API Reference · Email security

Recheck Email Security

Re-check email security now

POST/v1/applications/{application_id}/email-security/check

Free (guest token or account)MCP:recheck_email_security

Run after changing DNS records. Uses the domain's authoritative nameservers, so changes show within seconds. DKIM selectors found earlier are checked again. Sandbox domains simulate publishing the recommended DMARC record.

cURL example

cURL request

curl -X POST "https://api.verifiedinbox.ai/v1/applications/0192a5e0-1234-7000-8000-000000000001/email-security/check" \
  -H "VI-Guest-Token: vi_guest_YOUR_TOKEN"

Parameters

Parameter	Type	Description
application_idpathrequired	string (uuid)	Application id.
VI-Environmentheader	string	`live` (default) or `test`. Used for anonymous callers and OAuth access tokens; API keys and web sessions carry their own environment.

Response

200 OKUpdated report.

application/json

Field	Type	Description
checked_atrequired	string (date-time) \| null	—
dmarc_reportsrequired	object	Where daily DMARC reports go; every suggested record uses these addresses. Nested fields (3) `addresses` (string[]): Plain email addresses daily reports go to. `receives_email` (boolean): For an address at the domain itself: whether the domain has mail servers to receive the reports. `null` when we can't tell. `source` (string): `custom`: chosen with `setDmarcReports`. `published`: from the domain's current record. `suggested`: our default, `dmarc@<organizational domain>`.
dmarc_rolloutrequired	DmarcRollout \| null	— Nested fields (11) `direct_record` (RecordFix): The blocking record, for publishing directly or skipping ahead. `email_usage` (string) `enforced` (boolean): True when the policy meets the verified-logo requirement (filter all or block all, for all mail). `next_stage` (string) `path` (string): `direct`: publish the blocking record now (no or little email). `staged`: watch → filter some → filter all → block all. `plan` (object[]) `ready_to_advance` (boolean): Our suggestion; waiting times are never enforced. `reason` (string) `recommended_record` (RecordFix) `removed_tags` (string[]): Tags of the published record the suggested records leave out, e.g. `sp=none` (a verified logo needs subdomains protected). `ruf`, `adkim`, `aspf`, `fo`, `ri` and an enforcing `sp` are kept. `stage` (string)
email_usagerequired	string \| null	— Allowed: `none`, `low`, `active`
reportrequired	EmailAuthReport \| null	— Nested fields (10) `bimi` (object) `checked_at` (string (date-time)) `dkim` (object) `dmarc` (object) `domain` (string) `findings` (Finding[]): Every finding, most severe first. `mx` (object) `resolver` (string): Least-fresh source used; `authoritative` = the domain's own nameservers. `score` (object) `spf` (object)
suggested_email_usagerequired	string \| null	Our guess from DNS (no mail servers → `none`, two or more `include:` in SPF → `active`); the customer decides. Allowed: `none`, `low`, `active`

Example 200 response (EmailSecurity)

{
  "checked_at": "2026-10-31T12:00:00Z",
  "dmarc_reports": {
    "addresses": [],
    "receives_email": true,
    "source": "custom"
  },
  "dmarc_rollout": {
    "direct_record": {
      "host": "string",
      "note": "string",
      "type": "string",
      "value": "string"
    },
    "email_usage": "none",
    "enforced": true,
    "next_stage": "missing",
    "path": "direct",
    "plan": [],
    "ready_to_advance": true,
    "reason": "Updated company logo",
    "recommended_record": {
      "host": "string",
      "note": "string",
      "type": "string",
      "value": "string"
    },
    "removed_tags": [],
    "stage": "missing"
  },
  "email_usage": "none",
  "report": {
    "bimi": {
      "authority_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
      "findings": [],
      "logo_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
      "record": "string",
      "status": "pass"
    },
    "checked_at": "2026-10-31T12:00:00Z",
    "dkim": {
      "findings": [],
      "selectors": [],
      "status": "pass"
    },
    "dmarc": {
      "findings": [],
      "inherited_from": "string",
      "pct": 1,
      "policy": "none",
      "record": "string",
      "rollout_stage": "missing",
      "rua": [],
      "status": "pass",
      "subdomain_policy": "none"
    },
    "domain": "acme.com",
    "findings": [],
    "mx": {
      "provider": {
        "id": "0192a5e0-1234-7000-8000-000000000001",
        "name": "Acme Inc."
      },
      "records": [],
      "status": "pass"
    },
    "resolver": "authoritative",
    "score": {
      "passed": 1,
      "status": "ready",
      "total": 1
    },
    "spf": {
      "all": "string",
      "findings": [],
      "lookups": 1,
      "record": "string",
      "status": "pass"
    }
  },
  "suggested_email_usage": "none"
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response

{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}

401 (unauthenticated)`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

Example 401 error response

{
  "error": {
    "code": "unauthenticated",
    "message": "Sign in or provide an API key to continue.",
    "next_action": {
      "kind": "sign_in",
      "title": "Sign in or create an account",
      "url": "/login"
    }
  }
}

404 (not_found)`not_found` — doesn't exist or isn't accessible to you (never 403).

`not_found` — doesn't exist or isn't accessible to you (never 403).

Example 404 error response

{
  "error": {
    "code": "not_found",
    "message": "We couldn't find that resource."
  }
}

422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response

{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}

429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}

Was it helpful?