# SPF, DKIM & DMARC Checker - Bulk Email Deliverability Audit (`admirala/email-domain-auth-checker`) Actor

Bulk SPF, DKIM and DMARC checker: SPF lookup count, DMARC policy, DKIM selectors, MX, MTA-STS, TLS-RPT and BIMI with a score, grade and fix list per domain. $0.0009 per domain.

- **URL**: https://apify.com/admirala/email-domain-auth-checker.md
- **Developed by:** [Ja doei](https://apify.com/admirala) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.60 / 1,000 per domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SPF, DKIM & DMARC Checker - Bulk Email Deliverability Audit

> ✅ **Tested daily** with its default input (Apify's automated QA plus our own smoke test before every release).

**SPF, DKIM and DMARC checker** for any number of domains. Since Gmail and Yahoo started enforcing sender requirements, missing or broken SPF, DKIM and DMARC records mean mail lands in spam or bounces. This Actor audits the email authentication setup using public DNS only and tells you in plain words what to fix. **$0.0009 per domain**.

### What is checked

- **MX** records (and null MX)
- **SPF**: record present, duplicates, the final `all` qualifier, and the **recursive DNS-lookup count** across all includes (the 10-lookup limit from RFC 7208 is the most common silent failure)
- **DMARC**: policy `p`, subdomain policy `sp`, `pct`, alignment modes, and whether aggregate (`rua`) and forensic (`ruf`) reports are configured
- **DKIM**: ~30 common selectors (Google Workspace, Microsoft 365, Mailchimp/Mandrill, SendGrid, Zoho, Proton, Fastmail, Amazon SES, ...) plus any selectors you add; key type, approximate key length and revoked keys
- **MTA-STS**, **TLS-RPT** and **BIMI** records
- A **score (0–100)**, a **grade (A–F)** and an **issues** list per domain

### Use cases

- Agencies and MSPs checking client domains before a campaign or onboarding
- Deliverability audits of a list of sending domains
- Monitoring your own domains on a schedule for accidental DNS changes
- Lead qualification for email/DNS service providers (domain-level data only)

### Output example

```json
{
  "domain": "example.org", "score": 72, "grade": "C",
  "mx": ["mx1.example.org"], "spfRecord": "v=spf1 include:_spf.google.com ~all",
  "spfLookups": 4, "spfAll": "~all", "dmarcPolicy": "none", "dmarcRuaDomains": ["example.org"],
  "dkimSelectorsFound": ["google"], "mtaSts": false, "tlsRpt": false, "bimi": false,
  "issues": ["DMARC p=none (monitoring only, no protection)"]
}
```

### Input

| Field | Default | Description |
|---|---|---|
| `domains` | – | Domains, URLs or email domains (`@example.com`) |
| `dkimSelectors` | – | Your own DKIM selectors |
| `skipCommonSelectors` | false | Test only your selectors |
| `nameservers` | 1.1.1.1, 8.8.8.8 | Public resolvers used |

### Pricing (pay per event)

- **$0.0009 per domain audited.** Domains that do not exist are reported for free.

### Privacy

Only public DNS records are read. Report addresses in DMARC `rua`/`ruf` are reduced to their domain, so the output contains no email addresses. DKIM cannot be enumerated — if your provider uses a custom selector, add it in `dkimSelectors`.

### Use with AI agents (MCP)

This Actor can be used as a tool by AI agents (Claude, Cursor, VS Code, other MCP clients) through the official [Apify MCP server](https://docs.apify.com/platform/integrations/mcp):

- Add only this Actor as a tool: `https://mcp.apify.com?tools=admirala/email-domain-auth-checker` (sign in with OAuth or an Apify API token).
- Or connect `https://mcp.apify.com` and let the agent find it with `search-actors` (e.g. "dmarc checker"), read the input schema with `fetch-actor-details` and run it with `call-actor`.

Example input an agent can pass:

```json
{
  "domains": [
    "github.com",
    "wikipedia.org"
  ]
}
```

Cost per call: $0.0009 per domain audited; non-existent domains are free. Results come back as dataset items (`get-dataset-items`).

### FAQ

**How do I check a domain's SPF, DKIM and DMARC records?**
Add the domain to `domains`. You get the SPF record and lookup count, DMARC policy, DKIM selectors found, a 0-100 score, grade A-F and an `issues` list.

**Why does my SPF fail with too many DNS lookups?**
RFC 7208 allows 10 lookups. `spfLookups` counts them recursively across all includes.

**Can it find my DKIM selector?**
It probes about 30 common selectors (Google, Microsoft 365, SendGrid, Mailchimp, ...). Custom selectors cannot be enumerated; add them in `dkimSelectors`.

### Related actors

- [SSL Certificate Checker - Bulk Expiry, Chain & TLS](https://apify.com/admirala/ssl-certificate-expiry-checker)
- [Website Uptime Monitor - Status, Response Time & SSL](https://apify.com/admirala/website-uptime-ssl-monitor)
- Domain Expiry Checker - Bulk WHOIS/RDAP Expiration Dates (coming soon to Apify Store)
- [WHOIS Lookup Bulk - Domain RDAP, DNS Records & SSL](https://apify.com/admirala/domain-whois-rdap-dns-lookup)
- Security Headers Checker - Bulk HSTS, CSP Audit (A+ to F) (coming soon to Apify Store)
- [Tech Stack Detector - BuiltWith & Wappalyzer Alternative](https://apify.com/admirala/website-tech-stack-detector)
- Broken Link Checker - Find 404s & Redirects (Crawl or List) (coming soon to Apify Store)

# Actor input Schema

## `domains` (type: `array`):

Domains to audit; URLs and email addresses or '@example.com' are reduced to the domain. Example: \["github.com", "wikipedia.org"]. $0.0009 per domain.

## `dkimSelectors` (type: `array`):

Optional extra DKIM selectors to test besides ~30 common ones, e.g. \["s2048", "mail"]. Find yours in the DKIM-Signature header (s=) of a sent email.

## `skipCommonSelectors` (type: `boolean`):

true = test only the selectors in `dkimSelectors`, not the built-in common list.

## `nameservers` (type: `array`):

Public DNS resolver IPs used for lookups. Default \["1.1.1.1", "8.8.8.8"].

## Actor input object example

```json
{
  "domains": [
    "github.com",
    "wikipedia.org"
  ],
  "skipCommonSelectors": false,
  "nameservers": [
    "1.1.1.1",
    "8.8.8.8"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "github.com",
        "wikipedia.org"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("admirala/email-domain-auth-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "github.com",
        "wikipedia.org",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("admirala/email-domain-auth-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "github.com",
    "wikipedia.org"
  ]
}' |
apify call admirala/email-domain-auth-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,admirala/email-domain-auth-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/BROHgnCEgS3unujj4/builds/HVagl5gXeivHtdXJO/openapi.json