--- title: "Tools" description: "Every operation in this group: what it accepts, what it returns and the errors it can answer with." url: "https://openemail.uk/docs/api/reference/tools" area: "API" category: "Reference" --- # Tools Every operation in this group: what it accepts, what it returns and the errors it can answer with. ## Operations Checks of the public mail records of any domain, the free tools on the OpenEmail website: its DMARC policy, its BIMI logo, and a deliverability report across MX, SPF, DKIM, DMARC and BIMI. They read public DNS and nothing in the workspace, so they need no scope, and every answer is what DNS said at that moment. ### `GET /tools/dmarc` Check a domain's DMARC policy Reads the domain's DMARC record from public DNS, or the record of the organisational domain it inherits from, and says how strict it is and what is wrong with it. `stage` is `missing`, `invalid`, `monitor` for `p=none`, `quarantine` or `reject`. Needs no scope: any key or access token for the workspace may run it. - Needs an API key or an OAuth access token, and no scope. **Query parameters** - `domain` (`string`, required, up to 320 characters): The domain to check, such as `acme.com`. An email address, a URL or a domain with a trailing dot is read as its domain. Any public domain works, not only the ones in this workspace. **Returns** - `200` `DmarcReport`: What the DMARC record says. **Errors** - `422`: `invalid_parameter` on `domain`: it does not read as a domain. - `503`: `unreachable`: public DNS did not answer for the domain just now. Nothing about the domain was decided, so try again in a moment. - The errors every operation can return: `400`, `401`, `403`, `404`, `500`, described in the [error catalog](https://openemail.uk/docs/api/errors). Also available in: SDK [`tools.checkDmarc()`](https://openemail.uk/docs/sdk/reference/tools#checkDmarc); CLI [`openemail tools check-dmarc`](https://openemail.uk/docs/cli/reference/tools#tools-check-dmarc); MCP [`checkDmarc`](https://openemail.uk/docs/mcp/tools/domain-checks#checkDmarc). ### `GET /tools/bimi` Check a domain's BIMI logo Reads the domain's BIMI record, fetches the logo it names and checks the DMARC policy beside it, since inboxes draw a logo only at `p=quarantine` or `p=reject`. `status` is `present`, `partial` when the record is there but something stops inboxes showing it, `absent` or `invalid`, and `issues` says why. Needs no scope: any key or access token for the workspace may run it. - Needs an API key or an OAuth access token, and no scope. **Query parameters** - `domain` (`string`, required, up to 320 characters): The domain to check, such as `acme.com`. An email address, a URL or a domain with a trailing dot is read as its domain. Any public domain works, not only the ones in this workspace. **Returns** - `200` `BimiReport`: What the BIMI record says and whether inboxes can draw the logo. **Errors** - `422`: `invalid_parameter` on `domain`: it does not read as a domain. - `503`: `unreachable`: public DNS did not answer for the domain just now. Nothing about the domain was decided, so try again in a moment. - The errors every operation can return: `400`, `401`, `403`, `404`, `500`, described in the [error catalog](https://openemail.uk/docs/api/errors). Also available in: SDK [`tools.checkBimi()`](https://openemail.uk/docs/sdk/reference/tools#checkBimi); CLI [`openemail tools check-bimi`](https://openemail.uk/docs/cli/reference/tools#tools-check-bimi); MCP [`checkBimi`](https://openemail.uk/docs/mcp/tools/domain-checks#checkBimi). ### `GET /tools/deliverability` Check a domain's deliverability Checks the records a receiving mailbox reads before it trusts mail from the domain: MX, SPF, DKIM at the selectors its mail provider uses, DMARC and BIMI. Each check says `pass`, `warn`, `fail` or `absent` with a verdict and notes written to be shown to a person, and `score` weighs them into 0 to 100, graded A to F. Needs no scope: any key or access token for the workspace may run it. - Needs an API key or an OAuth access token, and no scope. **Query parameters** - `domain` (`string`, required, up to 320 characters): The domain to check, such as `acme.com`. An email address, a URL or a domain with a trailing dot is read as its domain. Any public domain works, not only the ones in this workspace. **Returns** - `200` `DeliverabilityReport`: Each check, the score and the grade. **Errors** - `422`: `invalid_parameter` on `domain`: it does not read as a domain. - `503`: `unreachable`: public DNS did not answer for the domain just now. Nothing about the domain was decided, so try again in a moment. - The errors every operation can return: `400`, `401`, `403`, `404`, `500`, described in the [error catalog](https://openemail.uk/docs/api/errors). Also available in: SDK [`tools.checkDeliverability()`](https://openemail.uk/docs/sdk/reference/tools#checkDeliverability); CLI [`openemail tools check-deliverability`](https://openemail.uk/docs/cli/reference/tools#tools-check-deliverability); MCP [`checkDeliverability`](https://openemail.uk/docs/mcp/tools/domain-checks#checkDeliverability). ### Objects #### `BimiReport` `object` - `object` (`string`, required, one of `"bimi_report"`) - `domain` (`string`, required) - `record` (`string`, required, nullable): The BIMI record at `default._bimi`, or null. - `version` (`string`, nullable) - `logoUrl` (`string`, nullable): The `l=` of the record: where the SVG logo is served. - `authorityUrl` (`string`, nullable): The `a=` of the record: where the mark certificate is served, or null without one. - `logoSvg` (`string`, nullable): The logo as it was fetched, when it could be, to show it. - `logoReachable` (`boolean`) - `dmarcPolicy` (`string`, nullable): The `p=` of the DMARC record beside it. - `dmarcEnforced` (`boolean`): Whether that policy is `quarantine` or `reject`, the only ones under which a logo is drawn. - `status` (`string`, required, one of `"present"`, `"partial"`, `"absent"`, `"invalid"`) - `issues` (`string[]`, required) #### `DeliverabilityCheck` `object` - `id` (`string`, required, one of `"mx"`, `"spf"`, `"dkim"`, `"dmarc"`, `"bimi"`) - `label` (`string`, required) - `status` (`string`, required, one of `"pass"`, `"warn"`, `"fail"`, `"absent"`) - `verdict` (`string`, required): One line saying what was found. - `record` (`string`, required, nullable): The record that was read, when there is one. - `notes` (`string[]`, required) #### `DeliverabilityReport` `object` - `object` (`string`, required, one of `"deliverability_report"`) - `domain` (`string`, required) - `score` (`integer`, required, at least 0, at most 100) - `grade` (`string`, required, one of `"A"`, `"B"`, `"C"`, `"D"`, `"F"`) - `provider` (`string`, required, nullable): The mail provider its MX records point at, such as `Google Workspace`, when it is known. - `checks` (`DeliverabilityCheck[]`, required) #### `DmarcReport` `object` - `object` (`string`, required, one of `"dmarc_report"`) - `domain` (`string`, required): The domain that was checked, lower-cased. - `record` (`string`, required, nullable): The DMARC record as published, or null when there is none. - `inheritedFrom` (`string`, required, nullable): The parent domain whose record applies, when the domain has none of its own. Null when the record is its own or there is none. - `tags` (`Record`, required): Every tag of the record, such as `p`, `sp`, `pct` and `rua`, as written. - `stage` (`string`, required, one of `"missing"`, `"invalid"`, `"monitor"`, `"quarantine"`, `"reject"`) - `issues` (`string[]`, required): Problems found, each written to be shown to a person. Empty when there are none.