Domain Security Auditor — DMARC, SPF, DKIM, TLS & DNS in bulk

Paste a list of domains. Get back, for each one, whether anybody on the internet can send email as that domain — plus the certificate, DNS and header problems sitting next to it. Every finding comes with the fix.

Since February 2024, Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders. Most domains still fail at least one. This actor tells you which, at whatever scale you need — one domain, or your whole prospect list.

No API keys. No account anywhere. Everything here is public DNS and a TLS handshake, read over DNS-over-HTTPS so it works from any container.

What it checks

Check	What you learn
SPF	Record, the all qualifier, and the fully expanded DNS lookup count
DKIM	Which of ~30 mainstream selectors resolve (Google, M365, Klaviyo, SendGrid, Zoho, Mimecast…)
DMARC	Policy (none/quarantine/reject), subdomain policy, pct, whether reports are collected
MX	Hosts, plus the mailbox provider inferred from them
MTA-STS	Both the TXT record and whether the policy file is actually served
TLS-RPT / BIMI	Whether reporting and brand indicators are published
TLS certificate	Issuer, expiry date, days remaining (negative when already expired)
DNSSEC / CAA	Whether answers are signed, and whether CA issuance is restricted
Security headers	HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy

The SPF lookup count is the one most tools get wrong

SPF allows a receiver ten DNS-querying mechanisms. The limit applies to the fully expanded tree, not the record you can see. Add one more SaaS sender to a record that already includes Google, HubSpot and Zendesk and you can cross it — at which point receivers return permerror and SPF stops working entirely, silently.

This actor resolves every include: and redirect= recursively (with loop protection) and reports the real number.

Example output record

{
  "domain": "example.com",
  "score": 47,
  "grade": "D",
  "dmarcPolicy": "none",
  "spfPublished": true,
  "dkimFound": true,
  "tlsDaysRemaining": 61,
  "criticalCount": 0,
  "topFinding": "SPF needs 13 DNS lookups (limit 10)",
  "checkedAt": "2026-09-03T04:11:20Z",
  "email": {
    "spf_record": "v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all",
    "spf_all": "~all",
    "spf_lookups": 13,
    "dmarc_record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com",
    "dmarc_policy": "none",
    "dmarc_rua": true,
    "dkim_selectors_found": ["google", "k1"],
    "mx_hosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com"],
    "mail_provider": "Google Workspace",
    "mta_sts": false,
    "tls_rpt": false,
    "bimi": false
  },
  "web": {
    "https_reachable": true,
    "tls_issuer": "Let's Encrypt",
    "tls_expires_at": "2026-11-03T09:14:00+00:00",
    "tls_days_remaining": 61,
    "hsts": true,
    "missing_headers": ["content-security-policy", "permissions-policy"]
  },
  "findings": [
    {
      "id": "spf-too-many-lookups",
      "severity": "high",
      "title": "SPF needs 13 DNS lookups (limit 10)",
      "detail": "Receivers stop evaluating and return permerror, so SPF effectively fails for every message.",
      "remediation": "Flatten or remove include: chains to get under ten lookups."
    },
    {
      "id": "dmarc-policy-none",
      "severity": "high",
      "title": "DMARC policy is p=none",
      "detail": "Monitoring only: spoofed mail is still delivered.",
      "remediation": "Move to p=quarantine, then p=reject, once reports look clean."
    }
  ]
}

The nine flat columns (domain, score, grade, dmarcPolicy, spfPublished, dkimFound, tlsDaysRemaining, criticalCount, topFinding) are what the Overview table and a CSV export show, so the result drops straight into a spreadsheet. The nested email, web and findings objects are there when you want the detail.

Scoring

Every domain starts at 100 and loses weight per finding — 25 for no DMARC, 20 for no SPF, 15 for an expired certificate, down to 2 for a missing CAA record. Grades: A 90+, B 80+, C 65+, D 50+, E 30+, F below. The score exists to sort a list; the findings are what you act on.

Input options

Option	Default	What it does
domains	—	The list to audit. URLs, email addresses and bare hosts all work — each is reduced to its domain and deduplicated
startUrls	—	Alternative list input for integrations that emit URLs; merged with domains
dkimSelectors	—	Extra DKIM selectors to try on top of the ~30 built in
includeWebChecks	true	Turn off for a DNS-only run: no TLS handshake, no header fetch, faster
concurrency	5	Domains audited at once (max 20)
maxItems	100	Hard cap per run, so a large paste cannot run away with cost

Use cases

• Agency prospecting. Audit a list of target companies and open with "anyone can spoof your invoices" — a p=none domain is a live risk you can prove in one line. Search terms: DMARC checker bulk, email spoofing audit.
• M&A and vendor due diligence. Score every domain a counterparty owns before you inherit their email security. Search terms: domain security audit, third party risk email.
• Your own estate. Schedule it across every domain you own and catch the certificate expiring in 14 days, or the SPF record that quietly crossed ten lookups when marketing added a new tool.

Honest limits

• DKIM cannot be enumerated. There is no DNS mechanism to list a domain's selectors — they can only be guessed. dkimFound: false means the ~30 mainstream selectors did not resolve, not that DKIM is missing. Pass your own via dkimSelectors if you know them.
• DNSSEC is read from the resolver's AD flag, which is the practical signal that the zone is signed and validated, not a full chain walk.
• The certificate is read with verification disabled, on purpose — an expired or mismatched certificate has to remain inspectable. Trust chain validity is not asserted, only issuer and expiry.
• A domain with no MX is reported as such rather than being marked down for a missing SPF record it may not need.
• Resolver failures are recorded in errors and never silently reported as a missing record.

Pricing

Pay per event: $0.01 per domain audited. A 500-domain estate audit is $5. Runs that audit nothing cost nothing beyond the platform's start fee.

Changelog

• 0.1 — first release: SPF (recursive lookup counting), DKIM selector discovery, DMARC, MX and provider detection, MTA-STS with policy fetch, TLS-RPT, BIMI, DNSSEC, CAA, TLS expiry, security headers, scoring and graded findings.