# Email Diagnostics by Acinsoft (`acinsoft/acinsoft-email-domain-security-audit`) Actor

Diagnose email domain configuration and receiving-server connectivity: SPF, DKIM selectors, DMARC, MX, SMTP STARTTLS, TLS certificates, PTR, MTA-STS and TLS-RPT. Export findings with evidence and coverage limits. Public configuration and transport checks; no mailbox access.

- **URL**: https://apify.com/acinsoft/acinsoft-email-domain-security-audit.md
- **Developed by:** [Acinsoft Services](https://apify.com/acinsoft) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 93.8% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.0075 / email domain audit

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Email Domain Security Audit by Acinsoft

Audit the public mail configuration of one domain and collect evidence from its
receiving servers. Intended for repeatable agency and mail-administration workflows.

Check DNS authentication together with actual SMTP STARTTLS, certificate validity
and reverse DNS. Use the structured findings to investigate mail configuration,
review a client's domain or compare scheduled audit results. No mailbox login or
Acinsoft API key is required from the person running the Actor.

### Quick start

Run with 128 MiB of memory and a maximum charge of at least USD 0.00755:

```json
{
  "domain": "acinsoft.com",
  "resolver": "cloudflare",
  "dkimSelectors": ["default"]
}
```

Replace the domain and DKIM selectors with your own. If you do not know the
selectors, omit `dkimSelectors`; the report marks DKIM as not evaluated.
Read the Dataset row for findings and evidence, or `OUTPUT` for the complete
result and billing receipt. A successful run can contain warnings and partial
coverage: it means an audit was delivered, not that the domain passed every check.

### Pricing

USD **0.0075 per delivered audit**, plus **0.00005 per Actor start**. One domain
per run: 1,000 ordinary runs cost USD **7.55** in Actor events. This Actor has
no additional subscription fee or plan-specific event prices. Free Apify plans
have the trial allowance described below; continuing after that allowance
requires a paid Apify plan. Apify credits and billing rules still apply.

A DNS-backed report is chargeable even when it confirms missing records or has
explicit partial coverage. A rejected input or total source failure does not
generate an audit event. Apify may still charge the start event. Resuming a run
can add another start event; it must not add another audit charge for the same
report. Set a finite maximum charge, for example USD 0.02, when using the API.

### Checks

- SPF records and bounded include/redirect dependency analysis.
- DMARC policy discovery using RFC 9989; DKIM public keys for supplied selectors.
- MX hosts, SMTP greeting/EHLO/STARTTLS and actual TLS negotiation with MX SNI.
- Certificate names, trust-chain observations, validity dates, fingerprint,
  negotiated protocol and cipher. Certificate revocation is not checked.
- IPv4/IPv6 PTR and forward-confirmed reverse DNS.
- MTA-STS announcement, strictly verified HTTPS policy and MX coverage; TLS-RPT syntax.

No messages, credentials or recipient probes are sent. This is not mailbox
verification, inbox-placement testing, message-level SPF/DKIM/DMARC validation,
a full cipher scan or a security certification. DANE/DNSSEC is not evaluated.
Unavailable sources and incomplete coverage are explicit; timeout alone does not
prove the remote server is misconfigured. Monitoring-only DMARC can be intentional.

### Input and output

Supply `domain`, an optional `resolver` (`cloudflare` or `google`), optional
`dkimSelectors` and optional public `outboundIps`. Without selectors, DKIM is not
evaluated. Outbound IPs are caller assertions, not discovered sending identities.

One run produces one Dataset row with findings and full evidence, plus `OUTPUT`
in the default key-value store. Every result carries a Platform execution ID and
SHA-256. Store secrets only in operator-controlled Actor environment variables.

The audit covers at most five MX hosts, two addresses per IP family per MX,
eight DKIM selectors, eight outbound IPs and 128 DNS requests. Provider work has
a 90-second deadline; admission and durable result storage can add time. DNS
uses one configured recursive resolver over TCP, not authenticated DNSSEC.

### Reliability and limits

The Actor uses limited Apify permissions and returns one result per run. DNS and
SMTP checks are performed by Acinsoft's backend. Domain names, supplied selectors
and public outbound IPs are sent to that backend to perform the audit.

Paid Apify users can request up to **1,000,000 audits per month**, at **10 requests
per minute per consumer**. Launch capacity is one audit at a time and 1,000,000
audits per month across the service; shared safety limits also apply. Busy or
rate-limited requests are rejected, so schedule calls and retry later.

Free Apify users receive **10 useful trial reports per user, for life**. All free
users also share **50 useful reports in a rolling seven-day window**, separate
from paid users. A full shared trial budget does not consume your remaining
individual allowance. Changing runs or API credentials does not reset the trial.
After your ten reports, use a paid Apify plan to continue. An exhausted trial
returns a clear status message and OUTPUT without a Dataset report or an audit
event; the Actor start may still be charged. These are usage allowances, not a
promise that Apify will waive its own charges.

Signed checkpoints preserve result and delivery/charge uncertainty on resurrection.
Do not reset INPUT, CHECKPOINT, OUTPUT or Dataset to force another execution.
An ambiguous execution/delivery stops instead of blindly repeating it; operator
reconciliation may be needed. Cross-build receipt recovery requires the existing
explicit recovery permission. The wrapper contains no mail-analysis engine.

### Current availability

Available on Apify Store. Delivery and pay-per-event receipts have been verified
with an independent test consumer. An event recorded during testing is not
evidence of paid revenue or settlement to the developer.

# Actor input Schema

## `domain` (type: `string`):

Public DNS domain, without a URL, port or email address.

## `resolver` (type: `string`):

Public recursive resolver used for the audit's DNS observations.

## `dkimSelectors` (type: `array`):

Up to eight selectors supplied by your mail provider. No guessing or mailbox verification.

## `outboundIps` (type: `array`):

Up to eight public sending IPs for reverse DNS checks. MX hosts do not identify outbound senders.

## `requestId` (type: `string`):

Optional UUID for this audit. Use a new value for a new audit; reuse is not permission to charge twice.

## Actor input object example

```json
{
  "resolver": "cloudflare"
}
```

# Actor output Schema

## `result` (type: `string`):

DNS configuration, inbound SMTP/TLS and reverse DNS evidence, with coverage limitations and a delivery receipt. A recorded event is not payment settlement.

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("acinsoft/acinsoft-email-domain-security-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("acinsoft/acinsoft-email-domain-security-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call acinsoft/acinsoft-email-domain-security-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,acinsoft/acinsoft-email-domain-security-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/cetovqY2SkuMVWFE0/builds/TtvgsPlebpgJo5GwH/openapi.json