Email Deliverability & DNS Security Auditor

Bulk-audit any list of domains for email deliverability and DNS security posture — the exact records that decide whether your mail lands in the inbox or the spam folder, and whether your domain can be spoofed by phishers. Every lookup runs over public DNS-over-HTTPS (Google dns.google with a Cloudflare fallback), so there is nothing to install, no local resolver quirks, and no dependence on port 25 / SMTP probing that data-center IPs routinely get blocked from. It is 100% free data and ToS-safe: it only queries public DNS for the domains you provide.

What it checks (per domain)

• MX — mail exchangers and their priorities (can the domain receive mail at all?)
• SPF — presence, the raw record, the all qualifier (-all / ~all / ?all / +all), a count of DNS-lookup-causing mechanisms (the RFC 7208 10-lookup limit that silently breaks SPF), and detection of the "multiple SPF records" misconfiguration.
• DMARC — presence, p= policy (none / quarantine / reject), subdomain policy sp=, pct=, and whether aggregate (rua) / forensic (ruf) reporting is configured.
• DKIM — probes a curated list of common selectors (Google, Microsoft 365, Amazon SES, SendGrid, Mailchimp/Mandrill, Zoho, Proton, Fastmail, Mailjet, and generic defaults). You can override the selector list.
• MTA-STS, TLS-RPT, BIMI — modern inbound-TLS and brand-indicator records.
• DNSSEC — whether answers are authenticated (AD flag).

Output

Each domain becomes one dataset row with a nested, machine-readable structure plus:

• score — a 0–100 deliverability/security score.
• grade — A–F.
• issues — concrete problems found (e.g. "DMARC is monitoring-only (p=none) — spoofed mail is not blocked").
• recommendations — actionable fixes (e.g. "End your SPF record with -all").

Input

Field	Type	Description
domains	array	Domains to audit. URLs or user@domain are accepted; the domain is extracted.
checkDkim	boolean	Probe DKIM selectors (default true).
dkimSelectors	array	Optional custom selector list (empty = built-in list).
timeoutSecs	integer	Per-query timeout (default 15).

Use cases

Cold-email / sales-ops teams pre-flighting sending domains; agencies auditing client deliverability at scale; security teams checking anti-spoofing posture across a portfolio; MSPs and lead-gen tools enriching domain lists. Feed it 1 domain or 10,000 — you pay per domain audited.

Pricing

Pay-per-event: one domain event is charged only for a domain whose result is successfully stored. No result, no charge.

How it works / reliability

All data comes from DNS-over-HTTPS JSON APIs, so runs are deterministic and fast. If Google DoH is unreachable for a query, it automatically retries against Cloudflare. TXT records are normalised (quotes stripped, split strings merged) before parsing, so SPF/DMARC/DKIM values are read correctly regardless of how the resolver returns them.