# Bulk Domain Email Security Checker (`automation-lab/bulk-domain-email-security-checker`) Actor Audit SPF, DMARC, MX, and DKIM DNS posture for bulk domain lists with scores, risk flags, and raw records. - **URL**: https://apify.com/automation-lab/bulk-domain-email-security-checker.md - **Developed by:** [Stas Persiianenko](https://apify.com/automation-lab) (community) - **Categories:** Developer tools, SEO tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Bulk Domain Email Security Checker Audit SPF, DMARC, MX, and DKIM DNS records for many domains at once. This Apify Actor turns public DNS lookups into a clean dataset with scores, risk flags, raw records, and remediation-ready evidence. ### What does Bulk Domain Email Security Checker do? Bulk Domain Email Security Checker reviews the public email authentication posture of every domain you provide. It checks: - 📬 MX records for mail routing - 🛡️ SPF TXT records on the root domain - 📣 DMARC TXT records on `_dmarc.domain` - 🔐 optional DKIM selectors such as `google`, `selector1`, `selector2`, and `default` - 🚩 normalized risks such as missing DMARC, weak `p=none`, missing SPF, multiple SPF records, and SPF lookup-limit risk The output is one row per domain, ready for CSV, JSON, Excel, BigQuery, Make, Zapier, or an internal remediation dashboard. ### Who is it for? This actor is designed for teams that manage many domains. - Email deliverability agencies auditing customer domains - MSPs checking Microsoft 365 or Google Workspace onboarding readiness - Security auditors reviewing email authentication posture - Cold-email operations teams cleaning prospect or sending-domain lists - SaaS onboarding teams validating customer DNS setup - RevOps teams monitoring domains after migrations - Compliance teams creating recurring evidence exports ### Why use this actor? Single-domain web checkers are useful for one-off debugging, but they are slow when you need to audit 50, 500, or 5,000 domains. This actor is bulk-first: - Paste a list of domains. - Run once. - Export a structured dataset. - Sort by score or risk flag. - Send the remediation queue to the right owner. ### What data can you extract? | Field | Description | | --- | --- | | `domain` | Normalized domain name checked | | `status` | `ok`, `warning`, or `error` | | `score` | 0-100 posture score | | `riskFlags` | Machine-readable remediation flags | | `mxHosts` | MX hostnames sorted by priority | | `spfStatus` | SPF status: pass, missing, multiple, or error | | `spfRecord` | First SPF record found | | `spfLookupMechanismCount` | Approximate SPF DNS lookup mechanism count | | `dmarcStatus` | DMARC status: pass, missing, or error | | `dmarcPolicy` | DMARC `p=` policy | | `dmarcRua` | Aggregate report destinations | | `dkimResults` | Results for requested DKIM selectors | | `rawTxtRecords` | Optional raw TXT records | | `errors` | DNS lookup errors captured per domain | ### How much does it cost to check domain email security? This actor uses pay-per-event pricing. - A small start event is charged once per run. - A per-domain event is charged for each domain row saved to the dataset. - Larger Apify subscription tiers receive lower per-domain prices. The actor does not use proxies or browsers, so compute costs are low and predictable. ### How to use it 1. Open the actor on Apify. 2. Add domains in the `domains` array or paste them into `domainsText`. 3. Optionally set DKIM selectors. 4. Choose whether to include raw DNS records. 5. Run the actor. 6. Export the dataset as CSV, JSON, Excel, or through the Apify API. ### Input example ```json { "domains": ["google.com", "gmail.com", "example.com"], "dkimSelectors": ["google", "selector1", "selector2", "default"], "includeRawRecords": true, "riskOnly": false, "maxConcurrency": 20, "timeoutMs": 5000 } ```` ### Output example ```json { "domain": "example.com", "status": "warning", "score": 55, "riskFlags": ["missing_dmarc"], "mxHosts": ["."], "spfStatus": "pass", "spfRecord": "v=spf1 -all", "dmarcStatus": "missing", "dkimResults": [{ "selector": "google", "found": false }], "checkedAt": "2026-06-26T00:00:00.000Z" } ``` ### Risk flags explained The `riskFlags` array is built for filtering and remediation. - `no_mx` — no MX record was found. - `missing_spf` — no root SPF record was found. - `multiple_spf_records` — more than one SPF record was found. - `spf_allows_all` — SPF contains `+all`. - `spf_dns_lookup_limit_risk` — SPF likely approaches or exceeds the 10 lookup limit. - `spf_uses_ptr_mechanism` — SPF uses the discouraged PTR mechanism. - `missing_dmarc` — no DMARC record was found. - `dmarc_policy_none` — DMARC is in monitor-only mode. - `dmarc_missing_rua` — DMARC does not publish aggregate reporting. - `multiple_dmarc_records` — multiple DMARC records were found. - `no_requested_dkim_selector_found` — none of the requested DKIM selectors resolved. ### Scoring model Each domain starts at 100 points. Risk flags subtract points based on likely operational impact. The score is not a legal or compliance certification; it is a practical prioritization signal for bulk remediation. ### DKIM selector checks DKIM is selector-based. There is no universal DNS record that lists every selector a domain uses. The actor checks selectors you provide at: `selector._domainkey.domain` Use selectors from your mail provider or common defaults such as: - `google` - `selector1` - `selector2` - `default` - `k1` - `mail` ### Tips for best results - Use root domains such as `example.com`, not email addresses. - Keep `includeRawRecords` enabled when you need audit evidence. - Enable `riskOnly` when you only want remediation rows. - Add provider-specific DKIM selectors for better DKIM coverage. - Lower concurrency if a custom DNS resolver or very large batch gets intermittent timeouts. ### Integrations Use this actor in workflows such as: - Weekly deliverability audit exported to Google Sheets - Customer onboarding DNS checks before enabling email sending - MSP domain inventory review in Airtable - Security posture dashboard in BigQuery - Slack alert for domains with missing DMARC - Make or Zapier workflow that creates remediation tickets ### API usage with Node.js ```js import { ApifyClient } from 'apify-client'; const client = new ApifyClient({ token: process.env.APIFY_TOKEN }); const run = await client.actor('automation-lab/bulk-domain-email-security-checker').call({ domains: ['example.com', 'google.com'], includeRawRecords: true }); console.log(run.defaultDatasetId); ``` ### API usage with Python ```python from apify_client import ApifyClient import os client = ApifyClient(os.environ['APIFY_TOKEN']) run = client.actor('automation-lab/bulk-domain-email-security-checker').call(run_input={ 'domains': ['example.com', 'google.com'], 'includeRawRecords': True, }) print(run['defaultDatasetId']) ``` ### API usage with cURL ```bash curl -X POST "https://api.apify.com/v2/acts/automation-lab~bulk-domain-email-security-checker/runs?token=$APIFY_TOKEN" \ -H 'Content-Type: application/json' \ -d '{"domains":["example.com","google.com"],"includeRawRecords":true}' ``` ### MCP integration Use this actor through Apify MCP from Claude Desktop, Claude Code, or other MCP-compatible clients. ```bash claude mcp add apify-domain-email-security "https://mcp.apify.com/?tools=automation-lab/bulk-domain-email-security-checker" ``` ```json { "mcpServers": { "apify-domain-email-security": { "url": "https://mcp.apify.com/?tools=automation-lab/bulk-domain-email-security-checker" } } } ``` Example prompts: - "Use Apify to check these domains for SPF, DMARC, MX, and DKIM risk flags." - "Run a bulk domain email security audit and return only domains with missing DMARC." - "Create a remediation summary for these customer domains from the Apify MCP results." ### MCP usage with Claude Connect Apify MCP with this tool enabled: `https://mcp.apify.com/?tools=automation-lab/bulk-domain-email-security-checker` Example prompts: - "Check these 200 customer domains for missing DMARC and summarize the riskiest ones." - "Run a bulk email security audit and export risky domains to CSV." - "Compare SPF and DMARC posture for these acquisition target domains." ### MCP usage with Claude Desktop Add Apify MCP to Claude Desktop, authorize your Apify account, and allow the `automation-lab/bulk-domain-email-security-checker` tool. Then paste domains directly into your prompt and ask Claude to run the audit. ### MCP usage with Claude Code Use the Apify MCP URL with: `?tools=automation-lab/bulk-domain-email-security-checker` Add it from the CLI: ```bash claude mcp add apify-domain-email-security "https://mcp.apify.com/?tools=automation-lab/bulk-domain-email-security-checker" ``` Or configure the MCP server in JSON: ```json { "mcpServers": { "apify-domain-email-security": { "url": "https://mcp.apify.com/?tools=automation-lab/bulk-domain-email-security-checker" } } } ``` Claude Code can run checks during onboarding scripts, DNS migration reviews, or repository-driven domain inventory updates. ### Legality The actor only queries public DNS records. It does not bypass authentication, scrape private pages, log in to accounts, or access mailbox content. Always use the results responsibly and follow your agreements with customers and domain owners. ### Limitations - DKIM requires known selectors. - DNS propagation can produce temporary differences by resolver and time. - SPF lookup counting is a practical heuristic, not a full recursive SPF evaluator. - DMARC `p=none` may be intentional during rollout. - A high score does not guarantee complete email deliverability. ### Troubleshooting: no DKIM found DKIM records are selector-specific. Add the selectors used by your email provider. For Google Workspace, try `google`. For Microsoft 365, try selectors such as `selector1` and `selector2`. ### Troubleshooting: DNS timeout errors Some domains have slow or broken DNS. Increase `timeoutMs` or reduce `maxConcurrency`. The actor records lookup errors in the `errors` field instead of failing the entire run. ### FAQ #### Can I check thousands of domains? Yes. The actor uses DNS lookups and concurrency rather than a browser, so large batches are efficient. #### Does it send email? No. It only reads public DNS records. #### Does it require proxies? No. DNS checks do not require Apify Proxy. #### Can it validate BIMI? Not in the first version. BIMI can be added later if users request it. #### Can it monitor domains over time? Yes. Schedule the actor on Apify and compare datasets between runs. ### Related scrapers and tools Other automation-lab actors may complement this workflow: - https://apify.com/automation-lab/website-contact-finder - https://apify.com/automation-lab/bulk-url-status-checker - https://apify.com/automation-lab/security-headers-checker ### Support If you need a new risk flag, a provider-specific DKIM selector preset, or another DNS record type, open an issue on the actor page. ### Changelog - Initial version: bulk SPF, DMARC, MX, and DKIM DNS audit with scores and risk flags. # Actor input Schema ## `domains` (type: `array`): Domain names to check. You can paste bare domains or URLs; the actor normalizes them to hostnames. ## `domainsText` (type: `string`): Optional newline/comma/space separated domain list. Useful when pasting from a spreadsheet. ## `dkimSelectors` (type: `array`): Selectors to test at selector.\_domainkey.domain. Common values include google, selector1, selector2, default, k1. ## `riskOnly` (type: `boolean`): If enabled, domains with a clean score are omitted from the dataset. ## `includeRawRecords` (type: `boolean`): Include raw TXT and DMARC TXT records in each output row for audit trails. ## `maxConcurrency` (type: `integer`): Number of domains checked in parallel. Lower this for very large lists if your resolver rate-limits. ## `timeoutMs` (type: `integer`): Timeout for each DNS lookup. The actor clamps this between 1000 and 30000 ms. ## Actor input object example ```json { "domains": [ "google.com", "gmail.com", "example.com" ], "dkimSelectors": [ "google", "selector1", "selector2", "default" ], "riskOnly": false, "includeRawRecords": true, "maxConcurrency": 20, "timeoutMs": 5000 } ``` # Actor output Schema ## `overview` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "google.com", "gmail.com", "example.com" ], "dkimSelectors": [ "google", "selector1", "selector2", "default" ], "maxConcurrency": 20, "timeoutMs": 5000 }; // Run the Actor and wait for it to finish const run = await client.actor("automation-lab/bulk-domain-email-security-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "google.com", "gmail.com", "example.com", ], "dkimSelectors": [ "google", "selector1", "selector2", "default", ], "maxConcurrency": 20, "timeoutMs": 5000, } # Run the Actor and wait for it to finish run = client.actor("automation-lab/bulk-domain-email-security-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "google.com", "gmail.com", "example.com" ], "dkimSelectors": [ "google", "selector1", "selector2", "default" ], "maxConcurrency": 20, "timeoutMs": 5000 }' | apify call automation-lab/bulk-domain-email-security-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=automation-lab/bulk-domain-email-security-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Bulk Domain Email Security Checker", "description": "Audit SPF, DMARC, MX, and DKIM DNS posture for bulk domain lists with scores, risk flags, and raw records.", "version": "0.1", "x-build-id": "r88MrOrmVzK8T448I" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/automation-lab~bulk-domain-email-security-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-automation-lab-bulk-domain-email-security-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/automation-lab~bulk-domain-email-security-checker/runs": { "post": { "operationId": "runs-sync-automation-lab-bulk-domain-email-security-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/automation-lab~bulk-domain-email-security-checker/run-sync": { "post": { "operationId": "run-sync-automation-lab-bulk-domain-email-security-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "domains": { "title": "Domains", "type": "array", "description": "Domain names to check. You can paste bare domains or URLs; the actor normalizes them to hostnames.", "items": { "type": "string" } }, "domainsText": { "title": "Domains text", "type": "string", "description": "Optional newline/comma/space separated domain list. Useful when pasting from a spreadsheet." }, "dkimSelectors": { "title": "DKIM selectors", "type": "array", "description": "Selectors to test at selector._domainkey.domain. Common values include google, selector1, selector2, default, k1.", "items": { "type": "string" } }, "riskOnly": { "title": "Return risky domains only", "type": "boolean", "description": "If enabled, domains with a clean score are omitted from the dataset.", "default": false }, "includeRawRecords": { "title": "Include raw DNS records", "type": "boolean", "description": "Include raw TXT and DMARC TXT records in each output row for audit trails.", "default": true }, "maxConcurrency": { "title": "Maximum concurrency", "minimum": 1, "maximum": 100, "type": "integer", "description": "Number of domains checked in parallel. Lower this for very large lists if your resolver rate-limits.", "default": 20 }, "timeoutMs": { "title": "DNS timeout per lookup (ms)", "minimum": 1000, "maximum": 30000, "type": "integer", "description": "Timeout for each DNS lookup. The actor clamps this between 1000 and 30000 ms.", "default": 5000 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```