Build with DMARC Shark
DMARC Shark gives your application an explicit, on-demand view of a domain's published email DNS. Use the public JSON API for scripts, or connect an MCP-compatible client to the Streamable HTTP endpoint. No account or API key is needed in this MVP.
- JSON API → — make a fresh check or read a timestamped saved snapshot.
- Result fields → — interpret findings, DNS failures, recommendations, and examples.
- MCP tools → — connect a client and discover the two domain-scoped tools.
Fresh checks run DNS queries and may replace a saved snapshot. Saved reads never query DNS. Neither mode examines actual email, proves domain ownership, or guarantees deliverability or protection from impersonation. If you just need a one-off result, use the web checker.
Quick start
curl -sS https://dmarcshark.com/api/v1/checks \
-H 'Content-Type: application/json' \
-d '{"domain":"poshtui.com"}'
The response includes source: "fresh", a UTC checked_at, per-record findings and evidence-linked recommendations. For a stored snapshot without a new check:
curl -sS https://dmarcshark.com/api/v1/domains/poshtui.com
What gets checked
| Record | DNS location | What it can tell you |
|---|---|---|
| SPF | TXT at the submitted domain | Published envelope-sender policy, not real sender coverage. |
| DMARC | TXT at _dmarc.<domain>, with organizational-domain fallback for subdomains |
Published or inherited visible-From alignment policy, not receiver behavior. |
| MX | MX at the submitted domain | Advertised inbound mail exchangers, not whether it sends. |
| DKIM | TXT at each explicitly supplied <selector>._domainkey.<domain> |
A key at that selector, not whether messages are signed. |
Use these results as published-DNS evidence, not a security score. Missing records and failed lookups have different meanings; see the result guide.