# Email Deliverability & DNS Security Auditor (SPF, DMARC) (`arthursbuisness/email-dns-deliverability-auditor`) Actor

- **URL**: https://apify.com/arthursbuisness/email-dns-deliverability-auditor.md
- **Developed by:** [Arthur](https://apify.com/arthursbuisness) (community)
- **Categories:**
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$10.00 / 1,000 domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Email Deliverability & DNS Security Auditor

Bulk-audit any list of domains for **email deliverability** and **DNS security posture** — the exact records that decide whether your mail lands in the inbox or the spam folder, and whether your domain can be spoofed by phishers. Every lookup runs over public **DNS-over-HTTPS** (Google `dns.google` with a Cloudflare fallback), so there is nothing to install, no local resolver quirks, and no dependence on port 25 / SMTP probing that data-center IPs routinely get blocked from. It is 100% free data and ToS-safe: it only queries public DNS for the domains you provide.

### What it checks (per domain)

- **MX** — mail exchangers and their priorities (can the domain receive mail at all?)
- **SPF** — presence, the raw record, the `all` qualifier (`-all` / `~all` / `?all` / `+all`), a count of DNS-lookup-causing mechanisms (the RFC 7208 **10-lookup limit** that silently breaks SPF), and detection of the "multiple SPF records" misconfiguration.
- **DMARC** — presence, `p=` policy (`none` / `quarantine` / `reject`), subdomain policy `sp=`, `pct=`, and whether aggregate (`rua`) / forensic (`ruf`) reporting is configured.
- **DKIM** — probes a curated list of common selectors (Google, Microsoft 365, Amazon SES, SendGrid, Mailchimp/Mandrill, Zoho, Proton, Fastmail, Mailjet, and generic defaults). You can override the selector list.
- **MTA-STS**, **TLS-RPT**, **BIMI** — modern inbound-TLS and brand-indicator records.
- **DNSSEC** — whether answers are authenticated (AD flag).

### Output

Each domain becomes one dataset row with a nested, machine-readable structure plus:

- **`score`** — a 0–100 deliverability/security score.
- **`grade`** — A–F.
- **`issues`** — concrete problems found (e.g. *"DMARC is monitoring-only (p=none) — spoofed mail is not blocked"*).
- **`recommendations`** — actionable fixes (e.g. *"End your SPF record with -all"*).

### Input

| Field | Type | Description |
|-------|------|-------------|
| `domains` | array | Domains to audit. URLs or `user@domain` are accepted; the domain is extracted. |
| `checkDkim` | boolean | Probe DKIM selectors (default `true`). |
| `dkimSelectors` | array | Optional custom selector list (empty = built-in list). |
| `timeoutSecs` | integer | Per-query timeout (default 15). |

### Use cases

Cold-email / sales-ops teams pre-flighting sending domains; agencies auditing client deliverability at scale; security teams checking anti-spoofing posture across a portfolio; MSPs and lead-gen tools enriching domain lists. Feed it 1 domain or 10,000 — you pay per domain audited.

### Pricing

Pay-per-event: one **`domain`** event is charged only for a domain whose result is successfully stored. No result, no charge.

### How it works / reliability

All data comes from DNS-over-HTTPS JSON APIs, so runs are deterministic and fast. If Google DoH is unreachable for a query, it automatically retries against Cloudflare. TXT records are normalised (quotes stripped, split strings merged) before parsing, so SPF/DMARC/DKIM values are read correctly regardless of how the resolver returns them.

# Actor input Schema

## `domains` (type: `array`):

List of domains to audit (e.g. example.com). Full URLs or user@domain are accepted — the domain is extracted automatically. Each domain becomes one result row.

## `checkDkim` (type: `boolean`):

Look up common DKIM selectors (Google, Microsoft 365, SendGrid, Amazon SES, etc.) to detect DKIM signing. Adds extra DNS lookups per domain. Turn off to audit only SPF/DMARC/MX and speed things up.

## `dkimSelectors` (type: `array`):

Override the default DKIM selector list. Provide only the selector labels (without .\_domainkey). Leave empty to use the built-in list covering the major email providers.

## `timeoutSecs` (type: `integer`):

Maximum seconds to wait for each DNS-over-HTTPS lookup before falling back or giving up.

## Actor input object example

```json
{
  "domains": [
    "example.com"
  ],
  "checkDkim": true,
  "dkimSelectors": [],
  "timeoutSecs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

One item per audited domain: MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, DNSSEC, plus score, grade, issues and recommendations.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ],
    "dkimSelectors": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("arthursbuisness/email-dns-deliverability-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": ["example.com"],
    "dkimSelectors": [],
}

# Run the Actor and wait for it to finish
run = client.actor("arthursbuisness/email-dns-deliverability-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ],
  "dkimSelectors": []
}' |
apify call arthursbuisness/email-dns-deliverability-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,arthursbuisness/email-dns-deliverability-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/0nlfETb1fqEsG5XlQ/builds/Dljqmfa4mvVL0A097/openapi.json