Free checks (no API key)

Score a phishing email an agent has already parsed

Keyless and free. The same scoring model as checkemail@relayshield.net, for a caller that has already parsed a message -- an agent reading a mailbox through the Gmail or Graph API -- rather than a raw RFC822 blob. Scores SPF/DKIM/DMARC, brand impersonation in the display name, ask-plus-pressure phrasing, links to public file-hosting services, and attachment names by extension. Links are checked through the same keyless path as /v1/link-check, never /v1/scan-url, so this endpoint has no per-call vendor cost.

This does not parse raw email. Extract from_address, from_name, subject, body_text, links and attachment_names yourself before calling.

Billing. Free. This endpoint is not metered.

Note. No API key required. checkemail@relayshield.net runs the same model over raw forwarded mail; this is a second door for a caller that has already parsed one.

post/v1/email-check

Request

  • Base URL: https://api.relayshield.net
  • URL: https://api.relayshield.net/v1/email-check
  • Auth: none required

Request body

from_addressstring

The claimed sender's address.

from_namestring

The claimed sender's display name.

reply_tostring

Reply-To address, if present and different from from_address.

return_pathstring

Envelope sender, if available. Informational only.

subjectstring

Message subject.

body_textstring

Plain-text body, used for ask/deadline/threat phrasing.

linksstring[]

Links found in the body, up to 25.

attachment_namesstring[]

Attachment filenames, checked by extension only. Nothing is opened, decoded or stored.

authentication_resultsstring

Raw Authentication-Results header text. Parsed only when auth_results is absent.

forwardedboolean

True when this is an inline forward. Forwarding strips the original SPF/DKIM/DMARC and re-signs the message as the forwarder's own provider, so auth signals are not scored when this is true -- they would describe the forwarder, not the message being asked about.

sourcestring

Optional integration identifier.

Example request

{
  "from_address": "alert@phrase.com",
  "from_name": "ApplyAML Meta Mask Details",
  "source": "muse"
}

Response

Success. ok is true and data holds the result.

oktrue required

Changes

No recorded changes to this operation across all 1 revision of this API.