XGM API

The checks behind the XGM tools as a free, read-only HTTP API: JSON for scripts, plain text for the terminal, and an MCP server for AI assistants. No key and no sign-up.

Quick start

curl gets a readable text report; ask for JSON with an Accept header or ?format=json.

curl https://xgm.ro/api/v1/email-security/example.com

curl -H 'Accept: application/json' https://xgm.ro/api/v1/dns/example.com

The full schema is at /api/v1/openapi.json (OpenAPI 3.1): import it into Postman, Insomnia or a client generator.

Endpoints

All endpoints are GET. Only public domains and IP addresses are accepted: private, internal and reserved targets return 400.

Endpoint	Returns	Rate limit	MCP tool
`/api/v1/email-security/{domain}` Try example.com	SPF (include tree, DNS lookup count against the limit of 10) and DMARC (policy, pct, report addresses and their authorisation) with findings and DNS fixes. Email Security tool	30/min	`dmarc_check, spf_check`
`/api/v1/dns/{domain}` Try example.com	A, AAAA, MX, NS, TXT and CNAME records, and which lookups failed. DNS Lookup tool	30/min	`dns_lookup`
`/api/v1/ssl/{domain}` Try example.com	Issuer, subject, expiry, days remaining, protocol and cipher on port 443. TLS Checker tool	20/min	`ssl_check`
`/api/v1/http-headers/{domain}` Try example.com	Response headers of https://<domain> and which security headers are present. HTTP Headers tool	20/min	`http_headers_check`
`/api/v1/redirect/{domain}` Try example.com	Every hop from http://<domain> to the final URL. Redirect Checker tool	20/min	`redirect_check`
`/api/v1/whois/{domain}` Try example.com	Registrar, dates, status, name servers and abuse contact from the registry (RDAP first, WHOIS fallback). WHOIS Lookup tool	20/min	`whois_lookup`
`/api/v1/blacklist/{target}` Try 127.0.0.2	An IPv4 address on 48 DNS blocklists, or a domain with its A and MX addresses plus 12 domain lists; refusals are reported separately. Blacklist Checker tool	20/min	`blacklist_check`
`/api/v1/ip/{ip}` Try 8.8.8.8	Reverse DNS, scope, network (ASN) and approximate location (ipwho.is via the XGM server). IP Intelligence tool	30/min	`ip_lookup`

Renamed endpoints

When the XGM tools were consolidated, three endpoints got new names. The old ones keep working for one more API version and answer with a Deprecation: true header and a Link header pointing to the new endpoint.

Old endpoint	Use instead	Difference
`/api/v1/dmarc/{domain}`	`/api/v1/email-security/{domain}`	The DMARC part of the email security check.
`/api/v1/spf/{domain}`	`/api/v1/email-security/{domain}`	The SPF part of the email security check.
`/api/v1/redirects/{domain}`	`/api/v1/redirect/{domain}`	Same response as /redirect.

Responses and errors

Email Security returns the same SPF and DMARC findings as the website: severity is critical, warning, info or passed, sorted most severe first, and many findings carry a copyable fix. The other endpoints return structured data.

{
  "api_version": "1",
  "tool": "email-security",
  "target": "example.com",
  "checked_at": "2026-09-15T08:00:00+00:00",
  "web_url": "https://xgm.ro/tools/email-security?d=example.com",
  "verdict": "SPF: SPF is valid; DMARC: Monitoring only (p=none)",
  "tone": "warning",
  "findings": [
    {
      "id": "dmarc-p-none",
      "severity": "warning",
      "title": "DMARC: Policy is p=none (monitoring only)",
      "explanation": "Receivers deliver mail that fails DMARC as usual. …",
      "fix": { "label": "Next step: quarantine", "code": "_dmarc.example.com. IN TXT \"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com\"" },
      "learn_more": { "href": "/guides/email-security", "label": "Read the Email Security guide" }
    }
  ],
  "spf": { "verdict": "SPF is valid", "record": "v=spf1 include:_spf.example.net -all", "lookups": 3, "…": "…" },
  "dmarc": { "verdict": "Monitoring only (p=none)", "policy": "none", "record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com", "…": "…" }
}

Error codes

400	Invalid input or a refused target (private address, internal name, IP where a domain is expected).
422	Invalid query parameter, for example `format=xml`.
429	Rate limit reached. Wait the number of seconds in the `Retry-After` header.
502	The upstream check failed (for example the WHOIS server did not answer).

Rate limits and fair use

Each client can make 30 API requests per minute. TLS, header, redirect, WHOIS and blocklist checks also count against the 20 per minute limit those tools have on the website. The API is meant for occasional scripted checks and monitoring of your own domains, not for bulk scanning. Results are not cached: every request runs a fresh check.

Privacy

API requests are handled like tool checks on the website: the target is used to run the check and is not saved with a result. Like every request, it can appear in short-lived server logs, and your address is held in memory for rate limiting. See the privacy policy.

MCP server for AI assistants

The XGM MCP server lets Claude and other MCP clients run these checks as tools (dmarc_check, spf_check, dns_lookup and six more). It is a single Python file with no dependencies that calls this API, so the same limits and target checks apply.

Download xgm_mcp.py (Python 3.9 or newer).
Add it to Claude Code:

claude mcp add xgm -- python3 /path/to/xgm_mcp.py

For other clients, use this stdio configuration:

{
  "mcpServers": {
    "xgm": { "command": "python3", "args": ["/path/to/xgm_mcp.py"] }
  }
}

Then ask, for example: “Check the DMARC and SPF setup of example.com and tell me what to fix.”