# B2B Email Security, DMARC/SPF/MX & Cyber Posture Auditor (`ausbizstack/b2b-email-security-dmarc-spf-auditor`) Actor

Bulk B2B DNS, MX, SPF, DKIM, DMARC, BIMI, CAA & HTTP security headers auditor for MSPs, cold-email agencies, RevOps & AI agents. Detects email providers (M365, Google, Proofpoint, Mimecast), spoofing risk, and generates ready-to-send MSP & deliverability pitch hooks.

- **URL**: https://apify.com/ausbizstack/b2b-email-security-dmarc-spf-auditor.md
- **Developed by:** [AusBizStack Intelligence](https://apify.com/ausbizstack) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 domain email security audits

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## B2B Email Security, DMARC/SPF/MX & Cyber Posture Auditor (`ausbizstack/b2b-email-security-dmarc-spf-auditor`)

Turn any list of **global B2B domains (`stripe.com`, `canva.com`, `xero.com`, `dishoom.com`, `tyrrells.com.au`)** into a complete **Email Security, Deliverability & Web Cyber Posture Audit**—complete with **auto-generated DNS remediation records (`DMARC`, `SPF`, `MTA-STS`, `TLS-RPT`, `security.txt`)** and **ready-to-send MSP & Cold-Email summary insights** at **$0.01/domain**.

Built by **AusBizStack Intelligence (`@ausbizstack`)** for **Managed Service Providers (MSPs), Cybersecurity Consultants, Cold-Email & Deliverability Agencies, Clay / n8n / Make.com RevOps Engineers, and MCP AI Agents (`mcp.apify.com`)**.

***

### What This Actor Audits & Generates Per Domain

1. **MX & Enterprise Email Gateway Fingerprinting (`emailProvider` & `hasThirdPartySeg`):**
   - Resolves primary/backup `MX` records via high-speed DNS-over-HTTPS (`cloudflare-dns.com/dns-query`) + Node native DNS.
   - Identifies whether the company runs **Microsoft 365 (Exchange Online)**, **Google Workspace**, **Zoho Mail**, **Fastmail**, **ProtonMail**, **Amazon SES**, **SendGrid**, or **Cloudflare Email Routing**—and flags whether they use a third-party **Secure Email Gateway (SEG)** such as **Proofpoint**, **Mimecast**, **Barracuda**, or **Cisco Secure Email (IronPort)**.
2. **SPF (`v=spf1`) Enforcement & RFC 7208 10-Lookup Risk Audit:**
   - Parses `v=spf1` records for enforcement mode (`hardfail (-all)`, `softfail (~all)`, `neutral (?all)`, `pass_all_danger (+all)`, or `missing`).
   - Extracts authorized third-party senders (`HubSpot`, `Salesforce`, `Klaviyo`, `SendGrid`, `Amazon SES`, `Zendesk`, `Xero`, `Mailchimp`) and estimates total DNS lookups to catch **>10 lookup RFC 7208 PermError** deliverability failures.
3. **DMARC (`_dmarc.<domain>`) Spoofing & Phishing Protection Audit:**
   - Inspects `v=DMARC1` policies (`reject`, `quarantine`, `none`, or `missing`), subdomain policies (`sp=`), percentage (`pct=`), DKIM/SPF alignment (`adkim=`, `aspf=`), and compliant role-based reporting mailboxes (`rua=`, `ruf=`).
   - Classifies domain spoofing exposure as `CRITICAL`, `HIGH`, `MODERATE`, or `LOW`.
4. **Enterprise DKIM Selector Probing + BIMI, MTA-STS, TLS-RPT & CAA:**
   - Probes 13 common enterprise DKIM selectors (`default`, `google`, `selector1`, `selector2`, `k1`, `s1`, `s2`, `mandrill`, `mail`, `dkim`, `mimecast`, `everlytickey1`, `zendesk1`) across `TXT` and `CNAME` records.
   - Checks `default._bimi.<domain>` (BIMI inbox brand logo), `_mta-sts.<domain>` (MTA-STS TLS enforcement), `_smtp._tls.<domain>` (SMTP TLS Reporting), and root `CAA` certificate authority restriction records.
5. **HTTP Security Headers & `/.well-known/security.txt` Posture:**
   - Audits `Strict-Transport-Security` (HSTS), `Content-Security-Policy` (CSP), `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, server banner exposure, and RFC 9116 `/.well-known/security.txt`.
6. **Turnkey DNS Remediation Pack (`recommendedDnsRecords`) + Sales Hooks:**
   - Outputs copy-paste `dmarcRecordToDeploy`, `spfRecordRecommendation`, `mtaStsTxtRecord`, `tlsRptTxtRecord`, and `securityTxtTemplate` alongside tailored **`mspCyberHook`** and **`deliverabilityAgencyHook`** strings.

***

### Quick-Start Integration Snippets

#### 1. Claude Desktop & Cursor IDE via Apify MCP (`mcp.apify.com`)

Add the entire **AusBizStack** 3-Actor suite to `claude_desktop_config.json` or `.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "ausbizstack-apify": {
      "command": "npx",
      "args": [
        "-y",
        "@apify/actors-mcp-server",
        "--actors",
        "ausbizstack/b2b-tech-stack-contact-abn-enricher,ausbizstack/ai-geo-llms-txt-auditor,ausbizstack/b2b-email-security-dmarc-spf-auditor"
      ],
      "env": {
        "APIFY_TOKEN": "YOUR_APIFY_API_TOKEN"
      }
    }
  }
}
```

#### 2. Apify REST API (`curl` — Synchronous JSON Dataset Output)

```bash
curl -X POST "https://api.apify.com/v2/acts/ausbizstack~b2b-email-security-dmarc-spf-auditor/run-sync-get-dataset-items" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": [
      "stripe.com",
      "canva.com",
      "xero.com",
      "dishoom.com",
      "tyrrells.com.au"
    ],
    "probeDkimSelectors": true,
    "checkHttpSecurityHeaders": true,
    "generateRemediationPack": true,
    "maxConcurrency": 5
  }'
```

#### 3. Clay.com HTTP API Waterfall (`$0.01/domain`)

- **Method:** `POST`
- **Endpoint URL:** `https://api.apify.com/v2/acts/ausbizstack~b2b-email-security-dmarc-spf-auditor/run-sync-get-dataset-items?`
- **Headers:** `Content-Type: application/json`
- **JSON Body:**
  ```json
  {
    "domains": ["{{Company Domain}}"],
    "probeDkimSelectors": true,
    "checkHttpSecurityHeaders": true,
    "generateRemediationPack": true
  }
  ```
- **Key Output Columns to Map in Clay:**
  - `response[0].emailProvider` -> **Email Provider / Gateway**
  - `response[0].spoofingRiskLevel` -> **Spoofing Risk (`CRITICAL` / `HIGH` / `MODERATE` / `LOW`)**
  - `response[0].dmarcPolicy` -> **DMARC Policy (`reject` / `quarantine` / `none` / `missing`)**
  - `response[0].mspLeadScore` -> **MSP Lead Score (0–100)**
  - `response[0].mspCyberHook` -> **MSP Outbound Hook**
  - `response[0].deliverabilityAgencyHook` -> **Cold-Email Agency Hook**
  - `response[0].recommendedDnsRecords.dmarcRecordToDeploy` -> **Copy-Paste DMARC Fix**

#### 4. n8n & Make.com Workflows

- Connect an **n8n HTTP Request** node or **Make.com HTTP** module (`POST`) to the synchronous endpoint above.
- Filter leads where `spoofingRiskLevel === "CRITICAL" || spoofingRiskLevel === "HIGH"` or `mspLeadScore >= 70` to route high-priority prospects directly into your CRM or outbound sequencer with their pre-generated `recommendedDnsRecords`.

***

### Output Sample

```json
{
  "inputTarget": "dishoom.com",
  "domain": "dishoom.com",
  "status": "ok",
  "emailProvider": "Mimecast Secure Email Gateway",
  "underlyingMailboxPlatform": "Microsoft 365 (fronted by Mimecast)",
  "hasThirdPartySeg": true,
  "segProvider": "Mimecast",
  "authorizedSpfSenders": ["Microsoft 365", "Mimecast", "Zendesk"],
  "spoofingRiskLevel": "MODERATE",
  "overallSecurityScore": 78,
  "emailSecurityScore": 84,
  "webHeaderSecurityScore": 64,
  "mspLeadScore": 68,
  "dmarcPolicy": "quarantine",
  "spfEnforcement": "hardfail (-all)",
  "spfLookupCountEstimate": 5,
  "activeDkimSelectors": ["selector1", "selector2"],
  "hasBimi": false,
  "hasMtaSts": false,
  "hasTlsRpt": false,
  "hasCaa": false,
  "roleSecurityEmails": ["security@dishoom.com", "postmaster@dishoom.com"],
  "mspCyberHook": "dishoom.com enforces DMARC (quarantine) on Mimecast Secure Email Gateway; pitch MTA-STS TLS enforcement, BIMI inbox logo verification, and HTTP CSP/HSTS hardening...",
  "deliverabilityAgencyHook": "dishoom.com passes core SPF/DMARC checks (quarantine, hardfail (-all)) with 2 active DKIM selector(s) (selector1, selector2) — pitch BIMI VMC brand checkmark deployment...",
  "recommendedDnsRecords": {
    "dmarcHost": "_dmarc.dishoom.com",
    "dmarcRecordToDeploy": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@dishoom.com; adkim=s; aspf=s; fo=1;",
    "spfHost": "dishoom.com",
    "spfRecordRecommendation": "v=spf1 include:eu._netblocks.mimecast.com include:spf.protection.outlook.com -all"
  }
}
```

***

### Strict Privacy-by-Design &

- **Zero Personal Emails (`0` PII):** Only role-based corporate security and technical addresses (`security@`, `abuse@`, `postmaster@`, `dmarc-reports@`, `soc@`, `cert@`, `admin@`, `support@`) are extracted or returned in `roleSecurityEmails`. Any personal employee email in `rua=`, `ruf=`, or `security.txt` is discarded in memory.
- **Passive Public DNS & HTTP Header Inspection Only:** Queries public DNS (`MX`, `TXT`, `CNAME`, `CAA`) records and standard `GET /` HTTP response headers—never performing intrusive port scans or active exploitation.

### API authentication

Pass your token as a header, never in the URL:

```bash
curl -X POST "https://api.apify.com/v2/acts/ausbizstack~b2b-email-security-dmarc-spf-auditor/run-sync-get-dataset-items" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" -H "Content-Type: application/json" -d '{...}'
```

### ✅ Zero Charge for Failed Domains

You are charged only when real intelligence data is returned. Failed, timed-out or unreachable targets still appear in the dataset with `status` and an error reason, but cost **$0**.

### Acceptable Use & Spam Act 2003 (Cth) Compliance

This Actor returns publicly available business information only. You are responsible for how you use it. If you send commercial electronic messages to Australian recipients you must comply with the *Spam Act 2003* (Cth): have consent (express or inferred), identify yourself accurately, and include a functional unsubscribe. Respect any website notice stating that unsolicited messages are not wanted, and comply with the Privacy Act 1988 (Cth), GDPR and other applicable laws. Do not use this Actor for bulk unsolicited messaging.

# Actor input Schema

## `domains` (type: `array`):

Enter B2B domains or website URLs (e.g., stripe.com, canva.com, xero.com, dishoom.com, tyrrells.com.au).

## `targets` (type: `array`):

Optional alias for `domains` so workflows passing `targets` or `domains` both work seamlessly.

## `probeDkimSelectors` (type: `boolean`):

Check 13 common DKIM selectors (default, google, selector1, selector2, k1, s1, s2, mandrill, mail, dkim, mimecast, everlytickey1, zendesk1) via DNS TXT/CNAME records.

## `checkHttpSecurityHeaders` (type: `boolean`):

Inspect Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Server header leakage, and /.well-known/security.txt.

## `generateRemediationPack` (type: `boolean`):

Automatically generate copy-paste DNS TXT records tailored to the audited domain and its detected mail provider.

## `maxConcurrency` (type: `integer`):

Number of domains audited in parallel (1 to 20).

## `requestTimeoutSecs` (type: `integer`):

Per-request DNS/HTTP timeout in seconds.

## Actor input object example

```json
{
  "domains": [
    "stripe.com",
    "canva.com",
    "xero.com",
    "dishoom.com",
    "tyrrells.com.au"
  ],
  "probeDkimSelectors": true,
  "checkHttpSecurityHeaders": true,
  "generateRemediationPack": true,
  "maxConcurrency": 50,
  "requestTimeoutSecs": 5
}
```

# Actor output Schema

## `audits` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "stripe.com",
        "canva.com",
        "xero.com",
        "dishoom.com",
        "tyrrells.com.au"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("ausbizstack/b2b-email-security-dmarc-spf-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "stripe.com",
        "canva.com",
        "xero.com",
        "dishoom.com",
        "tyrrells.com.au",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("ausbizstack/b2b-email-security-dmarc-spf-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "stripe.com",
    "canva.com",
    "xero.com",
    "dishoom.com",
    "tyrrells.com.au"
  ]
}' |
apify call ausbizstack/b2b-email-security-dmarc-spf-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ausbizstack/b2b-email-security-dmarc-spf-auditor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/o5G9jOLPA7lmbRPfD/builds/5GedoD3xFXFE78pxC/openapi.json