# Bulk Email Deliverability Checker - SPF, DKIM, DMARC, MX (`codeblix/email-deliverability-checker`) Actor Audit thousands of domains for email authentication, DNS issues, and deliverability risk. Checks SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT, BIMI. No login, no proxy, no API keys needed. - **URL**: https://apify.com/codeblix/email-deliverability-checker.md - **Developed by:** [Jayesh Choolun](https://apify.com/codeblix) (community) - **Categories:** Developer tools, SEO tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Bulk Email Deliverability Checker — SPF, DKIM, DMARC, MX > Audit thousands of domains for email authentication, DNS security, and deliverability risk. Check SPF, DKIM, DMARC, MX records, DNSSEC, MTA-STS, TLS-RPT, and BIMI in bulk. No proxy, no login, no API keys required — pure DNS queries. ### Why email deliverability matters Email authentication failures cost businesses real money. Domains without SPF, DKIM, and DMARC are vulnerable to spoofing, phishing, and spam filtering. Cold emails from unauthenticated domains land in spam. Google and Yahoo now **require** DMARC for bulk senders (2024 enforcement). This actor lets you audit any domain portfolio in seconds. ### What it checks | Check | Description | |-------|-------------| | **MX records** | Mail exchange records + email provider detection (Google Workspace, Microsoft 365, Zoho, SendGrid, Mailgun, ProtonMail, and 15+ others) | | **SPF** | Sender Policy Framework validation — single record check, `all` mechanism, DNS lookup count (RFC 7208 limit), `+all` danger detection | | **DKIM** | DomainKeys Identified Mail public key probing across 14+ common selectors (google, default, selector1, selector2, k1, sendgrid, mailgun, etc.) | | **DMARC** | Domain-based Message Authentication parsing — policy (none/quarantine/reject), subdomain policy, percentage, rua/ruf report destinations | | **DNSSEC** | DNS Security Extensions — zone signing check via DO-flag UDP query (fast, no DNSKEY round-trip) | | **MTA-STS** | SMTP MTA Strict Transport Security — TXT record + HTTPS policy file validation | | **TLS-RPT** | TLS Reporting — failure report destination at `_smtp._tls` | | **BIMI** | Brand Indicators for Message Identification — logo authentication record | | **Security headers** | Optional: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy | ### Output Each domain produces a dataset item with: - `domain` — the domain name - `score` — 0-100 deliverability score - `grade` — letter grade (A through F) - `emailProvider` — detected email provider (Google Workspace, Microsoft 365, Zoho, etc.) - `spfValid` — boolean - `dmarcPolicy` — none / quarantine / reject - `dkimPresent` — boolean - `dkimSelectorsFound` — list of selectors with public keys - `dnssecEnabled` — boolean - `mtaStsPresent` — boolean - `tlsRptPresent` — boolean - `bimiPresent` — boolean - `criticalIssues` — list of critical problems - `warnings` — list of non-critical issues - `recommendations` — actionable fix suggestions - `issuesCount` — total issue count - Full nested details under `mx`, `spf`, `dmarc`, `dkim`, `dnssec`, `mtaSts`, `tlsRpt`, `bimi` A `SUMMARY` key-value store entry contains aggregate stats: total domains, average score, grade distribution, throughput. #### Example output ```json { "domain": "cloudflare.com", "score": 92, "grade": "A", "emailProvider": "Other / Unknown", "spfValid": true, "dmarcPolicy": "reject", "dkimPresent": true, "dkimSelectorsFound": ["k1", "mandrill", "s1"], "dnssecEnabled": true, "mtaStsPresent": false, "tlsRptPresent": false, "bimiPresent": true, "criticalIssues": [], "warnings": ["MTA-STS not configured."], "recommendations": ["Configure MTA-STS to enforce TLS for inbound SMTP."], "issuesCount": 1 } ```` ### Scoring | Component | Points | |-----------|--------| | MX records present | 15 | | SPF present + valid | 25 | | DMARC present + enforced | 25 | | DKIM present | 15 | | DNSSEC enabled | 10 | | MTA-STS configured | 5 | | TLS-RPT configured | 3 (bonus) | | BIMI configured | 2 (bonus) | | **Maximum** | **100** | Grades: A (90+), B (80-89), C (70-79), D (60-69), E (40-59), F (<40) ### Input | Field | Type | Required | Default | Description | |-------|------|----------|---------|-------------| | `domains` | array\[string] | One of `domains`/`domainsText` | — | List of domains to check | | `domainsText` | string | One of `domains`/`domainsText` | — | Newline or comma-separated domains for bulk paste (10,000+) | | `dkimSelectors` | array\[string] | No | 14 common selectors | DKIM selector names to probe | | `checkDNSSEC` | boolean | No | true | Check DNSSEC | | `checkMTASTS` | boolean | No | true | Check MTA-STS + TLS-RPT | | `checkBIMI` | boolean | No | true | Check BIMI | | `checkSecurityHeaders` | boolean | No | false | Check HTTPS security headers | | `timeout` | integer | No | 10 | DNS query timeout (seconds) | | `concurrency` | integer | No | 10 | Concurrent domain checks (1-100) | | `dnsResolver` | string | No | system default | Custom DNS resolver IP (e.g. 1.1.1.1) | ### Use cases - **Cold email agencies**: Audit client domains before outreach campaigns — ensure SPF, DKIM, and DMARC are configured so emails land in inbox, not spam - **SEO agencies**: Add email deliverability auditing to client reports as a value-add service - **Lead generation teams**: Filter prospect domains by deliverability score — skip domains that can't receive email - **Security teams**: Bulk-check domain portfolios for spoofing risk and DMARC enforcement gaps - **Domain investors**: Assess domain email infrastructure quality before purchase - **SaaS operations**: Monitor your own domain's email authentication posture over time - **Compliance audits**: Verify Google/Yahoo 2024 bulk sender requirements across all sending domains - **MSPs**: Audit all client domains as part of onboarding security checks ### Performance - \~0.1s per domain (all DNS checks run in parallel per domain) - \~6-25 domains/second depending on concurrency - No proxy needed — pure DNS queries - No API keys needed - No login required - Scales to 10,000+ domains per run - Python 3.12, Apify SDK 3.x, dnspython 2.x ### Pricing Pay-per-event: **$0.001 per domain checked**. You only pay for results delivered. No subscription, no minimum. Check 1 domain for $0.001 or 10,000 domains for $10. ### How it works 1. Provide a list of domains (via `domains` array or paste into `domainsText`) 2. The actor queries DNS records for each domain in parallel 3. For each domain, it checks MX, SPF, DMARC, DKIM (14 selectors), DNSSEC, MTA-STS, TLS-RPT, and BIMI 4. Results are scored 0-100 with letter grades and actionable recommendations 5. All results are pushed to the Apify dataset as structured JSON 6. A summary with aggregate stats is saved to the key-value store ### Categories SEO tools, Business, Lead generation, Developer tools # Actor input Schema ## `domains` (type: `array`): List of domain names to audit (e.g. example.com, google.com). Either this or 'domainsText' must be provided. ## `domainsText` (type: `string`): Alternative to 'domains': paste a large list of domains, one per line or comma-separated. Useful for bulk uploads of 10,000+ domains. ## `dkimSelectors` (type: `array`): DKIM selector names to check for DKIM public keys. The actor will query .\_domainkey. for each. Defaults cover Google, Microsoft, SendGrid, Mailgun, Zoho, and others. ## `checkDNSSEC` (type: `boolean`): Query DNSSEC status for each domain. Adds a small amount of time per domain. ## `checkMTASTS` (type: `boolean`): Fetch and validate MTA-STS policy (\_mta-sts TXT + HTTPS policy file) and TLS-RPT (\_smtp.\_tls TXT). Adds 1-2 HTTP requests per domain. ## `checkBIMI` (type: `boolean`): Check for BIMI (Brand Indicators for Message Identification) record at default.\_bimi.. ## `checkSecurityHeaders` (type: `boolean`): Fetch the domain over HTTPS and inspect security headers (HSTS, CSP, X-Frame-Options, etc.). Adds 1 HTTP request per domain. ## `timeout` (type: `integer`): Timeout for each DNS query in seconds. Increase for slow resolvers. ## `concurrency` (type: `integer`): Number of domains to check in parallel. Higher = faster but may hit local resolver rate limits. ## `dnsResolver` (type: `string`): IP address of a DNS resolver to use instead of the system default (e.g. 1.1.1.1 for Cloudflare, 8.8.8.8 for Google). Leave empty to use system default. ## Actor input object example ```json { "domains": [ "google.com", "github.com" ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "k1", "mail", "smtp", "sendgrid", "mandrill", "mailgun", "zoho", "dkim", "s1", "selector" ], "checkDNSSEC": true, "checkMTASTS": true, "checkBIMI": true, "checkSecurityHeaders": false, "timeout": 10, "concurrency": 10, "dnsResolver": "" } ``` # Actor output Schema ## `dataset` (type: `string`): Dataset containing one item per domain with deliverability score, grade, and full check details ## `summary` (type: `string`): Key-value store entry with aggregate stats (total domains, average score, grade distribution) # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "google.com", "github.com" ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "k1", "mail", "smtp", "sendgrid", "mandrill", "mailgun", "zoho", "dkim", "s1", "selector" ], "checkDNSSEC": true, "checkMTASTS": true, "checkBIMI": true, "timeout": 10, "concurrency": 10 }; // Run the Actor and wait for it to finish const run = await client.actor("codeblix/email-deliverability-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "google.com", "github.com", ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "k1", "mail", "smtp", "sendgrid", "mandrill", "mailgun", "zoho", "dkim", "s1", "selector", ], "checkDNSSEC": True, "checkMTASTS": True, "checkBIMI": True, "timeout": 10, "concurrency": 10, } # Run the Actor and wait for it to finish run = client.actor("codeblix/email-deliverability-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "google.com", "github.com" ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "k1", "mail", "smtp", "sendgrid", "mandrill", "mailgun", "zoho", "dkim", "s1", "selector" ], "checkDNSSEC": true, "checkMTASTS": true, "checkBIMI": true, "timeout": 10, "concurrency": 10 }' | apify call codeblix/email-deliverability-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=codeblix/email-deliverability-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Bulk Email Deliverability Checker - SPF, DKIM, DMARC, MX", "description": "Audit thousands of domains for email authentication, DNS issues, and deliverability risk. Checks SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT, BIMI. No login, no proxy, no API keys needed.", "version": "0.2", "x-build-id": "WxuFOhvYvaEc09EhX" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/codeblix~email-deliverability-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-codeblix-email-deliverability-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/codeblix~email-deliverability-checker/runs": { "post": { "operationId": "runs-sync-codeblix-email-deliverability-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/codeblix~email-deliverability-checker/run-sync": { "post": { "operationId": "run-sync-codeblix-email-deliverability-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "domains": { "title": "Domains to check", "type": "array", "description": "List of domain names to audit (e.g. example.com, google.com). Either this or 'domainsText' must be provided.", "items": { "type": "string" } }, "domainsText": { "title": "Domains (one per line / comma-separated)", "type": "string", "description": "Alternative to 'domains': paste a large list of domains, one per line or comma-separated. Useful for bulk uploads of 10,000+ domains." }, "dkimSelectors": { "title": "DKIM selectors to probe", "type": "array", "description": "DKIM selector names to check for DKIM public keys. The actor will query ._domainkey. for each. Defaults cover Google, Microsoft, SendGrid, Mailgun, Zoho, and others.", "items": { "type": "string" }, "default": [ "google", "default", "selector1", "selector2", "k1", "mail", "smtp", "sendgrid", "mandrill", "mailgun", "zoho", "dkim", "s1", "selector" ] }, "checkDNSSEC": { "title": "Check DNSSEC", "type": "boolean", "description": "Query DNSSEC status for each domain. Adds a small amount of time per domain.", "default": true }, "checkMTASTS": { "title": "Check MTA-STS and TLS-RPT", "type": "boolean", "description": "Fetch and validate MTA-STS policy (_mta-sts TXT + HTTPS policy file) and TLS-RPT (_smtp._tls TXT). Adds 1-2 HTTP requests per domain.", "default": true }, "checkBIMI": { "title": "Check BIMI", "type": "boolean", "description": "Check for BIMI (Brand Indicators for Message Identification) record at default._bimi..", "default": true }, "checkSecurityHeaders": { "title": "Check HTTPS security headers", "type": "boolean", "description": "Fetch the domain over HTTPS and inspect security headers (HSTS, CSP, X-Frame-Options, etc.). Adds 1 HTTP request per domain.", "default": false }, "timeout": { "title": "DNS query timeout (seconds)", "minimum": 1, "maximum": 60, "type": "integer", "description": "Timeout for each DNS query in seconds. Increase for slow resolvers.", "default": 10 }, "concurrency": { "title": "Concurrent domain checks", "minimum": 1, "maximum": 100, "type": "integer", "description": "Number of domains to check in parallel. Higher = faster but may hit local resolver rate limits.", "default": 10 }, "dnsResolver": { "title": "Custom DNS resolver (optional)", "type": "string", "description": "IP address of a DNS resolver to use instead of the system default (e.g. 1.1.1.1 for Cloudflare, 8.8.8.8 for Google). Leave empty to use system default.", "default": "" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```