B2B Email Security, DMARC/SPF/MX & Cyber Posture Auditor (ausbizstack/b2b-email-security-dmarc-spf-auditor)

Turn any list of global B2B domains (stripe.com, canva.com, xero.com, dishoom.com, tyrrells.com.au) into a complete Email Security, Deliverability & Web Cyber Posture Audit—complete with auto-generated DNS remediation records (DMARC, SPF, MTA-STS, TLS-RPT, security.txt) and ready-to-send MSP & Cold-Email summary insights at $0.01/domain.

Built by AusBizStack Intelligence (@ausbizstack) for Managed Service Providers (MSPs), Cybersecurity Consultants, Cold-Email & Deliverability Agencies, Clay / n8n / Make.com RevOps Engineers, and MCP AI Agents (mcp.apify.com).

---

What This Actor Audits & Generates Per Domain

1. MX & Enterprise Email Gateway Fingerprinting (emailProvider & hasThirdPartySeg):
   • Resolves primary/backup MX records via high-speed DNS-over-HTTPS (cloudflare-dns.com/dns-query) + Node native DNS.
   • Identifies whether the company runs Microsoft 365 (Exchange Online), Google Workspace, Zoho Mail, Fastmail, ProtonMail, Amazon SES, SendGrid, or Cloudflare Email Routing—and flags whether they use a third-party Secure Email Gateway (SEG) such as Proofpoint, Mimecast, Barracuda, or Cisco Secure Email (IronPort).
2. SPF (v=spf1) Enforcement & RFC 7208 10-Lookup Risk Audit:
   • Parses v=spf1 records for enforcement mode (hardfail (-all), softfail (~all), neutral (?all), pass_all_danger (+all), or missing).
   • Extracts authorized third-party senders (HubSpot, Salesforce, Klaviyo, SendGrid, Amazon SES, Zendesk, Xero, Mailchimp) and estimates total DNS lookups to catch >10 lookup RFC 7208 PermError deliverability failures.
3. DMARC (_dmarc.<domain>) Spoofing & Phishing Protection Audit:
   • Inspects v=DMARC1 policies (reject, quarantine, none, or missing), subdomain policies (sp=), percentage (pct=), DKIM/SPF alignment (adkim=, aspf=), and compliant role-based reporting mailboxes (rua=, ruf=).
   • Classifies domain spoofing exposure as CRITICAL, HIGH, MODERATE, or LOW.
4. Enterprise DKIM Selector Probing + BIMI, MTA-STS, TLS-RPT & CAA:
   • Probes 13 common enterprise DKIM selectors (default, google, selector1, selector2, k1, s1, s2, mandrill, mail, dkim, mimecast, everlytickey1, zendesk1) across TXT and CNAME records.
   • Checks default._bimi.<domain> (BIMI inbox brand logo), _mta-sts.<domain> (MTA-STS TLS enforcement), _smtp._tls.<domain> (SMTP TLS Reporting), and root CAA certificate authority restriction records.
5. HTTP Security Headers & /.well-known/security.txt Posture:
   • Audits Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, server banner exposure, and RFC 9116 /.well-known/security.txt.
6. Turnkey DNS Remediation Pack (recommendedDnsRecords) + Sales Hooks:
   • Outputs copy-paste dmarcRecordToDeploy, spfRecordRecommendation, mtaStsTxtRecord, tlsRptTxtRecord, and securityTxtTemplate alongside tailored mspCyberHook and deliverabilityAgencyHook strings.

---

Quick-Start Integration Snippets

1. Claude Desktop & Cursor IDE via Apify MCP (mcp.apify.com)

Add the entire AusBizStack 3-Actor suite to claude_desktop_config.json or .cursor/mcp.json:

{
  "mcpServers": {
    "ausbizstack-apify": {
      "command": "npx",
      "args": [
        "-y",
        "@apify/actors-mcp-server",
        "--actors",
        "ausbizstack/b2b-tech-stack-contact-abn-enricher,ausbizstack/ai-geo-llms-txt-auditor,ausbizstack/b2b-email-security-dmarc-spf-auditor"
      ],
      "env": {
        "APIFY_TOKEN": "YOUR_APIFY_API_TOKEN"
      }
    }
  }
}

2. Apify REST API (curl — Synchronous JSON Dataset Output)

curl -X POST "https://api.apify.com/v2/acts/ausbizstack~b2b-email-security-dmarc-spf-auditor/run-sync-get-dataset-items" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": [
      "stripe.com",
      "canva.com",
      "xero.com",
      "dishoom.com",
      "tyrrells.com.au"
    ],
    "probeDkimSelectors": true,
    "checkHttpSecurityHeaders": true,
    "generateRemediationPack": true,
    "maxConcurrency": 5
  }'

3. Clay.com HTTP API Waterfall ($0.01/domain)

• Method: POST
• Endpoint URL: https://api.apify.com/v2/acts/ausbizstack~b2b-email-security-dmarc-spf-auditor/run-sync-get-dataset-items?
• Headers: Content-Type: application/json
• JSON Body:

  {
    "domains": ["{{Company Domain}}"],
    "probeDkimSelectors": true,
    "checkHttpSecurityHeaders": true,
    "generateRemediationPack": true
  }
  

• Key Output Columns to Map in Clay:
  • response[0].emailProvider -> Email Provider / Gateway
  • response[0].spoofingRiskLevel -> Spoofing Risk (CRITICAL / HIGH / MODERATE / LOW)
  • response[0].dmarcPolicy -> DMARC Policy (reject / quarantine / none / missing)
  • response[0].mspLeadScore -> MSP Lead Score (0–100)
  • response[0].mspCyberHook -> MSP Outbound Hook
  • response[0].deliverabilityAgencyHook -> Cold-Email Agency Hook
  • response[0].recommendedDnsRecords.dmarcRecordToDeploy -> Copy-Paste DMARC Fix

4. n8n & Make.com Workflows

• Connect an n8n HTTP Request node or Make.com HTTP module (POST) to the synchronous endpoint above.
• Filter leads where spoofingRiskLevel === "CRITICAL" || spoofingRiskLevel === "HIGH" or mspLeadScore >= 70 to route high-priority prospects directly into your CRM or outbound sequencer with their pre-generated recommendedDnsRecords.

---

Output Sample

{
  "inputTarget": "dishoom.com",
  "domain": "dishoom.com",
  "status": "ok",
  "emailProvider": "Mimecast Secure Email Gateway",
  "underlyingMailboxPlatform": "Microsoft 365 (fronted by Mimecast)",
  "hasThirdPartySeg": true,
  "segProvider": "Mimecast",
  "authorizedSpfSenders": ["Microsoft 365", "Mimecast", "Zendesk"],
  "spoofingRiskLevel": "MODERATE",
  "overallSecurityScore": 78,
  "emailSecurityScore": 84,
  "webHeaderSecurityScore": 64,
  "mspLeadScore": 68,
  "dmarcPolicy": "quarantine",
  "spfEnforcement": "hardfail (-all)",
  "spfLookupCountEstimate": 5,
  "activeDkimSelectors": ["selector1", "selector2"],
  "hasBimi": false,
  "hasMtaSts": false,
  "hasTlsRpt": false,
  "hasCaa": false,
  "roleSecurityEmails": ["security@dishoom.com", "postmaster@dishoom.com"],
  "mspCyberHook": "dishoom.com enforces DMARC (quarantine) on Mimecast Secure Email Gateway; pitch MTA-STS TLS enforcement, BIMI inbox logo verification, and HTTP CSP/HSTS hardening...",
  "deliverabilityAgencyHook": "dishoom.com passes core SPF/DMARC checks (quarantine, hardfail (-all)) with 2 active DKIM selector(s) (selector1, selector2) — pitch BIMI VMC brand checkmark deployment...",
  "recommendedDnsRecords": {
    "dmarcHost": "_dmarc.dishoom.com",
    "dmarcRecordToDeploy": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@dishoom.com; adkim=s; aspf=s; fo=1;",
    "spfHost": "dishoom.com",
    "spfRecordRecommendation": "v=spf1 include:eu._netblocks.mimecast.com include:spf.protection.outlook.com -all"
  }
}

---

Strict Privacy-by-Design &

• Zero Personal Emails (0 PII): Only role-based corporate security and technical addresses (security@, abuse@, postmaster@, dmarc-reports@, soc@, cert@, admin@, support@) are extracted or returned in roleSecurityEmails. Any personal employee email in rua=, ruf=, or security.txt is discarded in memory.
• Passive Public DNS & HTTP Header Inspection Only: Queries public DNS (MX, TXT, CNAME, CAA) records and standard GET / HTTP response headers—never performing intrusive port scans or active exploitation.

API authentication

Pass your token as a header, never in the URL:

curl -X POST "https://api.apify.com/v2/acts/ausbizstack~b2b-email-security-dmarc-spf-auditor/run-sync-get-dataset-items" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" -H "Content-Type: application/json" -d '{...}'

✅ Zero Charge for Failed Domains

You are charged only when real intelligence data is returned. Failed, timed-out or unreachable targets still appear in the dataset with status and an error reason, but cost $0.

Acceptable Use & Spam Act 2003 (Cth) Compliance

This Actor returns publicly available business information only. You are responsible for how you use it. If you send commercial electronic messages to Australian recipients you must comply with the Spam Act 2003 (Cth): have consent (express or inferred), identify yourself accurately, and include a functional unsubscribe. Respect any website notice stating that unsolicited messages are not wanted, and comply with the Privacy Act 1988 (Cth), GDPR and other applicable laws. Do not use this Actor for bulk unsolicited messaging.