> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailchannels.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DKIM, SPF & Domain Lockdown Check

> Validates a domain's email authentication setup by retrieving its DKIM, SPF, and Domain Lockdown status.
This endpoint checks whether the domain is properly configured for secure email delivery.




## OpenAPI

````yaml /email-api/api-reference/openapi.yaml post /check-domain
openapi: 3.0.0
info:
  contact:
    email: support@mailchannels.com
    name: MailChannels Corporation
  description: >
    This is the API reference for Email API. Here, you'll find more detailed
    information on every endpoint, including parameters, response formats, and
    error codes.
  title: Email API
  version: 1.4.0
servers:
  - url: https://api.mailchannels.net/tx/v1
security: []
tags:
  - name: Send
  - name: DKIM
  - name: Metrics
  - name: Sub-accounts
  - name: Suppression
  - name: Webhooks
  - name: Usage
  - name: Custom Tracking
paths:
  /check-domain:
    post:
      tags:
        - DKIM
      summary: DKIM, SPF & Domain Lockdown Check
      description: >
        Validates a domain's email authentication setup by retrieving its DKIM,
        SPF, and Domain Lockdown status.

        This endpoint checks whether the domain is properly configured for
        secure email delivery.
      parameters:
        - in: header
          name: X-Api-Key
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckDomainBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckDomainResult'
          description: Success.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Bad Request
        '403':
          description: User does not have access to this feature
      x-codeSamples:
        - label: Node.js
          lang: javascript
          source: >-
            import { MailChannels } from "mailchannels-sdk";


            const { MAILCHANNELS_API_KEY, DOMAIN } = process.env;

            if (!MAILCHANNELS_API_KEY) throw new Error("Set MAILCHANNELS_API_KEY
            before running");

            if (!DOMAIN) throw new Error("Set DOMAIN (the sending domain, e.g.
            example.com)");


            const mailchannels = new MailChannels(MAILCHANNELS_API_KEY);


            const { data, error } = await mailchannels.domains.check(DOMAIN);


            if (error) {
              console.error("Check domain failed:", error);
              process.exit(1);
            }

            console.log(data);
        - label: Python
          lang: python
          source: >-
            import os

            import sys


            import mailchannels


            if not os.environ.get("MAILCHANNELS_API_KEY"):
                sys.exit("Set MAILCHANNELS_API_KEY before running")

            domain = os.environ.get("DOMAIN")

            if not domain:
                sys.exit("Set DOMAIN (the sending domain, e.g. example.com)")

            # Check that DKIM, SPF, and Domain Lockdown records are configured
            correctly

            # and have propagated.

            response = mailchannels.CheckDomain.check(domain)


            print(response)
        - label: PHP
          lang: php
          source: >-
            <?php


            require_once __DIR__ . '/vendor/autoload.php';


            use MailChannels\Client;


            $api_key = getenv('MAILCHANNELS_API_KEY') or exit("Error:
            MAILCHANNELS_API_KEY is not set\n");

            $domain  = getenv('DOMAIN') or exit("Error: DOMAIN is not set\n");


            $client = new Client(apiKey: $api_key);


            // Check that DKIM, SPF, and Domain Lockdown records are configured
            correctly

            // and have propagated.

            $response = $client->checkDomain->check($domain);


            print_r($response->toArray());
components:
  schemas:
    CheckDomainBody:
      properties:
        dkim_settings:
          description: >
            Each item may include DKIM domain, selector and private key. Up to
            10 items are allowed.

            The absence or presence of these fields affects how DKIM settings
            are validated:

            1. If dkim_domain, dkim_selector, and dkim_private_key are all
            present, verify using the provided domain, selector, and key.

            2. If dkim_domain and dkim_selector are present, use the stored
            private key for the given domain and selector.

            3. If only dkim_domain is present, use all stored keys for the given
            domain.

            4. If none are present, use all stored keys for the domain provided
            in the `domain` field of the request.

            5. If dkim_private_key is present, dkim_selector must be present.

            6. If dkim_selector is present and dkim_domain is not, the domain
            will be taken from the `domain` field of the request.
          items:
            $ref: '#/components/schemas/DkimSetting'
          maxItems: 10
          type: array
        domain:
          description: >
            Domain used for sending emails. If dkim_settings are not provided,
            or dkim_settings are provided with no dkim_domain,

            the stored dkim settings for this domain will be used.
          type: string
        sender_id:
          description: >
            Used exclusively for [Domain
            Lockdown](https://support.mailchannels.com/hc/en-us/articles/16918954360845-Secure-your-domain-name-against-spoofing-with-Domain-Lockdown)
            verification.

            If you're not using `senderid` to associate your domain with your
            account, you can disregard this field.

            The corresponding value is included in the X-MailChannels-SenderId
            header of emails sent via MailChannels.
          type: string
      required:
        - domain
      type: object
    CheckDomainResult:
      properties:
        check_results:
          $ref: '#/components/schemas/CheckResults'
        references:
          description: >-
            Link to SPF, Domain Lockdown or DKIM references, displayed if any
            verdict is not passed.
          items:
            type: string
          type: array
      type: object
    ErrorResponse:
      properties:
        errors:
          description: >
            This is an array error objects that provide machine and human
            readable descriptions of the errors.
          items:
            type: string
          type: array
      type: object
    DkimSetting:
      description: |
        Domain, selector and private key for DKIM signing.
      properties:
        dkim_domain:
          description: >
            The Signing Domain Identifier; the d= field in a DKIM-Signature
            header
          type: string
        dkim_private_key:
          description: |
            Encoded in Base64.
          type: string
        dkim_selector:
          type: string
      type: object
    CheckResults:
      properties:
        dkim:
          items:
            $ref: '#/components/schemas/DkimResult'
          type: array
        domain_lockdown:
          $ref: '#/components/schemas/LockdownResult'
        sender_domain:
          $ref: '#/components/schemas/SenderDomainResult'
        spf:
          $ref: '#/components/schemas/SpfResult'
      type: object
    DkimResult:
      properties:
        dkim_domain:
          type: string
        dkim_key_status:
          description: >
            The human readable status of the DKIM key used for verification.

            This field is only present if the DKIM check was performed using a
            DKIM key managed by MailChannels.

            If a DKIM key is present in the request, this field will not be
            included.
          type: string
        dkim_selector:
          type: string
        reason:
          description: A human-readable explanation of DKIM check.
          type: string
        verdict:
          enum:
            - passed
            - failed
          type: string
      type: object
    LockdownResult:
      properties:
        reason:
          description: |
            A human-readable explanation of Domain Lockdown check.
          type: string
        verdict:
          enum:
            - passed
            - failed
          type: string
      type: object
    SenderDomainResult:
      description: >
        These results are here to help avoid SDNF (Sender Domain Not Found)
        blocks.

        For messages not to get blocked by
        [SDNF](https://support.mailchannels.com/hc/en-us/articles/203155500-550-5-2-1-SDNF-Sender-Domain-Not-Found),

        we require either an MX or A record to exist for the sender domain.
      properties:
        a:
          properties:
            reason:
              description: |
                A human-readable explanation of A record check.
              type: string
            verdict:
              enum:
                - passed
                - failed
              type: string
          type: object
        mx:
          properties:
            reason:
              description: |
                A human-readable explanation of MX record check.
              type: string
            verdict:
              enum:
                - passed
                - failed
              type: string
          type: object
        verdict:
          description: Overall verdict. Passed if either A or MX record check passed.
          enum:
            - passed
            - failed
          type: string
      type: object
    SpfResult:
      properties:
        reason:
          description: |
            A human-readable explanation of SPF check.
          type: string
        spfRecord:
          description: |
            The SPF record that was used for the check.
          type: string
        spfRecordError:
          description: |
            Error message if the SPF record lookup failed.
          type: string
        verdict:
          enum:
            - passed
            - failed
            - soft failed
            - temporary error
            - permanent error
            - neutral
            - none
            - unknown
          type: string
      type: object

````