XGM API

The checks behind the XGM tools as a free, read-only HTTP API: JSON for scripts, plain text for the terminal, and an MCP server for AI assistants. No key and no sign-up.

Quick start

curl gets a readable text report; ask for JSON with an Accept header or ?format=json.

curl https://xgm.ro/api/v1/email-security/example.com

curl -H 'Accept: application/json' https://xgm.ro/api/v1/dns/example.com

The full schema is at /api/v1/openapi.json (OpenAPI 3.1): import it into Postman, Insomnia or a client generator.

Endpoints

All endpoints are GET. Only public domains and IP addresses are accepted: private, internal and reserved targets return 400.

Endpoint	Returns	Rate limit	MCP tool
`/api/v1/email-security/{domain}` Try example.com	SPF (include tree, DNS lookup count against the limit of 10), DMARC (policy, pct, report addresses and their authorisation), DKIM (24 built-in selectors plus ?selector=, with key type, size and flags), MTA-STS (the policy file fetched and parsed), TLS-RPT and BIMI (the mark certificate read). Findings and DNS fixes cover SPF and DMARC. Email Security tool	20/min	`dmarc_check, spf_check`
`/api/v1/dns/{domain}` Try example.com	A, AAAA, MX, NS, TXT and CNAME records, and which lookups failed. DNS Lookup tool	30/min	`dns_lookup`
`/api/v1/ssl/{domain}` Try example.com	The full scan: grade A+ to F with the reasons, certificate (issuer, subject, SAN, expiry, serial, SHA-256 fingerprint), key and signature algorithm, one handshake per TLS version, four weak cipher families, OCSP stapling, HSTS and preload status. TLS Checker tool	12/min	`ssl_check`
`/api/v1/http-headers/{domain}` Try example.com	Response headers of https://<domain> and which security headers are present. HTTP Headers tool	20/min	`http_headers_check`
`/api/v1/redirect/{domain}` Try example.com	All four entry URLs (http and https, with and without www) traced in parallel: every hop with its status, Location, kind (3xx or meta refresh), timing and SEO headers, loop and hop-limit detection, and the canonical destination the variants agree on. Redirect Checker tool	20/min	`redirect_check`
`/api/v1/whois/{domain}` Try example.com	Registrar, dates, status, name servers and abuse contact from the registry (RDAP first, WHOIS fallback). WHOIS Lookup tool	20/min	`whois_lookup`
`/api/v1/blacklist/{target}` Try 127.0.0.2	An IPv4 address on 58 DNS blocklists, or a domain with its A and MX addresses plus 19 domain lists; refusals are reported separately. Blacklist Checker tool	20/min	`blacklist_check`
`/api/v1/ip/{ip}` Try 8.8.8.8	Reverse DNS, scope, network (ASN) and approximate location (ipwho.is via the XGM server). IP Intelligence tool	30/min	`ip_lookup`
`/api/v1/ping/{host}` Try github.com	Ten ICMP echo requests from the XGM server: packet loss, min/avg/max round trip, jitter and the raw output. One probe location; falls back to TCP 443/80 where ICMP is unavailable. Ping & Traceroute tool	12/min	`–`
`/api/v1/port-check/{host}` Try scanme.nmap.org	TCP connect to each port of a public host: open, closed or filtered, the latency and the banner. ?ports=80,443,8000-8005 (default 80,443,8080,8443; at most 200). Port Scanner tool	12/min	`–`

Renamed endpoints

When the XGM tools were consolidated, three endpoints got new names. The old ones keep working for one more API version and answer with a Deprecation: true header and a Link header pointing to the new endpoint.

Old endpoint	Use instead	Difference
`/api/v1/dmarc/{domain}`	`/api/v1/email-security/{domain}`	The DMARC part of the email security check.
`/api/v1/spf/{domain}`	`/api/v1/email-security/{domain}`	The SPF part of the email security check.
`/api/v1/redirects/{domain}`	`/api/v1/redirect/{domain}`	Same response as /redirect.

Responses and errors

Email Security returns the same SPF and DMARC findings as the website: severity is critical, warning, info or passed, sorted most severe first, and many findings carry a copyable fix. The other endpoints return structured data.

{
  "api_version": "1",
  "tool": "email-security",
  "target": "example.com",
  "checked_at": "2026-09-15T08:00:00+00:00",
  "web_url": "https://xgm.ro/tools/email-security?d=example.com",
  "verdict": "SPF: SPF is valid; DMARC: Monitoring only (p=none)",
  "tone": "warning",
  "findings": [
    {
      "id": "dmarc-p-none",
      "severity": "warning",
      "title": "DMARC: Policy is p=none (monitoring only)",
      "explanation": "Receivers deliver mail that fails DMARC as usual. …",
      "fix": { "label": "Next step: quarantine", "code": "_dmarc.example.com. IN TXT \"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com\"" },
      "learn_more": { "href": "/guides/email-security", "label": "Read the Email Security guide" }
    }
  ],
  "spf": { "verdict": "SPF is valid", "record": "v=spf1 include:_spf.example.net -all", "lookups": 3, "…": "…" },
  "dmarc": { "verdict": "Monitoring only (p=none)", "policy": "none", "record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com", "…": "…" }
}

Error codes

400	Invalid input or a refused target (private address, internal name, IP where a domain is expected).
422	Invalid query parameter, for example `format=xml`.
429	Rate limit reached. Wait the number of seconds in the `Retry-After` header.
502	The upstream check failed (for example the WHOIS server did not answer).

Rate limits and fair use

Each client can make 30 API requests per minute. A check also pays the limit its own tool has on the website: 20 per minute for header, redirect, WHOIS, blocklist and email checks, and 12 per minute for the network ones, the TLS scan among them. The table above lists the binding limit per endpoint. The API is meant for occasional scripted checks and monitoring of your own domains, not for bulk scanning. Results are not cached: every request runs a fresh check.

Privacy

API requests are handled like tool checks on the website: the target is used to run the check and is not saved with a result. Like every request, it can appear in short-lived server logs, and your address is held in memory for rate limiting. See the privacy policy.

MCP server for AI assistants

The XGM MCP server lets Claude and other MCP clients run these checks as tools (dmarc_check, spf_check, dns_lookup and six more). It is a single Python file with no dependencies that calls this API, so the same limits and target checks apply.

Download xgm_mcp.py (Python 3.9 or newer).
Add it to Claude Code:

claude mcp add xgm -- python3 /path/to/xgm_mcp.py

For other clients, use this stdio configuration:

{
  "mcpServers": {
    "xgm": { "command": "python3", "args": ["/path/to/xgm_mcp.py"] }
  }
}

Then ask, for example: “Check the DMARC and SPF setup of example.com and tell me what to fix.”