Email Auth Check: SPF, DMARC & DKIM Anti-Spoofing

Find out if someone can spoof email from your domain. Give it domains; for each it reads the SPF, DMARC and DKIM records (and MX) over keyless DNS-over-HTTPS and composes an anti-spoofing posture with specific, actionable findings and a clear signal. Keyless, agent-callable, built to answer "is my domain protected against email spoofing, and what's missing?"

🔎 Read-only DNS. It queries public DNS over DoH — it never contacts the domain's mail servers. DKIM is probed against common selectors, so absence here isn't proof DKIM is unused. Signals for review.

⚡ Why it's useful

Email spoofing and phishing abuse domains with weak authentication. This checks the three records that stop it — SPF (who may send), DKIM (cryptographic signing), DMARC (enforcement + reporting) — and tells you exactly what's missing, in one call across every domain you own.

📋 What each report contains

Field	Meaning
signal	protected / mostly-protected--review / monitoring-only--not-enforced / spoofable--add-dmarc-enforcement / spoofable--no-email-auth / no-email-configured
spf	present, the record, the all qualifier (-all/~all/+all), lookup count, issues
dmarc	present, policy (p=none/quarantine/reject), pct, rua, issues
dkim	selectors checked and selectors with a live key
mxPresent / findings	whether email is configured, and the specific problems found

📥 Input

{ "domains": ["example.com", "your-brand.org"], "dkimSelectors": ["google", "k1"] }

Leave dkimSelectors empty to use a common default set. One report per domain.

📤 Example output (real run, trimmed)

{ "domain": "apify.com", "signal": "protected",
  "spf": { "present": true, "allQualifier": "-all" },
  "dmarc": { "present": true, "policy": "reject", "pct": "100" },
  "dkim": { "selectorsFound": ["google"] }, "mxPresent": true, "findings": [] }

In the same run example.com returned mostly-protected--review (SPF -all + DMARC reject, but no live DKIM for the common selectors), and github.com / paypal.com returned protected.

💰 Pricing (pay-per-event)

• Domain checked — $0.02 per domain.

💡 Use cases

• IT / security: confirm SPF + DMARC enforcement + DKIM across every domain you own, and catch p=none.
• Deliverability / marketing: weak auth sends your mail to spam — this pinpoints the gap.
• Agencies / MSPs / M&A due diligence: audit a whole portfolio's email security fast.
• Agents: callable as an MCP tool — give it domains, get back an anti-spoofing posture.

🔑 Keyless & agent-callable

No API keys, no accounts, no paid child Actors — just public DNS over DoH.

🚀 Ready-made tasks (one click)

• DMARC Checker - Policy, Reporting & Enforcement

🤖 For AI agents (MCP)

https://mcp.apify.com/?tools=actors,docs,centorprat/email-auth-dmarc-spf-check

Loads as centorprat--email-auth-dmarc-spf-check. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/email-auth-dmarc-spf-check