Email Deliverability Checker: SPF, DKIM And DMARC For Any Domain

Find out whether a domain can send email that actually lands, and exactly what is stopping it.

Mail that fails authentication goes to spam or gets rejected outright, and the sender is the last to know. Gmail and Yahoo now require SPF, DKIM and DMARC from anyone sending in volume, so a missing record is not a best practice question any more. It is the difference between the inbox and nothing.

Give this a list of domains and get the full authentication setup for each one: SPF with its policy and lookup count, DKIM keys on every selector worth probing, DMARC with its policy and reporting addresses, MX with the mail platform behind it, plus BIMI and MTA-STS. Every row carries a score out of 100 and a plain list of what is wrong.

Built for deliverability consultants auditing a client list, agencies onboarding new accounts, sales teams checking a prospect's setup before pitching an email product, and anyone responsible for more domains than they can remember.

How it works

flowchart LR
    A[Domains or email addresses] --> B[Read the domain]
    B --> C[MX records]
    B --> D[TXT at the apex<br/>for SPF]
    B --> E[_dmarc TXT]
    B --> F[Probe DKIM selectors]
    B --> G[BIMI and MTA-STS]
    C --> H[Parse and score]
    D --> H
    E --> H
    F --> H
    G --> H
    H --> I[(One row per domain<br/>with a score and issues)]

Everything comes from DNS. There is no scraping, no API key, no rate limit worth managing, and no mail is ever sent to anyone.

What you get

One row per domain. A real row from a live run:

{
  "domain": "stripe.com",
  "status": "ok",
  "score": 97,
  "issues": [],
  "acceptsEmail": true,
  "mailProvider": "Google Workspace",
  "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com"],
  "spfPresent": true,
  "spfPolicy": "softfail",
  "spfLookupCount": 3,
  "spfIncludes": ["spf1.stripe.com", "_spf.qualtrics.com"],
  "dkimFound": true,
  "dkimSelectors": ["google", "mandrill", "s1", "s2"],
  "dmarcPresent": true,
  "dmarcPolicy": "reject",
  "dmarcReporting": true,
  "dmarcReportingAddresses": ["mailto:dmarc-reports@stripe.com"],
  "bimiPresent": false,
  "mtaStsPresent": false,
  "checkedAt": "2026-09-08T09:12:04.881Z"
}

And a domain that needs work:

{
  "domain": "example.net",
  "status": "critical",
  "score": 0,
  "issues": [
    "No SPF record, so receivers cannot tell which servers may send for this domain",
    "No DMARC record, so nothing tells receivers what to do with mail that fails authentication",
    "No DKIM key found on any common selector",
    "No MX records, so this domain cannot receive email"
  ]
}

What the checks catch

Presence is the easy half. These are the failures that a simple "is there an SPF record" check reports as healthy.

Problem	Why it matters
Two SPF records	Receivers treat it as a permanent error and ignore SPF completely, so publishing a second one turns protection off
SPF over 10 DNS lookups	The limit is in the spec. Past it, evaluation stops and the check fails no matter how correct the record reads
SPF ending in +all	Authorises the entire internet to send as the domain
DKIM key revoked	An empty p= tag means the key is withdrawn. The selector answers, so a naive check counts it as working
DMARC p=none	Monitors and blocks nothing, which is a staging post rather than protection
DMARC with no rua	No reports come back, so failures stay invisible
DMARC pct below 100	The policy only applies to a share of mail

Scores and status

score is a number out of 100 for sorting a long list. status is the verdict: ok, warning, critical, or error when the domain does not resolve at all. A domain that resolves but publishes nothing is critical, not an error, because the answer is real and actionable.

Example input

{
  "domains": [
    "example.com",
    "sales@prospect.com",
    "https://clientsite.co.uk"
  ],
  "extraDkimSelectors": ["mycustomselector"],
  "onlyProblems": true
}

Email addresses are accepted directly, so a list pulled from a CRM needs no cleaning first.

Run it from the command line

curl -X POST "https://api.apify.com/v2/acts/arched_friend~email-deliverability-checker/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com", "prospect.com"],
    "onlyProblems": true
  }'

Pricing

$0.004 per domain checked, covering every record on that domain.

	This Actor	Deliverability SaaS	Manual dig
500 domains	$2	$50 to $200 a month	A day of work
DKIM selector discovery	Yes, 31 selectors	Usually	One at a time
Revoked key detection	Yes	Rarely	Only if you read the record
SPF lookup limit check	Yes	Sometimes	By hand
Bulk lists	Paste and run	Often one domain at a time

Notes and limits

• DKIM absence cannot be proven. DKIM has no discovery mechanism, so the only way to find a key is to guess the selector. This probes 31 selectors covering the common platforms, and you can add your own. A domain with a private selector and no match reports dkimFound: false, which means "none of the selectors probed answered", not "this domain has no DKIM".
• Records are read live from DNS on every run, so a change shows up as soon as it has propagated.
• Nothing here sends mail or connects to a mail server, so no prospect is ever contacted by the check itself.

Related products

• Email List Cleaner for validating the addresses you are about to send to.
• Domain & SSL Expiry Monitor for the registration and certificate side of the same domain list.
• Website Lead Extractor for pulling contact details off the sites behind those domains.