Email Security Checker Template
- Next.js
- TypeScript
Grade any domain’s SPF and DMARC setup from A to F, with both records decoded and a checklist of what to fix.
A Next.js app that checks how well a domain is protected against email spoofing. Enter a domain or an email address and get an A to F grade, a plain-language checklist, and its SPF and DMARC records with every tag explained. Use it to audit your own domains or a client’s before a launch, or lift the API route to add a deliverability check to your own onboarding.
What it does
- An A to F grade
- Scores SPF strictness and DMARC policy into one grade, with a checklist that says what each finding means.
- Records, decoded
- Shows the raw SPF and DMARC records with their tags highlighted, and explains every DMARC tag in words.
- What to add
- When a record is missing, suggests a safe starting record to publish.
- Two APIs, one call
- The route asks SPF Validator and DMARC Validator in parallel and caches the pair for an hour.
- Keeps your key private
- The browser only talks to your own API route, which checks the domain and limits each visitor to 10 checks a minute.
How it works
The API route: it cleans up the domain, then calls SPF Validator and DMARC Validator together.
/** GET /api/check?domain=...: a domain's SPF and DMARC records, looked up together. */
export async function GET(request: Request) {
const domain = str(new URL(request.url).searchParams.get('domain'), 253)
.toLowerCase()
.replace(/^https?:\/\//, '')
.replace(/\/.*$/, '')
.replace(/^.*@/, ''); // accept an email address too
if (!domain) return fail('Enter a domain, like example.com');
if (!/^[a-z0-9.-]+\.[a-z0-9-]{2,}$/.test(domain)) return fail('That doesn’t look like a domain, like example.com');
const key = `check:${domain}`;
const hit = fromCache<Report>(key, TTL_MS);
if (hit) return Response.json(hit);
const blocked = guard(request);
if (blocked) return blocked;
return respond(async () => {
const [spf, dmarc] = await Promise.all([
callApi<Spf & { spf_records_list?: unknown; authorized_ips?: unknown; domains_extracted?: unknown }>('spfvalidator', { query: { domain } }),
callApi<Dmarc>('dmarcvalidator', { query: { domain } })
]);
// The page doesn't draw the full include tree, so leave the bulky lists out of the response.
delete spf.spf_records_list;
delete spf.authorized_ips;
delete spf.domains_extracted;
const report: Report = { domain, spf, dmarc };
toCache(key, report);
return report;
});
}Deploy it
- Get a free API key
The free plan includes 200 credits a month, no card needed. Create your key.
- Deploy it
Click Deploy to Vercel. Vercel copies the repo to your GitHub account and asks for
APIVERVE_API_KEY: paste your key there. - Open your app
Vercel builds it and gives you a live URL, usually in about a minute. Every push to the repo redeploys it.
Try the SPF Validator API — the call this template makes
GETapi.apiverve.com/v1/spfvalidator?domain=myspace.com
Query parametersVerificationFormat
No key required to try it. Get a key to use it in your app.
{
"status": "ok",
"error": null,
"data": {
"host": "myspace.com",
"has_spf_record": true,
"dns_lookups_num": 9,
"spf_record": "v=spf1 mx ip4:63.208.226.34 ip4:204.16.32.0/22 ip4:67.134.143.0/24 ip4:216.205.243.0/24 ip4:34.85.156.5/32 ip4:35.245.108.108/32 ip4:34.86.129.193/32 ip4:34.86.134.94/32 ip4:34.85.222.234/32 ip4:34.86.176.234/32 ip4:34.86.125.212/32 ip4:34.85.224.60/32 ip4:34.86.160.49/32 ip4:35.245.64.166/32 ip4:35.188.226.11/32 ip4:34.86.208.228/32 ip4:34.85.216.144/32 ip4:35.221.22.153/32 ip4:34.86.137.108/32 ip4:34.86.51.35/32 ip4:34.150.221.40/32 ip4:34.85.216.70/32 ip4:34.86.37.191/32 ip4:34.85.214.215/32 ip4:35.236.234.82/32 ip4:34.86.161.241/32 ip4:216.32.181.16 ip4:216.178.32.0/20 ip4:168.235.224.0/24 include:_netblocks.mimecast.com -all",
"spf_records_list": [
{
"origin": "myspace.com",
"record": "v=spf1 mx ip4:63.208.226.34 ip4:204.16.32.0/22 ip4:67.134.143.0/24 ip4:216.205.243.0/24 ip4:34.85.156.5/32 ip4:35.245.108.108/32 ip4:34.86.129.193/32 ip4:34.86.134.94/32 ip4:34.85.222.234/32 ip4:34.86.176.234/32 ip4:34.86.125.212/32 ip4:34.85.224.60/32 ip4:34.86.160.49/32 ip4:35.245.64.166/32 ip4:35.188.226.11/32 ip4:34.86.208.228/32 ip4:34.85.216.144/32 ip4:35.221.22.153/32 ip4:34.86.137.108/32 ip4:34.86.51.35/32 ip4:34.150.221.40/32 ip4:34.85.216.70/32 ip4:34.86.37.191/32 ip4:34.85.214.215/32 ip4:35.236.234.82/32 ip4:34.86.161.241/32 ip4:216.32.181.16 ip4:216.178.32.0/20 ip4:168.235.224.0/24 include:_netblocks.mimecast.com -all",
"chars_num": 637,
"use_macro": false,
"domains": [
"_netblocks.mimecast.com"
],
"authorized_ips": {
"ipv4": [
"63.208.226.34",
"204.16.32.0/22",
"67.134.143.0/24",
"216.205.243.0/24",
"34.85.156.5/32",
"35.245.108.108/32",
"34.86.129.193/32",
"34.86.134.94/32",
"34.85.222.234/32",
"34.86.176.234/32",
"34.86.125.212/32",
"34.85.224.60/32",
"34.86.160.49/32",
"35.245.64.166/32",
"35.188.226.11/32",
"34.86.208.228/32",
"34.85.216.144/32",
"35.221.22.153/32",
"34.86.137.108/32",
"34.86.51.35/32",
"34.150.221.40/32",
"34.85.216.70/32",
"34.86.37.191/32",
"34.85.214.215/32",
"35.236.234.82/32",
"34.86.161.241/32",
"216.32.181.16",
"216.178.32.0/20",
"168.235.224.0/24"
]
}
},
{
"origin": "_netblocks.mimecast.com",
"record": "v=spf1 include:eu._netblocks.mimecast.com include:us._netblocks.mimecast.com include:za._netblocks.mimecast.com include:de._netblocks.mimecast.com include:au._netblocks.mimecast.com include:ca._netblocks.mimecast.com include:usb._netblocks.mimecast.com ~all",
"chars_num": 257,
"use_macro": false,
"domains": [
"eu._netblocks.mimecast.com",
"us._netblocks.mimecast.com",
"za._netblocks.mimecast.com",
"de._netblocks.mimecast.com",
"au._netblocks.mimecast.com",
"ca._netblocks.mimecast.com",
"usb._netblocks.mimecast.com"
]
},
{
"origin": "eu._netblocks.mimecast.com",
"record": "v=spf1 ip4:195.130.217.0/24 ip4:91.220.42.0/24 ip4:146.101.78.0/24 ip4:207.82.80.0/24 ip4:213.167.81.0/25 ip4:193.7.207.0/25 ip4:213.167.75.0/25 ip4:185.58.85.0/24 ip4:185.58.86.0/24 ip4:193.7.206.0/25 ip4:147.28.36.0/24 ~all",
"chars_num": 225,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"195.130.217.0/24",
"91.220.42.0/24",
"146.101.78.0/24",
"207.82.80.0/24",
"213.167.81.0/25",
"193.7.207.0/25",
"213.167.75.0/25",
"185.58.85.0/24",
"185.58.86.0/24",
"193.7.206.0/25",
"147.28.36.0/24"
]
}
},
{
"origin": "us._netblocks.mimecast.com",
"record": "v=spf1 ip4:207.211.31.0/25 ip4:205.139.110.0/24 ip4:216.205.24.0/24 ip4:170.10.129.0/24 ip4:63.128.21.0/24 ip4:170.10.133.0/24 ip4:185.58.84.93/32 ip4:207.211.41.113/32 ip4:207.211.30.64/26 ip4:207.211.30.128/25 ip4:216.145.221.0/24 ip4:170.10.128.0/24 ip4:170.10.132.56/29 ip4:170.10.132.64/29 ~all",
"chars_num": 299,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"207.211.31.0/25",
"205.139.110.0/24",
"216.205.24.0/24",
"170.10.129.0/24",
"63.128.21.0/24",
"170.10.133.0/24",
"185.58.84.93/32",
"207.211.41.113/32",
"207.211.30.64/26",
"207.211.30.128/25",
"216.145.221.0/24",
"170.10.128.0/24",
"170.10.132.56/29",
"170.10.132.64/29"
]
}
},
{
"origin": "za._netblocks.mimecast.com",
"record": "v=spf1 ip4:41.74.192.0/22 ip4:41.74.200.0/23 ip4:41.74.196.0/22 ip4:41.74.204.0/23 ip4:41.74.206.0/24 ~all",
"chars_num": 106,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"41.74.192.0/22",
"41.74.200.0/23",
"41.74.196.0/22",
"41.74.204.0/23",
"41.74.206.0/24"
]
}
},
{
"origin": "de._netblocks.mimecast.com",
"record": "v=spf1 ip4:51.163.158.0/24 ip4:194.104.109.0/24 ip4:194.104.111.0/24 ip4:194.104.110.21/32 ip4:194.104.110.240/28 ip4:62.140.10.21/32 ip4:62.140.7.0/24 ip4:194.104.108.240/29 ip4:194.104.108.21/32 ip4:51.163.159.0/24 ~all",
"chars_num": 221,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"51.163.158.0/24",
"194.104.109.0/24",
"194.104.111.0/24",
"194.104.110.21/32",
"194.104.110.240/28",
"62.140.10.21/32",
"62.140.7.0/24",
"194.104.108.240/29",
"194.104.108.21/32",
"51.163.159.0/24"
]
}
},
{
"origin": "au._netblocks.mimecast.com",
"record": "v=spf1 ip4:103.13.69.0/24 ip4:124.47.150.0/24 ip4:124.47.189.0/24 ip4:103.96.23.0/24 ip4:103.96.21.0/24 ip4:180.189.28.0/24 ip4:216.145.217.0/24 ip4:103.96.22.96/28 ip4:103.96.22.22/32 ip4:103.96.20.22/32 ip4:103.96.20.96/28 ~all",
"chars_num": 229,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"103.13.69.0/24",
"124.47.150.0/24",
"124.47.189.0/24",
"103.96.23.0/24",
"103.96.21.0/24",
"180.189.28.0/24",
"216.145.217.0/24",
"103.96.22.96/28",
"103.96.22.22/32",
"103.96.20.22/32",
"103.96.20.96/28"
]
}
},
{
"origin": "ca._netblocks.mimecast.com",
"record": "v=spf1 ip4:170.10.145.0/24 ip4:170.10.147.0/24 ip4:170.10.144.126/32 ip4:170.10.146.126/32 ip4:170.10.144.240/29 ip4:170.10.146.240/29 ip4:216.145.216.0/24 ~all",
"chars_num": 160,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"170.10.145.0/24",
"170.10.147.0/24",
"170.10.144.126/32",
"170.10.146.126/32",
"170.10.144.240/29",
"170.10.146.240/29",
"216.145.216.0/24"
]
}
},
{
"origin": "usb._netblocks.mimecast.com",
"record": "v=spf1 ip4:170.10.151.0/24 ip4:170.10.153.0/24 ip4:170.10.150.240/29 ip4:170.10.152.240/29 ip4:170.10.156.0/24 ip4:170.10.157.0/24 ~all",
"chars_num": 135,
"use_macro": false,
"authorized_ips": {
"ipv4": [
"170.10.151.0/24",
"170.10.153.0/24",
"170.10.150.240/29",
"170.10.152.240/29",
"170.10.156.0/24",
"170.10.157.0/24"
]
}
}
],
"domains_extracted": [
"myspace.com",
"_netblocks.mimecast.com",
"eu._netblocks.mimecast.com",
"us._netblocks.mimecast.com",
"za._netblocks.mimecast.com",
"de._netblocks.mimecast.com",
"au._netblocks.mimecast.com",
"ca._netblocks.mimecast.com",
"usb._netblocks.mimecast.com"
],
"authorized_ips": {
"ipv4": [
"63.208.226.34",
"204.16.32.0/22",
"67.134.143.0/24",
"216.205.243.0/24",
"34.85.156.5/32",
"35.245.108.108/32",
"34.86.129.193/32",
"34.86.134.94/32",
"34.85.222.234/32",
"34.86.176.234/32",
"34.86.125.212/32",
"34.85.224.60/32",
"34.86.160.49/32",
"35.245.64.166/32",
"35.188.226.11/32",
"34.86.208.228/32",
"34.85.216.144/32",
"35.221.22.153/32",
"34.86.137.108/32",
"34.86.51.35/32",
"34.150.221.40/32",
"34.85.216.70/32",
"34.86.37.191/32",
"34.85.214.215/32",
"35.236.234.82/32",
"34.86.161.241/32",
"216.32.181.16",
"216.178.32.0/20",
"168.235.224.0/24",
"195.130.217.0/24",
"91.220.42.0/24",
"146.101.78.0/24",
"207.82.80.0/24",
"213.167.81.0/25",
"193.7.207.0/25",
"213.167.75.0/25",
"185.58.85.0/24",
"185.58.86.0/24",
"193.7.206.0/25",
"147.28.36.0/24",
"207.211.31.0/25",
"205.139.110.0/24",
"216.205.24.0/24",
"170.10.129.0/24",
"63.128.21.0/24",
"170.10.133.0/24",
"185.58.84.93/32",
"207.211.41.113/32",
"207.211.30.64/26",
"207.211.30.128/25",
"216.145.221.0/24",
"170.10.128.0/24",
"170.10.132.56/29",
"170.10.132.64/29",
"41.74.192.0/22",
"41.74.200.0/23",
"41.74.196.0/22",
"41.74.204.0/23",
"41.74.206.0/24",
"51.163.158.0/24",
"194.104.109.0/24",
"194.104.111.0/24",
"194.104.110.21/32",
"194.104.110.240/28",
"62.140.10.21/32",
"62.140.7.0/24",
"194.104.108.240/29",
"194.104.108.21/32",
"51.163.159.0/24",
"103.13.69.0/24",
"124.47.150.0/24",
"124.47.189.0/24",
"103.96.23.0/24",
"103.96.21.0/24",
"180.189.28.0/24",
"216.145.217.0/24",
"103.96.22.96/28",
"103.96.22.22/32",
"103.96.20.22/32",
"103.96.20.96/28",
"170.10.145.0/24",
"170.10.147.0/24",
"170.10.144.126/32",
"170.10.146.126/32",
"170.10.144.240/29",
"170.10.146.240/29",
"216.145.216.0/24",
"170.10.151.0/24",
"170.10.153.0/24",
"170.10.150.240/29",
"170.10.152.240/29",
"170.10.156.0/24",
"170.10.157.0/24"
],
"ipv6": []
},
"issues_found": [],
"spf_valid": true,
"has_issues": false,
"macros_found": false,
"ip_pass": false,
"elapsed_ms": 431,
"all_qualifier": "fail",
"risk_score": 5,
"risk_level": "low"
}
}