Domain Validation Endpoint

The domain endpoint allows you to check if a domain is used for disposable email addresses, along with additional details about the domain.

Endpoint

GET /domain/{domain}

Parameters

Parameter	Type	Required	Description
domain	string	Yes	The domain to check (e.g., github.com)

Request Example

curl -X GET "https://api.usercheck.com/domain/github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response

Success Response (200)

{
  "status": 200,
  "domain": "github.com",
  "domain_authority": 96,
  "tld_trust": 1,
  "domain_age_in_days": 6712,
  "mx": true,
  "mx_records": [
      { "hostname": "aspmx.l.google.com", "priority": 1 },
      { "hostname": "alt1.aspmx.l.google.com", "priority": 5 },
      { "hostname": "alt2.aspmx.l.google.com", "priority": 5 },
      { "hostname": "alt3.aspmx.l.google.com", "priority": 10 },
      { "hostname": "alt4.aspmx.l.google.com", "priority": 10 }
  ],
  "mx_providers": [
      { "slug": "google", "type": "mailbox", "grade": "professional" }
  ],
  "spf": "relaxed",
  "dmarc": "quarantine",
  "disposable": false,
  "public_domain": false,
  "relay_domain": false,
  "free_subdomain": false,
  "spam": false,
  "did_you_mean": null,
  "blocklisted": false
}

Response Fields

Field	Type	Description
status	integer	HTTP status code indicating the result of the API request. 200: Successful request 400: Invalid input (malformed domain) 429: Rate limit exceeded
domain	string	The domain that was checked, in normalized form: lowercased, with internationalized names converted to their ASCII (punycode) representation.
domain_authority	integer|null	A 0–100 score indicating how established and credible a domain is. Higher scores indicate well-established domains with strong online presence. Lower scores may signal newly created or less reputable domains. The value is null when the score hasn't been determined yet. Pro Plan Only
tld_trust	integer|null	A 1–5 score indicating how strict the registration requirements are for the domain's TLD. Higher scores mean the registry performed more identity verification before issuing the domain. See TLD Trust below. Pro Plan Only
domain_age_in_days	integer|null	The number of days since the domain was registered, based on the registration date reported by the domain's registry. The value is null when the registration date is unknown or hasn't been retrieved yet.
mx	boolean|null	Indicates whether the domain has valid MX (Mail Exchange) records, the DNS records that name the servers accepting mail for a domain. A value of true means the domain is configured to receive email. The value is null when the DNS lookup couldn't be completed.
mx_records	array	The domain's MX records, sorted by priority (lowest value first, the order in which sending servers try them). Each record contains the mail server hostname and its priority. Empty when the domain has no MX records.
mx_providers	array	Third-party services the domain delegates its MX records to. Empty when the domain manages its own MX infrastructure or uses an unrecognized setup. See MX Providers below.
spf	string|null	The domain's SPF posture: how strictly its published SPF record limits who may send email as the domain. One of: strict, relaxed, neutral, permissive, missing, or invalid. The value is null when the SPF posture hasn't been assessed yet. See SPF below.
dmarc	string|null	The domain's effective DMARC policy: what it asks receivers to do with mail that fails authentication. One of: reject, quarantine, none, missing, or invalid. The value is null when the DMARC policy hasn't been assessed yet. See DMARC below.
disposable	boolean	Indicates whether the domain is from a temporary or disposable email provider. These domains allow users to create temporary email addresses that typically expire after a short period, and are commonly used to bypass verification systems. Subdomains of a disposable domain are flagged as well.
disposable_provider	string|null	The primary domain of the service operating the disposable domain. Disposable providers typically rotate through large pools of interchangeable domains that all feed the same service; this field identifies the provider behind the checked domain. The value is null when the provider hasn't been identified. Only included in the response when disposable is true. Pro Plan Only
public_domain	boolean	Indicates whether the domain is a public email service like Gmail, Yahoo Mail, or Outlook, where anyone can create a mailbox. Addresses on a public domain belong to unrelated individuals, unlike addresses on a company domain, which belong to one organization.
relay_domain	boolean	Indicates whether the domain belongs to an email forwarding or relay service such as SimpleLogin, DuckDuckGo Email Protection, or Apple's Hide My Email. Addresses on these domains automatically forward mail to the owner's actual mailbox at another address, which stays hidden.
free_subdomain	boolean	Indicates whether the domain is a subdomain of a free subdomain or dynamic DNS service like duckdns.org. The parent domain itself is not flagged. See Free Subdomains below.
spam	boolean	Indicates whether the domain is associated with spam or other abusive activity. These domains often look legitimate at first glance but have been flagged in UserCheck's dataset. A domain can be flagged as spam without being disposable.
did_you_mean	string|null	A suggested correction when the domain looks like a likely misspelling of a well-known domain (e.g., gmial.com → gmail.com). The value is null when no suggestion is available.
blocklisted	boolean	Indicates whether the domain exactly matches an entry on your account's custom blocklist. Entries are managed in the dashboard or through the Blocklist endpoint. Pro Plan Only

MX Providers

mx_providers identifies the third-party services a domain delegates its MX records to (e.g., Google Workspace, Microsoft 365, Mimecast). Domains that manage their own MX infrastructure return an empty array, since they are not delegating MX to an external provider.

When mx_providers is empty

An empty array means the domain is not delegating email to a recognized third-party service. You can combine it with other response fields to understand why:

Scenario	Fields
Public email service running its own infrastructure	public_domain: true
Self-hosted or unrecognized mail setup	public_domain: false, mx: true
No mail infrastructure at all	mx: false

Provider object

Each entry in mx_providers contains:

• slug (string): A unique, URL-safe identifier for the provider (e.g., google, fastmail, mimecast).
• type (string): The provider category. Possible values:
  • mailbox: Full mailbox provider (e.g., Google Workspace, Microsoft 365, Fastmail)
  • hosting: Web hosting provider with bundled email (e.g., GoDaddy, OVH, Hostinger)
  • email_api: Transactional/programmatic email service (e.g., Mailgun, SendGrid, Postmark)
  • security_gateway: Email security or filtering gateway (e.g., Mimecast, Barracuda, Proofpoint)
  • forwarding: Email forwarding/relay service (e.g., Cloudflare Email Routing, ImprovMX, SimpleLogin)
• grade (string): Reflects how much commitment is typically required to use the provider. Higher grades suggest the domain owner has invested more effort in their email setup. Possible values:
  • enterprise: High-touch providers with sales processes and contracts (e.g., Mimecast, Proofpoint)
  • professional: Established paid providers (e.g., Google Workspace, Microsoft 365)
  • standard: Mid-range providers with moderate onboarding
  • basic: Low barrier to entry, minimal verification (e.g., free bundled hosting email)

A domain may have multiple providers when its MX records point to different services (e.g., a mailbox provider alongside a security gateway). Providers are ordered by the priority of the MX record they were detected from.

SPF

SPF (Sender Policy Framework) is how a domain declares which servers are allowed to send email in its name. Without it, anyone can send mail that appears to come from the domain. spf condenses the domain's published record into a single value: how strictly its owner controls who may send as the domain.

Value	What it means
strict	Only the domain's listed servers may send; everything else should be rejected. A deliberate, tightly managed setup.
relaxed	The domain lists its senders but asks receivers to be lenient with the rest. The most common posture for properly configured domains.
neutral	A record exists but takes no position on who may send. It provides no protection.
permissive	The record authorizes every server on the Internet to send as the domain, which defeats the point of SPF. Legitimate domains essentially never publish this deliberately.
missing	The domain publishes no SPF record. Common for domains that don't send email, and for domains set up with minimal effort.
invalid	The record is broken (for example, several conflicting records) and can't be applied.

A strict or relaxed posture means someone deliberately configured the domain's email; that's the normal state of an actively managed domain. missing or neutral doesn't make a domain suspicious on its own; many small and personal domains never set up SPF. It means SPF provides no signal about the domain either way. permissive and invalid are the outliers, rarely seen on well-run domains.

SPF applies to the exact domain that was checked; subdomains don't inherit their parent's record. The value is null when the record hasn't been assessed yet.

DMARC

DMARC is the policy a domain publishes to fight impersonation: it tells receiving servers what to do with mail that claims to come from the domain but fails authentication. dmarc reflects the policy the domain has chosen.

Value	What it means
reject	Impersonated mail should be refused outright. The strictest policy: the domain's email is actively protected.
quarantine	Impersonated mail should be delivered to spam. An enforced policy, one step softer than reject.
none	The domain monitors impersonation but asks receivers not to act on it. The most common policy, and often the first step of a gradual rollout.
missing	The domain publishes no DMARC policy at all.
invalid	A policy exists but is misconfigured and can't be applied.

An enforced policy (reject or quarantine) takes deliberate effort to set up, so it's typical of established organizations that care about their email reputation. none or missing doesn't make a domain suspicious; most of the Internet, including many legitimate businesses, runs without DMARC enforcement. Unlike SPF, a subdomain without its own policy inherits its parent domain's. The value is null when the policy hasn't been assessed yet.

TLD Trust

tld_trust quantifies how strict a TLD's registration requirements are, scored from 1 to 5. A higher score means the registry itself performed more identity verification before the domain was issued.

Score	Level	What it means	Examples
1	Open	No verification. Anyone can register in seconds.	.com, .net, .org, .xyz, .io
2	Low Trust	Rules exist on paper (residency, ID) but enforcement is minimal.	.fr, .ar, .barcelona
3	Moderate Trust	Verifiable business number or national ID required and checked.	.com.au, .it, .bd
4	High Trust	Restricted to specific institution types with accreditation documents.	.bank, .ac.uk, .ac.jp
5	Absolute Trust	Not available for public registration. Government, military, or brand TLDs.	.gov, .mil, .apple

A score of 1 doesn't mean the domain is suspicious; most legitimate businesses use open TLDs. It means the TLD itself provides no identity signal. For scores of 3 and above, the TLD becomes a meaningful trust signal on its own because the registry verified the entity behind the domain.

The value is null when the score hasn't been determined yet.

Free Subdomains

Some services hand out subdomains of their own domain to the public, for free: dynamic DNS providers like duckdns.org and free subdomain services like us.kg. Unlike an ordinary subdomain, which belongs to whoever owns the parent domain, each name under one of these namespaces is controlled by a different, unrelated person, and new ones can be created instantly.

free_subdomain is true when the domain sits under one of these namespaces. The parent domain itself is not flagged: it's an ordinary registered domain, owned and controlled by the service operator; only the names beneath it are given away.

Domain	free_subdomain	Why
alice.duckdns.org	true	A name handed out under the duckdns.org dynamic DNS service
duckdns.org	false	The operator's own registered domain, not a handed-out name
myapp.us.kg	true	A name handed out under a free subdomain service
github.com	false	An ordinary registered domain

free_subdomain and disposable are independent: a free subdomain is not necessarily disposable, and a domain can be both.

Error Responses

Invalid Domain Format (400)

{
  "status": 400,
  "error": "The domain is invalid"
}

Rate Limit Exceeded (429)

{
  "status": 429,
  "error": "Too many requests"
}