Bulk DMARC Checker & MX Checker — SPF, DKIM and Email Deliverability Audit for Any Number of Domains

Paste a list of domains (or websites, or email addresses) and get a complete email-authentication audit for each one: SPF validity and 10-DNS-lookup limit, DMARC policy and reporting, DKIM keys on 40 common selectors, MX / email provider detection, MTA-STS, TLS-RPT and BIMI — plus a 0–100 score, an A–F grade and plain-English fixes.

Perfect for cold-email and outbound teams, deliverability consultants, MSPs, agencies, security reviewers and sales teams qualifying prospects.

What you get per domain

• Email provider from MX records (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast, Fastmail, GoDaddy, Amazon SES, 25+ more) — great for B2B lead segmentation.
• SPF: record, valid/invalid, multiple-record errors, recursive DNS lookup count (permerror over 10), all qualifier, void includes, deprecated ptr.
• DMARC: policy (none / quarantine / reject), subdomain policy, pct, rua/ruf reporting addresses.
• DKIM: active selectors found, revoked keys, wildcard detection. Add your own selectors.
• MTA-STS mode (enforce / testing / none), TLS-RPT and BIMI records.
• Gmail & Yahoo bulk-sender readiness flag (SPF + DKIM + DMARC).
• Score, grade, top issue and a prioritized list of fixes.

Why this checker?

• ⚡ Fast & bulk — thousands of domains per run, de-duplicated automatically; accepts example.com, https://www.example.com/page or jane@example.com.
• 🔒 100% passive — only reads public DNS (via DNS-over-HTTPS). No emails sent, no SMTP probing, no mailbox checks.
• 💸 One flat price per domain — not per DNS query.
• 🔁 Schedule it to monitor your own domains or clients' domains and get alerted when a record breaks.

Input

{
  "domains": ["acme.com", "https://www.example.org", "sales@contoso.com"],
  "dkimSelectors": ["mycustomselector"],
  "fetchMtaStsPolicy": true
}

Output example

{
  "domain": "acme.com",
  "grade": "C",
  "score": 68,
  "mailProvider": "Google Workspace",
  "mxRecords": ["1 smtp.google.com"],
  "spfRecord": "v=spf1 include:_spf.google.com include:sendgrid.net ~all",
  "spfStatus": "valid",
  "spfLookupCount": 4,
  "spfAll": "~all (softfail)",
  "dmarcRecord": "v=DMARC1; p=none",
  "dmarcPolicy": "none",
  "dmarcRua": null,
  "dkimSelectorsFound": ["google", "s1"],
  "mtaStsMode": null,
  "tlsRpt": null,
  "bimi": null,
  "gmailYahooBulkSenderReady": true,
  "topIssue": "DMARC policy is p=none (monitoring only)",
  "issues": [
    { "severity": "medium", "issue": "DMARC policy is p=none (monitoring only)", "recommendation": "Move to p=quarantine, then p=reject, after reviewing reports." },
    { "severity": "low", "issue": "DMARC has no rua reporting address", "recommendation": "Add rua=mailto:... to receive aggregate reports." }
  ]
}

Use it as a bulk DMARC checker or MX checker

• DMARC checker: dmarcPolicy (none / quarantine / reject), subdomain policy, pct and rua/ruf reporting addresses for every domain in your list. Filter on dmarcPolicy to find domains that can still be spoofed.
• MX checker / MX record lookup: the MX hosts and the detected email provider (mailProvider, e.g. Google Workspace or Microsoft 365) for every domain, which is useful for B2B lead segmentation or migration planning.

Scoring

MX 10 · SPF 25 · DMARC 40 (policy + reporting) · DKIM 15 · MTA-STS/TLS-RPT/BIMI 10. A ≥ 90, B ≥ 80, C ≥ 65, D ≥ 50, F < 50. Domains that correctly lock down a non-mail domain (null MX + -all + p=reject) score A.

Pricing

$2.00 per 1,000 domains (pay-per-event, domain-audited). Every check above is included.

What will it cost?

Domains	Cost
3 domains (the pre-filled form)	$0.006
1,000 domains	$2.00
10,000 domains	$20.00
100,000 domains	$200.00

Duplicate domains are removed before auditing, so you pay once per unique domain. Each run also has a $0.00005 start fee (one per GB of memory; the default memory needs one), which is too small to change these numbers. You pay only for these events: no rental fee and no separate compute charge. Set a maximum cost per run in the run options (or maxTotalChargeUsd in the API) and the Actor stops cleanly when it reaches it.

Use it via API, code or AI agents

Everything in the Console also works over the API, so you can run it from code, a scheduler or an AI agent. Replace <YOUR_APIFY_TOKEN> with your token from Apify Console → Settings → API & Integrations.

REST: run and get the results in one call (waits up to 5 minutes; maxTotalChargeUsd caps what the run can cost):

curl -X POST "https://api.apify.com/v2/acts/batreek~email-deliverability-auditor/run-sync-get-dataset-items?maxTotalChargeUsd=1" \
  -H "Authorization: Bearer <YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com", "github.com"]}'

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("batreek/email-deliverability-auditor").call(run_input={
    "domains": [
        "example.com",
        "github.com"
    ]
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / Node.js (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('batreek/email-deliverability-auditor').call({"domains": ["example.com", "github.com"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

AI agents (MCP): add this Actor as a tool in Claude, ChatGPT, Cursor or any MCP client through Apify's hosted MCP server at https://mcp.apify.com?tools=batreek/email-deliverability-auditor. The agent can then check SPF, DKIM, DMARC and MX records for any list of domains and read the structured results. Runs are billed to your Apify account like any other run.

No-code: use Apify's integrations (Zapier, Make, n8n, Google Sheets, Slack, webhooks) or put it on an Apify Schedule.

FAQ

Why does DKIM say "not found" for a domain that signs mail? DKIM keys can't be listed; they must be guessed by selector name. We try 40 common selectors. Some providers use rotating/custom selectors (Google often uses dated ones). Add yours in Extra DKIM selectors. Is this legal? Yes — DNS records are public by design. The Actor never contacts mail servers. Does it verify email addresses? No. It audits the domain's configuration, not individual mailboxes.