We graded 255 ASX 200 domains on email security. Only 29.4% are fully protected. [Read the Report]

Rate Limiting

API throttles, request limits, and backoff strategies

4 min read API Reference

Rate Limiting

API rate limiting prevents abuse and ensures fair usage across all accounts.

Default Limits

General API Endpoints

60 requests per minute per API token

Webhook Processing

1000 webhooks per hour

DNS Operations

10 DNS writes per minute (SPF updates, DNS provider writes)

Public Endpoints

100 requests per minute per IP

Rate Limit Headers

Every API response includes rate limit information:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1691350320

Handling Rate Limits

When you hit a rate limit, the API returns 429 Too Many Requests:

{
  "error": "Rate limit exceeded",
  "retry_after": 30
}

Implementation tips:

  • Check X-RateLimit-Remaining before making requests
  • Implement exponential backoff on 429 responses
  • Batch operations where possible
  • Contact support for higher limits if needed

Error Handling

Understanding API error responses and how to troubleshoot issues.

HTTP Status Codes

200 OK

Request succeeded

201 Created

Resource created successfully

400 Bad Request

Invalid request parameters or body

401 Unauthorized

Missing or invalid authentication

403 Forbidden

Authenticated but not authorized (e.g., domain not in your account)

404 Not Found

Resource doesn't exist

429 Too Many Requests

Rate limit exceeded (see Retry-After header)

500 Server Error

Internal server error — retry with backoff

Error Response Format

{
  "message": "Validation failed",
  "errors": {
    "domain_name": ["Domain name is required"],
    "automation_level": ["Invalid automation level"]
  }
}

Common Error Scenarios

Invalid Token

Solution: Generate a new token in Settings → API Access. Expired tokens must be recreated.

Domain Not Found

Solution: Use the exact domain name. API only returns domains in your account (no enumeration).

SPF Lookup Limit Exceeded

Solution: Consolidate SPF sources. Use the SPF Flattener tool to reduce nested includes.

DNS Provider Authentication Failed

Solution: Re-authenticate in Settings. Verify API tokens are still valid on the DNS provider.