MailAuthWatch

JSON API

Run a check or list your monitored domains from your own scripts and client reports. Included with the Agency plan ($79/month). Two endpoints and an MCP server, one header, no SDK.

Authentication

Generate a key on your account page (Agency plan). Send it as a bearer token on every request. Keys start with maw_, are shown once, and can be rotated from the same page.

Authorization: Bearer maw_your_key_here

Requests without a valid key get 401; keys on a plan without API access get 403.

GET /api/v1/check/{domain}

LIVE

Runs a full check right now and returns the same report the web page renders: grade, SPF with lookup count and include chain, DKIM selectors found, DMARC policy and reporting, MX, and a ranked issues array. Add ?selectors=a,b to probe your own DKIM selectors as well (up to 20).

curl -H "Authorization: Bearer maw_…" \
  "https://www.mailauthwatch.com/api/v1/check/example.com?selectors=google,selector1"

Typical latency is 200 to 800 ms; slow authoritative DNS can take a few seconds. A branch that could not be measured is reported as "status": "error", never as missing.

GET /api/v1/check/{domain}/fix

AGENT-READY

Runs a check and returns the fix plan: ranked tasks with exact record values, mail-provider and DNS-host steps, rules, verification commands, and the whole thing rendered as Markdown in markdown. Hand the Markdown to an agent, or act on tasks[].records directly.

curl -H "Authorization: Bearer maw_…" https://www.mailauthwatch.com/api/v1/check/example.com/fix
{"domain":"example.com","grade":{"letter":"C","points":55},"dnsHost":"Cloudflare","mailProvider":"Google Workspace",
  "tasks":[{"severity":"warn","title":"DMARC is sitting at p=none.","records":[{"action":"replace","type":"TXT","name":"_dmarc.example.com","value":"v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com"}],"steps":["…"]}],
  "rules":["Publish exactly one SPF record; …"],"verify":{"dig":["dig +short TXT _dmarc.example.com"],"url":"…?fresh=1","targets":["DMARC p=quarantine"]},"markdown":"# Fix email authentication for example.com …"}

No API key? The same plan is public at /check/{domain}/fix.md for one-off use.

GET /api/v1/domains

Lists the domains you monitor with their latest grade and a summary, straight from the last daily measurement. No DNS queries are made.

curl -H "Authorization: Bearer maw_…" https://www.mailauthwatch.com/api/v1/domains
{"domains":[{"id":"…","name":"client-one.com","selectors":["google"],"alertsEnabled":true,
  "lastCheckedAt":"2026-09-01T06:00:12.000Z","grade":"A",
  "summary":{"spf":"found","spfLookups":4,"dkim":"found","dmarc":"found","dmarcPolicy":"reject","issues":1}}]}

Rate limits

Check endpoint
120 requests per hour per account
Headers
X-RateLimit-Limit, X-RateLimit-Remaining
Over the limit
429 with a JSON error

Grade and status values

grade.letter
A, B, C, D or F; points is 0 to 100
spf.status
found, absent, error
dkim.status
found, not_found, error
dmarc.status
found, absent, error
issues[].sev
critical, error, warn, info
measurement
complete, partial, domain_not_found

Errors

400
Invalid domain
401
Missing or malformed bearer token
403
API requires an active Agency subscription
429
Rate limit exceeded
500
Check failed; retry

MCP server for your agents

AGENCY

Claude Code, Cursor and any MCP-capable agent can call MailAuthWatch directly instead of pasting prompts. The server speaks Streamable HTTP at https://www.mailauthwatch.com/mcp and authenticates with the same bearer key. Three tools:

check_domain
Measure a domain live; returns grade, records as published, DKIM selectors, ranked issues.
fix_plan
Measure and return the agent-ready plan as Markdown or structured JSON tasks with exact records.
list_domains
Your monitored domains with their latest grade.

Claude Code

claude mcp add mailauthwatch --transport http https://www.mailauthwatch.com/mcp   --header "Authorization: Bearer maw_your_key_here"

Cursor, Windsurf, and other clients (mcp.json)

{
  "mcpServers": {
    "mailauthwatch": {
      "url": "https://www.mailauthwatch.com/mcp",
      "headers": { "Authorization": "Bearer maw_your_key_here" }
    }
  }
}

Then ask your agent: "Use mailauthwatch to get a fix plan for client-one.com, show me the DNS diff, and apply it in Cloudflare." Nothing in the server changes DNS; the agent does, with your approval.

Example response (abridged)

GET /api/v1/check/example.com
{
  "domain": "example.com",
  "checkedAt": "2026-09-01T12:00:00.000Z",
  "measurement": "complete",
  "grade": {
    "letter": "B",
    "points": 80,
    "reasons": [
      "SPF present and valid",
      "SPF ends with ~all",
      "DKIM found (1 selector)",
      "DMARC present and valid",
      "DMARC policy is quarantine",
      "DMARC aggregate reporting enabled"
    ]
  },
  "spf": {
    "status": "found",
    "record": "v=spf1 include:_spf.google.com ~all",
    "lookups": 4,
    "voidLookups": 0,
    "allMechanism": "~all",
    "valid": true,
    "issues": []
  },
  "dkim": {
    "status": "found",
    "probed": 79,
    "found": [
      {
        "selector": "google",
        "bits": 2048,
        "revoked": false
      }
    ],
    "issues": []
  },
  "dmarc": {
    "status": "found",
    "record": "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com",
    "policy": "quarantine",
    "pct": 100,
    "rua": [
      "mailto:dmarc@example.com"
    ],
    "valid": true,
    "issues": []
  },
  "mx": {
    "status": "found",
    "provider": {
      "id": "google",
      "name": "Google Workspace"
    }
  },
  "issues": [
    {
      "sev": "info",
      "code": "dmarc_policy_quarantine",
      "area": "dmarc",
      "msg": "Policy is p=quarantine. p=reject is the strongest protection once you are confident all senders are aligned."
    }
  ]
}

Get an API key

Included with Agency: 50 monitored domains, webhook alerts and the API for $79/month, 14-day trial without a card.

See pricingAccount page