

Fix: It is required. Send the bare registrable domain, not a full URL or an email address.

`complete: false`

One or more checks timed out against slow authoritative nameservers.

Fix: Retry once. Treat the grade as provisional whenever `checks_completed` is below `checks_total`.

Empty dkim_selectors_found on a domain you know signs mail

The provider uses a selector outside the probed list.

Fix: This is expected for custom setups. Verify manually with a TXT lookup on `<selector>._domainkey.<domain>`.

Slow response

Every call performs live DNS resolution across several record types.

Fix: Cache results per domain for hours, not seconds. DNS records rarely change within a day.

AGPC Domain Check API — frequently asked questions

Is the AGPC Domain Check API free?

Yes, free with no API key and no account. It only reads public DNS records, so there is nothing to authenticate.

Why does it say no DKIM when my domain definitely has DKIM?

DKIM keys are published under an arbitrary selector name that cannot be enumerated from DNS. The scanner probes about thirty common selectors and lists them in the response; a custom selector will not be found and the report says as much rather than claiming DKIM is absent.

What does an MX record of `0 .` mean?

That is the null MX from RFC 7505, an explicit statement that the domain accepts no mail at all. It is the correct configuration for a domain used only for a website.

Can I use it to check other people's domains?

Yes. Every record it reads is public DNS, and looking up someone's SPF or DMARC record is no different from any other DNS query.

Tools that pair with this API

AGPC Domain Check is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.