API Reference · Email security

Verify DKIM Selectors

Verify DKIM selectors you supply

POST/v1/applications/{application_id}/dkim-selectors

Free (guest token or account)MCP:verify_dkim_selectors

cURL example

cURL request

curl -X POST "https://api.verifiedinbox.ai/v1/applications/0192a5e0-1234-7000-8000-000000000001/dkim-selectors" \
  -H "VI-Guest-Token: vi_guest_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "selectors": [
      "string"
    ]
  }'

Parameters

Parameter	Type	Description
application_idpathrequired	string (uuid)	Application id.
VI-Environmentheader	string	`live` (default) or `test`. Used for anonymous callers and OAuth access tokens; API keys and web sessions carry their own environment.

Request body

application/json · required

Field	Type	Description
selectorsrequired	string[]	DKIM selectors to check, e.g. `google`, `s1` (from the sending service's setup page).

Example request payload (DkimSelectorsRequest)

{
  "selectors": [
    "string"
  ]
}

Response

200 OKUpdated report.

application/json

Field	Type	Description
checked_atrequired	string (date-time) \| null	—
dmarc_reportsrequired	object	Where daily DMARC reports go; every suggested record uses these addresses. Nested fields (3) `addresses` (string[]): Plain email addresses daily reports go to. `receives_email` (boolean): For an address at the domain itself: whether the domain has mail servers to receive the reports. `null` when we can't tell. `source` (string): `custom`: chosen with `setDmarcReports`. `published`: from the domain's current record. `suggested`: our default, `dmarc@<organizational domain>`.
dmarc_rolloutrequired	DmarcRollout \| null	— Nested fields (11) `direct_record` (RecordFix): The blocking record, for publishing directly or skipping ahead. `email_usage` (string) `enforced` (boolean): True when the policy meets the verified-logo requirement (filter all or block all, for all mail). `next_stage` (string) `path` (string): `direct`: publish the blocking record now (no or little email). `staged`: watch → filter some → filter all → block all. `plan` (object[]) `ready_to_advance` (boolean): Our suggestion; waiting times are never enforced. `reason` (string) `recommended_record` (RecordFix) `removed_tags` (string[]): Tags of the published record the suggested records leave out, e.g. `sp=none` (a verified logo needs subdomains protected). `ruf`, `adkim`, `aspf`, `fo`, `ri` and an enforcing `sp` are kept. `stage` (string)
email_usagerequired	string \| null	— Allowed: `none`, `low`, `active`
reportrequired	EmailAuthReport \| null	— Nested fields (10) `bimi` (object) `checked_at` (string (date-time)) `dkim` (object) `dmarc` (object) `domain` (string) `findings` (Finding[]): Every finding, most severe first. `mx` (object) `resolver` (string): Least-fresh source used; `authoritative` = the domain's own nameservers. `score` (object) `spf` (object)
suggested_email_usagerequired	string \| null	Our guess from DNS (no mail servers → `none`, two or more `include:` in SPF → `active`); the customer decides. Allowed: `none`, `low`, `active`

Example 200 response (EmailSecurity)

{
  "checked_at": "2026-10-31T12:00:00Z",
  "dmarc_reports": {
    "addresses": [],
    "receives_email": true,
    "source": "custom"
  },
  "dmarc_rollout": {
    "direct_record": {
      "host": "string",
      "note": "string",
      "type": "string",
      "value": "string"
    },
    "email_usage": "none",
    "enforced": true,
    "next_stage": "missing",
    "path": "direct",
    "plan": [],
    "ready_to_advance": true,
    "reason": "Updated company logo",
    "recommended_record": {
      "host": "string",
      "note": "string",
      "type": "string",
      "value": "string"
    },
    "removed_tags": [],
    "stage": "missing"
  },
  "email_usage": "none",
  "report": {
    "bimi": {
      "authority_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
      "findings": [],
      "logo_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
      "record": "string",
      "status": "pass"
    },
    "checked_at": "2026-10-31T12:00:00Z",
    "dkim": {
      "findings": [],
      "selectors": [],
      "status": "pass"
    },
    "dmarc": {
      "findings": [],
      "inherited_from": "string",
      "pct": 1,
      "policy": "none",
      "record": "string",
      "rollout_stage": "missing",
      "rua": [],
      "status": "pass",
      "subdomain_policy": "none"
    },
    "domain": "acme.com",
    "findings": [],
    "mx": {
      "provider": {
        "id": "0192a5e0-1234-7000-8000-000000000001",
        "name": "Acme Inc."
      },
      "records": [],
      "status": "pass"
    },
    "resolver": "authoritative",
    "score": {
      "passed": 1,
      "status": "ready",
      "total": 1
    },
    "spf": {
      "all": "string",
      "findings": [],
      "lookups": 1,
      "record": "string",
      "status": "pass"
    }
  },
  "suggested_email_usage": "none"
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response

{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}

401 (unauthenticated)`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

Example 401 error response

{
  "error": {
    "code": "unauthenticated",
    "message": "Sign in or provide an API key to continue.",
    "next_action": {
      "kind": "sign_in",
      "title": "Sign in or create an account",
      "url": "/login"
    }
  }
}

404 (not_found)`not_found` — doesn't exist or isn't accessible to you (never 403).

`not_found` — doesn't exist or isn't accessible to you (never 403).

Example 404 error response

{
  "error": {
    "code": "not_found",
    "message": "We couldn't find that resource."
  }
}

422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response

{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}

429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}

Was it helpful?