Email Auth API

API reference

Email Auth HTTP endpoints on api.syndaq.com.

All Email Auth endpoints are served from https://api.syndaq.com/v1/emailauth/.

Authenticated requests require a valid Email Auth key. Lookup routes require your ea_sec_ secret key.

Endpoints overview

Method	Path	Auth	Purpose
GET	`/v1/emailauth/lookup`	Secret key	Lookup by `?domain=` query parameter
GET	`/v1/emailauth/lookup/{domain}`	Secret key	Lookup by domain in the URL path
GET	`/v1/emailauth/status`	Public or secret key	Plan limits and quota snapshot

Response headers

Successful and error responses may include:

Header	Description
`X-Request-Id`	Unique ID for support and log correlation
`X-RateLimit-Limit`	Plan requests per minute for this key
`X-RateLimit-Remaining`	Requests left in the current minute window
`X-RateLimit-Reset`	Unix timestamp when the minute window resets
`X-Quota-Limit`	Monthly quota for the subscription
`X-Quota-Remaining`	Lookups left this calendar month (UTC)
`X-Quota-Period`	Current quota month (`YYYY-MM`)
`Retry-After`	Seconds to wait after HTTP 429

GET /v1/emailauth/lookup

Returns SPF, DKIM, and DMARC authentication signals for a single domain.

Request

Pass the target domain using one of these forms:

GET /v1/emailauth/lookup/example.com
GET /v1/emailauth/lookup?domain=example.com

Headers:

Authorization: Bearer ea_sec_YOUR_SECRET_KEY

Success response (200)

{
  "success": true,
  "domain": "example.com",
  "cached": true,
  "fetched_at": "2026-07-15 12:00:00.000",
  "score": 100,
  "spf": {
    "found": true,
    "record": "v=spf1 -all"
  },
  "dkim": {
    "found": true,
    "selectors": [
      {
        "selector": "selector1",
        "record": "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."
      }
    ]
  },
  "dmarc": {
    "found": true,
    "record": "v=DMARC1; p=reject; rua=mailto:[email protected]"
  },
  "request_id": "e6d04020be9b57b1e1069d6e483c0443"
}

Scoring

The score is a presence-based composite (0–100):

Signal	Points when found
SPF	35
DMARC	40
DKIM (any known selector)	25

This score reflects whether records exist, not policy strength or alignment success on real mail.

DKIM is detected by querying common selectors (default, google, selector1, selector2, k1, s1, s2, mail, smtp) as {selector}._domainkey.{domain} TXT records.

Response fields

Field	Type	Description
`domain`	string	Normalized domain that was checked
`cached`	boolean	`true` when Syndaq already holds a recent result for this lookup
`fetched_at`	string	When this result was last retrieved
`score`	integer	Composite presence score from 0 to 100
`spf.found`	boolean	Whether a `v=spf1` TXT record was found
`spf.record`	string \	null	Raw SPF record when present
`dkim.found`	boolean	Whether any DKIM selector returned a record
`dkim.selectors`	array	Matching selector objects (`selector`, `record`)
`dmarc.found`	boolean	Whether a `v=DMARC1` record was found at `_dmarc.`
`dmarc.record`	string \	null	Raw DMARC record when present

GET /v1/emailauth/status

Returns key status, plan limits, and quota usage without performing a lookup.

Request

GET /v1/emailauth/status
Authorization: Bearer ea_sec_YOUR_SECRET_KEY

The public key (ea_pub_) is accepted on this route.

Success response (200)

{
  "success": true,
  "status": "active",
  "product": "emailauth",
  "plan": "starter",
  "rate_limit_per_minute": 120,
  "monthly_quota": 10000,
  "quota_unlimited": false,
  "quota_remaining": 9842,
  "quota_period": "2026-07",
  "database_records": 42000
}

Errors

Failed requests return JSON with success: false, error, error_code, and usually request_id.

HTTP	error_code	Typical cause
400	`invalid_domain`	Missing or malformed domain
401	`missing_credentials`	No API key provided
401	`invalid_api_key`	Unknown, inactive, or revoked key
401	`wrong_key_type`	Public key used on a lookup endpoint
403	`ip_not_allowed`	Caller IP not on the key allowlist
429	`rate_limit_exceeded`	Per-minute limit exceeded
429	`quota_exceeded`	Monthly quota exhausted
502	`lookup_failed`	Temporary DNS lookup failure
500	`internal_error`	Unexpected server error

Handle non-200 responses in your application and retry transient errors with exponential backoff.