Email Domain Security Audit by Acinsoft

Audit the public mail configuration of one domain and collect evidence from its receiving servers. Intended for repeatable agency and mail-administration workflows.

Check DNS authentication together with actual SMTP STARTTLS, certificate validity and reverse DNS. Use the structured findings to investigate mail configuration, review a client's domain or compare scheduled audit results. No mailbox login or Acinsoft API key is required from the person running the Actor.

Quick start

Run with 128 MiB of memory and a maximum charge of at least USD 0.00755:

{
  "domain": "acinsoft.com",
  "resolver": "cloudflare",
  "dkimSelectors": ["default"]
}

Replace the domain and DKIM selectors with your own. If you do not know the selectors, omit dkimSelectors; the report marks DKIM as not evaluated. Read the Dataset row for findings and evidence, or OUTPUT for the complete result and billing receipt. A successful run can contain warnings and partial coverage: it means an audit was delivered, not that the domain passed every check.

Pricing

USD 0.0075 per delivered audit, plus 0.00005 per Actor start. One domain per run: 1,000 ordinary runs cost USD 7.55 in Actor events. This Actor has no additional subscription fee or plan-specific event prices. Free Apify plans have the trial allowance described below; continuing after that allowance requires a paid Apify plan. Apify credits and billing rules still apply.

A DNS-backed report is chargeable even when it confirms missing records or has explicit partial coverage. A rejected input or total source failure does not generate an audit event. Apify may still charge the start event. Resuming a run can add another start event; it must not add another audit charge for the same report. Set a finite maximum charge, for example USD 0.02, when using the API.

Checks

• SPF records and bounded include/redirect dependency analysis.
• DMARC policy discovery using RFC 9989; DKIM public keys for supplied selectors.
• MX hosts, SMTP greeting/EHLO/STARTTLS and actual TLS negotiation with MX SNI.
• Certificate names, trust-chain observations, validity dates, fingerprint, negotiated protocol and cipher. Certificate revocation is not checked.
• IPv4/IPv6 PTR and forward-confirmed reverse DNS.
• MTA-STS announcement, strictly verified HTTPS policy and MX coverage; TLS-RPT syntax.

No messages, credentials or recipient probes are sent. This is not mailbox verification, inbox-placement testing, message-level SPF/DKIM/DMARC validation, a full cipher scan or a security certification. DANE/DNSSEC is not evaluated. Unavailable sources and incomplete coverage are explicit; timeout alone does not prove the remote server is misconfigured. Monitoring-only DMARC can be intentional.

Input and output

Supply domain, an optional resolver (cloudflare or google), optional dkimSelectors and optional public outboundIps. Without selectors, DKIM is not evaluated. Outbound IPs are caller assertions, not discovered sending identities.

One run produces one Dataset row with findings and full evidence, plus OUTPUT in the default key-value store. Every result carries a Platform execution ID and SHA-256. Store secrets only in operator-controlled Actor environment variables.

The audit covers at most five MX hosts, two addresses per IP family per MX, eight DKIM selectors, eight outbound IPs and 128 DNS requests. Provider work has a 90-second deadline; admission and durable result storage can add time. DNS uses one configured recursive resolver over TCP, not authenticated DNSSEC.

Reliability and limits

The Actor uses limited Apify permissions and returns one result per run. DNS and SMTP checks are performed by Acinsoft's backend. Domain names, supplied selectors and public outbound IPs are sent to that backend to perform the audit.

Paid Apify users can request up to 1,000,000 audits per month, at 10 requests per minute per consumer. Launch capacity is one audit at a time and 1,000,000 audits per month across the service; shared safety limits also apply. Busy or rate-limited requests are rejected, so schedule calls and retry later.

Free Apify users receive 10 useful trial reports per user, for life. All free users also share 50 useful reports in a rolling seven-day window, separate from paid users. A full shared trial budget does not consume your remaining individual allowance. Changing runs or API credentials does not reset the trial. After your ten reports, use a paid Apify plan to continue. An exhausted trial returns a clear status message and OUTPUT without a Dataset report or an audit event; the Actor start may still be charged. These are usage allowances, not a promise that Apify will waive its own charges.

Signed checkpoints preserve result and delivery/charge uncertainty on resurrection. Do not reset INPUT, CHECKPOINT, OUTPUT or Dataset to force another execution. An ambiguous execution/delivery stops instead of blindly repeating it; operator reconciliation may be needed. Cross-build receipt recovery requires the existing explicit recovery permission. The wrapper contains no mail-analysis engine.

Current availability

Available on Apify Store. Delivery and pay-per-event receipts have been verified with an independent test consumer. An event recorded during testing is not evidence of paid revenue or settlement to the developer.