DNS and domain checks

GET  /accounts/{id}/dns
POST /accounts/{id}/dns

GET returns the last 10 DNS checks for the account, newest first, plus latest as a convenience (the first item of history, or null). POST re-runs the check now and returns { "result": { … } }, or 400 with the error text if the check could not run.

{
  "latest": {
    "id": "b1e7c2a4-0c3e-4c0a-9a6f-2b7d8e5f1a33",
    "accountId": "3a6f9e2e-4b7a-4e9a-9b1d-6e3a2f8c1a10",
    "domain": "yourdomain.com",
    "checkedAt": "2026-09-11T08:14:00.000Z",
    "spfStatus": "pass",
    "spfRecord": "v=spf1 include:_spf.google.com ~all",
    "dkimStatus": "none",
    "dkimSelector": null,
    "dkimRecord": null,
    "dmarcStatus": "pass",
    "dmarcRecord": "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com",
    "mxStatus": "pass",
    "mxRecords": ["aspmx.l.google.com"],
    "findings": [],
    "overallStatus": "warn"
  },
  "history": [ { "id": "b1e7c2a4-0c3e-4c0a-9a6f-2b7d8e5f1a33", "…": "same shape as latest" } ]
}

Each record status (SPF, DKIM, DMARC and MX) is pass, none, fail or error; overallStatus is pass, warn or fail. mxStatus is null on older checks. Two things to know before you treat a result as a verdict:

• error means DNS did not answer (timeout or resolver problem), not that the record is wrong. Re-check rather than re-publishing records.
• dkimStatus: "none" can mean "present but under a selector Warmerly could not guess", the check tries a list of common selector names and cannot discover an arbitrary one. Set dkimSelector on the account (see Update an account) and re-check.

SPF, DKIM, DMARC and MX are checked here, and if the account has a tracking domain its CNAME is re-verified on the same run. Everything each record does, and the order to publish them in, is in the DNS records checklist.