Tools

Reads the domain's DMARC record from public DNS, or the record of the organisational domain it inherits from, and says how strict it is and what is wrong with it. stage is missing, invalid, monitor for p=none, quarantine or reject.

Needs no scope: any key or access token for the workspace may run it.

Reads the domain's BIMI record, fetches the logo it names and checks the DMARC policy beside it, since inboxes draw a logo only at p=quarantine or p=reject. status is present, partial when the record is there but something stops inboxes showing it, absent or invalid, and issues says why.

Needs no scope: any key or access token for the workspace may run it.

Checks the records a receiving mailbox reads before it trusts mail from the domain: MX, SPF, DKIM at the selectors its mail provider uses, DMARC and BIMI. Each check says pass, warn, fail or absent with a verdict and notes written to be shown to a person, and score weighs them into 0 to 100, graded A to F.

Needs no scope: any key or access token for the workspace may run it.

Finds the sign-in or verification code in a message you pass in, with the reader that puts a code at the top of a message in Nextmail. Send the message as raw (the whole MIME source) or as subject with html or text.

It answers only when it is sure. The message has to hold exactly one code worded as one, such as a verification code, a one-time code or a security code, in any of the common languages. Two different codes, or a number that could be an order, a booking, a meeting, a phone number or a promotion, give code: null. The code comes back as you would type it: digits only, or capital letters and digits, without spaces or dashes.

It reads only what you send, so it cannot tell whether the sender is who it claims to be. The verificationCode on a message in your mailbox also requires the sender to pass authentication. Nothing is stored, and no model is called.

Needs no scope: any key or access token for the workspace may run it.

Says whether an address is worth sending to: valid, risky, invalid or unknown, with the reasons. It checks the syntax, whether the domain takes mail at all, whether it is a throwaway domain or a role address such as info@, and offers a correction for a likely typo such as gmial.com. With the emails:read scope it also says what this workspace knows: whether it suppressed the address and when it last delivered to it or saw it bounce. It never shows another workspace's history.

deep also asks whether the mailbox exists. A deep check is billed per address through pay as you go, $1.50 per 100 addresses on every plan, needs the emails:send scope, and is refused when pay as you go is off. Without it the check is free and checks.mailbox is null.

Needs no scope: any key or access token for the workspace may run it.

Checks up to 100 addresses in one call, each as GET /tools/address does, and returns them in the order they were sent. deep applies to every address and is billed for each one that reaches the mailbox check.

Needs no scope: any key or access token for the workspace may run it.

Prices every plan for the usage you describe, as the cost calculator on the Nextmail website does: the plan itself, the extra sends and AI actions it would bill, the monthly total, and whether the plan fits at all. A plan does not fit when the usage needs more domains than it includes, more than one person without team access, or more sends than it allows without billing extra. cheapest names the cheapest plan that fits.

Amounts are in US cents per month. With interval set to year, the plan price is the monthly equivalent of paying yearly.

Needs no scope: any key or access token for the workspace may run it.