---
title: "Query an email"
method: GET
path: "/{email}"
tags: ["Query email address"]
---

# Query an email

`GET /{email}`

## Request

- Base URL: `https://emailrep.io`
- URL: `https://emailrep.io/{email}`
- Auth: none declared

## Path parameters

- `email` string, required

## Query parameters

- `summary` boolean

## Response `200`

Query successful

- QueryResponse
  - `email` string: email address queried
  - `reputation` string: high/medium/low/none
  - `suspicious` boolean: whether the email address should be treated as suspicious or risky
  - `references` integer: total number of positive and negative sources of reputation. note that these may not all be direct references to the email address, but can include reputation sources for the domain or other related information
  - `details` QueryResponseDetails
    - `blacklisted` boolean: the email is believed to be malicious or spammy
    - `malicious_activity` boolean: the email has exhibited malicious behavior (e.g. phishing or fraud)
    - `malicious_activity_recent` boolean: malicious behavior in the last 90 days (e.g. in the case of temporal account takeovers)
    - `credentials_leaked` boolean: credentials were leaked at some point in time (e.g. a data breach, pastebin, dark web, etc.)
    - `credentials_leaked_recent` boolean: credentials were leaked in the last 90 days
    - `data_breach` boolean: the email was in a data breach at some point in time
    - `first_seen` string: the first date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior ('never' if never seen)
    - `last_seen` string: the last date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior ('never' if never seen)
    - `domain_exists` boolean: valid domain
    - `domain_reputation` string: high/medium/low/n/a (n/a if the domain is a free_provider, disposable, or doesn't exist)
    - `new_domain` boolean: the domain was created within the last year
    - `days_since_domain_creation` integer: days since the domain was created
    - `suspicious_tld` boolean: suspicious tld
    - `spam` boolean: the email has exhibited spammy behavior (e.g. spam traps, login form abuse)
    - `free_provider` boolean: the email uses a free email provider
    - `disposable` boolean: the email uses a temporary/disposable service
    - `deliverable` boolean: deliverable
    - `accept_all` boolean: whether the mail server has a default accept all policy. some mail servers return inconsistent responses, so we may default to an accept_all for those to be safe
    - `valid_mx` boolean: has an MX record
    - `spoofable` boolean: email address can be spoofed (e.g. not a strict SPF policy or DMARC is not enforced)
    - `spf_strict` boolean: sufficiently strict SPF record to prevent spoofing
    - `dmarc_enforced` boolean: DMARC is configured correctly and enforced
    - `profiles` string[]: online profiles used by the email

## Other responses

- `400`: Invalid email
- `401`: Invalid api key (for authenticated requests)
- `429`: Too many requests. Contact us for an api key

---

[API](https://skmtc.dev/sublime/apis/emailrep-alpha-api.md) - [All operations](https://skmtc.dev/sublime/apis/emailrep-alpha-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sublime/apis/emailrep-alpha-api/revisions/a590cde4e5fe?raw)