Partner Embed Integration: Add Email Health Checks to Your Product

What the Email Health Widget Shows

The mxio.io email health widget runs four authentication checks in parallel and displays the results in a self-contained panel:

• MX Records — are mail servers configured and reachable?
• SPF — is the Sender Policy Framework record valid, within lookup limits, and properly structured?
• DKIM — are DomainKeys Identified Mail signatures in place for common selectors?
• DMARC — is there a DMARC policy, and does it align with SPF and DKIM?

Each check shows a pass/warn/fail status with a brief explanation. The overall status summarizes whether the domain's email authentication is healthy.

Why Partners Embed It

Reduce support burden

Email deliverability problems generate support tickets. When your customers can check their own email health in your product, they self-diagnose before contacting you. One less ticket, one less back-and-forth.

Differentiate your product

Most hosting panels, email security platforms, and IT management tools don't show email authentication status. Adding health checks signals that you understand what your customers care about.

White-label ready

Two themes (dark and light) and two layout modes (summary and compact) fit any product design without custom CSS. The widget is fully self-contained — inline styles, no external dependencies.

How It Works

Iframe embed (simplest)

Drop a single <iframe> tag into your HTML:

<iframe
  src="https://tools.mxio.io/embed/health?domain=example.com&token=YOUR_TOKEN&selectors=google,selector1&mode=summary&theme=dark"
  width="100%"
  height="320"
  style="border:none"
  title="Email Health Check"
></iframe>

The widget is fully self-contained — all styles are inline, no external CSS or JavaScript required. It works in any HTML context: dashboards, documentation pages, control panels, emails (as a linked preview).

JSON API (for custom UIs)

If you need raw data to render your own UI:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://tools.mxio.io/api/tools/embed/health?domain=example.com"

The response includes overall_status, individual check results, and a report_url linking to the full report on mxio.io.

Attribution required: When using the JSON API to build a custom UI, you must display "Powered by mxio.io" with a link to mxio.io. The iframe embed includes attribution automatically.

DKIM selectors

By default, the widget shows DKIM as a warning because it has no way to know which selectors your customers use. If you know the selectors (e.g. MailRoute uses mr01, mr02, mr03; Google Workspace uses google), pass them in the selectors parameter:

&selectors=mr01,mr02,google

Up to 5 selectors can be checked per request. By default, if any selector passes, DKIM shows as green — a sensible rule when the selectors are a guess, since a domain should not be marked failing because one guessed selector does not exist.

Requiring your own records

If your product is the mail path, "some valid SPF exists" is not the question you need answered — you need to know whether the customer's domain is configured for you. Two optional per-partner requirements change the widget from a generic health check into a setup check:

• Required SPF include — the widget marks SPF failing unless the customer's record actually authorizes your host (e.g. spf.mailroute.net).
• Required DKIM selectors — every listed selector must carry a usable key, not just one of them.

These are set on your partner record, not in the embed URL, so a white-label page cannot accidentally drop them, and changing them does not mean re-editing every page that carries the snippet. Ask us to configure them.

Three details worth knowing, because they are where a naive check gets the answer wrong:

• The include has to be reachable. v=spf1 include:_spf.google.com ~all include:spf.example.net does not authorize you — SPF evaluation stops at all, so the trailing include never runs. The widget reads it as missing, because receivers do too.
• The qualifier has to be a pass. ~include: yields SoftFail and ?include: yields Neutral. Neither is an SPF Pass, so neither satisfies a requirement.
• Nested includes count. If the customer reaches your host through a reseller's include, the widget resolves the whole chain and passes — and tells them which include it came through, because an indirect path costs against the 10-lookup limit.

When a requirement is not met, the widget says so specifically ("SPF is valid, but MailRoute isn't authorized — add include:spf.mailroute.net") rather than calling the record broken, because it usually isn't. The JSON response carries a requirement_code on the affected check so a server-side integration can branch on the reason without parsing the sentence.

If a lookup fails, the widget reports that it could not confirm the requirement — it never reads a DNS failure as a missing record.

Modes and themes

• Summary mode (default): shows all four checks with status badges and details
• Compact mode: condensed single-row layout for tight spaces
• Dark theme (default): zinc-900 background, designed for dark UIs
• Light theme: white background with subtle borders

Rate Limits

New partner tokens work immediately at the starter rate. After admin review, limits are upgraded to the full partner tier.

Getting Started

1. Visit the embed integration page for a live preview, copy-paste snippets, and instant token registration
2. Register for a partner token — it works immediately at 30 requests/min, upgraded to 60/min after admin review
3. Drop the iframe into your product and start embedding

No token is required for basic usage — anonymous embeds work immediately at 10 requests/minute. Partner tokens unlock higher limits and attribution tracking.