# Check Domain Authentication

> Run a fresh SPF, DKIM and DMARC check for an account's sending domain.

Requires an API key with the `write` scope.

FoxReach looks up the sending domain's DNS records now, stores the result on the account and returns it. The result is informational: a failing check never blocks sending. Use `domainAuth` on [Get Email Account](/api-reference/email-accounts/get-account) to read the last stored result without a new lookup.

## Path Parameters

<ParamField path="account_id" type="string" required>The email account id.</ParamField>

## Response

<ResponseField name="data" type="object">
  <Expandable title="data">
    <ResponseField name="domainAuth" type="object">The stored result, with an entry for `spf`, `dkim` and `dmarc`.</ResponseField>
    <ResponseField name="domainAuthCheckedAt" type="string">ISO 8601 timestamp of this check.</ResponseField>
    <ResponseField name="dkimSelector" type="string">The DKIM selector used, or `null` to try the common ones.</ResponseField>
  </Expandable>
</ResponseField>

<RequestExample>
```bash cURL
curl -X POST "https://api.foxreach.io/api/v1/email-accounts/acc_abc123/domain-auth/check" \
  -H "X-API-Key: otr_your_key"
```

```python Python SDK
from foxreach import FoxReach

client = FoxReach(api_key="otr_your_key")
result = client.email_accounts.check_domain_auth("acc_abc123")
```

```typescript TypeScript SDK
import { FoxReach } from "foxreach";

const client = new FoxReach({ apiKey: "otr_your_key" });
const result = await client.emailAccounts.checkDomainAuth("acc_abc123");
```
</RequestExample>

<ResponseExample>
```json
{
  "data": {
    "domainAuth": {"spf": {"status": "pass"}, "dkim": {"status": "pass"}, "dmarc": {"status": "fail"}},
    "domainAuthCheckedAt": "2026-11-04T10:00:00",
    "dkimSelector": null
  }
}
```
</ResponseExample>

## Errors

| Status | Description |
|--------|-------------|
| `401` | Missing, invalid, revoked or expired API key |
| `403` | API key does not have the required scope: `write` |
| `404` | `Email account not found`: the account does not exist in this workspace |

## Rate Limit

- **100 requests per minute, shared by every `expensive` call in your workspace.** Fixed 60-second window.
- Every response includes `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` (unix epoch seconds) and `X-RateLimit-Bucket` (`expensive`).
- A `429` response includes a `Retry-After` header (seconds until the bucket resets).

For client-side patterns, see [Rate Limiting](/rate-limiting).