SPF, DMARC & DKIM Checker: Bulk Email Domain DNS Audit

For AI agents: Use when asked to check DMARC, SPF or DKIM, find why email lands in spam, or audit sending domains before outreach. Call with domains (domains, emails or URLs; required), optional dkimSelectors, onlyProblems: true to return only domains that need work. Returns one row per domain: status (ok/warning/error), score, grade, mailProvider, spfAll, spfLookups (10-lookup limit), dmarcEffectivePolicy, dkimSelectorsFound, mtaStsMode, problems. Cost: $0.001 per domain checked ($1 per 1,000); nonexistent domains free.

For people: Tell your AI agent "check DMARC, SPF and DKIM for these 50 domains and list the ones with problems" and it hands the list to this tool, then reads back a scored table with the exact record to fix. No DNS knowledge needed, and 1,000 domains cost $1.

Check SPF, DMARC and DKIM for hundreds or thousands of domains in one run. Paste a list of domains, email addresses or website URLs and this email domain checker reads each domain's DNS and tells you whether its mail is properly authenticated: SPF (with the recursive 10-DNS-lookup limit counted for you), DMARC policy, DKIM keys on common selectors, MX records and mail provider (Google Workspace, Microsoft 365, Zoho, Proton and 35+ more), plus BIMI, MTA-STS and TLS-RPT. Every domain gets a score from 0 to 100, an A-F grade, a status (ok, warning, error) and a plain-English list of problems to fix.

No proxies, no API keys, no paid data sources: it uses public DNS resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8, with DNS-over-HTTPS fallback), exports to CSV, Excel, JSON or Google Sheets, and can run on a schedule so you hear about a broken SPF record before your emails land in spam.

What does this SPF, DMARC & DKIM checker do?

• 📮 MX records sorted by priority, the detected mail provider (Google Workspace, Microsoft 365, Zoho Mail, Proton Mail, Fastmail, iCloud, Amazon SES, Mimecast, Proofpoint, Barracuda, Cloudflare Email Routing, GoDaddy, IONOS, OVH...) and null MX detection (domains that don't accept mail).
• 🛡️ SPF check: the raw record, final all qualifier, DNS lookups counted recursively through every include: and redirect= (flags more than 10 = permerror, and 9-10 as "one more include breaks it"), void lookups, multiple SPF records, +all / ?all, deprecated ptr, broken includes, and the sending services detected from includes (SendGrid, Mailchimp, HubSpot, Salesforce, Zendesk, Mailgun, Amazon SES, Postmark...).
• 📜 DMARC check: p= policy, sp= subdomain policy, pct=, rua= / ruf= report addresses, alignment modes; flags a missing record, p=none, partial pct, missing reports and multiple records. Subdomains inherit the organizational domain's policy, exactly like receivers do.
• 🔑 DKIM lookup on 19 common selectors (google, selector1/selector2 for Microsoft 365, k1-k3 for Mailchimp, s1/s2, default, mail, dkim, mandrill, smtp, pm, sig1, zendesk1...) or your own list, with key type and size (1024 vs 2048-bit) and revoked keys.
• 🏷️ BIMI (brand logo and VMC URL), MTA-STS (record + policy file mode enforce/testing and max_age) and TLS-RPT report addresses.
• 🚦 Score 0-100, grade A-F, status and problems list per domain, plus optional recommendations. Domains that don't send mail (null MX / v=spf1 -all) are scored on spoofing protection only.
• 🧹 Bulk-friendly input: domains, emails (jane@acme.com -> acme.com) and URLs are normalized and de-duplicated; 10-50 domains are checked in parallel.

Use cases

• Cold email deliverability: audit your own sending domains (and every new inbox domain) for SPF, DKIM and DMARC before a campaign, as Google and Yahoo now require for bulk senders.
• Lead list cleaning and enrichment: run a list of prospect emails or company domains to drop domains that don't exist or can't receive mail, and learn each company's email provider (Google Workspace vs Microsoft 365) and marketing stack from SPF.
• Client audits for agencies and MSPs: one run over every client domain, exported to Google Sheets, with a score and fix list per client.
• Security and brand protection: find domains (including parked ones) that can be spoofed because DMARC is missing or p=none.
• DMARC rollout tracking: schedule a weekly run and watch domains move from p=none to quarantine and reject.

How to use it

1. Paste domains, emails or URLs into Domains, emails or URLs, one per line.
2. Optionally add your own DKIM selectors (e.g. the one your ESP gave you) and turn on Only output problems for alert-style runs.
3. Click Start, then open the Overview table or export the results. For monitoring, add a Schedule and an email, Slack or webhook integration in Apify Console.

Input example

{
  "domains": ["apify.com", "jane@github.com", "https://www.example.com/contact"],
  "dkimSelectors": [],
  "onlyProblems": false
}

Output example

{
  "domain": "github.com",
  "status": "warning",
  "score": 80,
  "grade": "B",
  "problems": ["SPF uses 10 of 10 allowed DNS lookups (one more include breaks it)"],
  "recommendations": ["A DKIM key is 1024-bit RSA; 2048-bit is recommended", "No MTA-STS record (_mta-sts): inbound TLS is not enforced"],
  "mailProvider": "Microsoft 365",
  "mxRecords": [{ "priority": 0, "host": "github-com.mail.protection.outlook.com" }],
  "spfRecord": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com ... ~all",
  "spfAll": "~all",
  "spfLookups": 10,
  "spfSenders": ["Microsoft 365", "Zendesk", "Salesforce / Marketing Cloud", "Mailchimp", "Marketo", "SendGrid"],
  "dmarcRecord": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
  "dmarcPolicy": "quarantine",
  "dmarcSubdomainPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": ["mailto:dmarc@github.com"],
  "dkimSelectorsFound": ["google", "selector1", "k1", "s1", "s2", "k2", "k3", "zendesk1"],
  "dkim": [{ "selector": "google", "keyType": "rsa", "keyBits": 2048, "revoked": false }],
  "bimiRecord": null,
  "mtaStsRecord": null,
  "tlsRptRecord": null,
  "checkedAt": "2026-10-22T16:23:39.065Z"
}

Domains that don't exist come back as status: "error" with domainExists: false and the problem "Domain does not exist (NXDOMAIN)". A SUMMARY record in the key-value store has counts per status.

How much does it cost to check SPF, DMARC and DKIM?

You pay $0.001 per domain checked ($1 per 1,000 domains), covering every check above. Nonexistent (NXDOMAIN) and unresolvable domains are free, and with Only output problems on, domains that are fully OK are skipped and free too. No start fee.

Job	Domains	Cost
Your 10 sending domains, checked daily	~300/month	~$0.30/month
Agency: 200 client domains, weekly	~800/month	~$0.80/month
Clean a lead list of 25,000 company domains	25,000	$25 (less for dead domains)

• Apify's free plan includes $5 of monthly credit, enough for about 5,000 domains a month.
• Paid Apify plans get automatic discounts: Silver -10%, Gold and above -20%.
• Set Maximum cost per run to cap spend; the Actor stops cleanly at the limit.

Email DNS checker vs. the alternatives

	This Actor	Free online SPF/DMARC checkers	DMARC monitoring SaaS
Bulk lists (thousands of domains)	✅	❌ one at a time	by plan
SPF + DMARC + DKIM + MX + BIMI + MTA-STS + TLS-RPT in one row	✅	usually one check per page	partial
Recursive SPF lookup count	✅	some	✅
Mail provider and sending-service detection	✅	❌	❌
API, schedules, webhooks, Google Sheets	✅	❌	partial
Cost model	$1 per 1,000 domains, no subscription	free, manual	monthly subscription per domain

Use it as an API (Python, JavaScript, cURL)

Python

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("datawright-labs/email-domain-dns-checker").call(run_input={"domains": ["example.com", "jane@acme.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["domain"], item["status"], item.get("score"), item.get("dmarcPolicy"), item.get("problems"))

JavaScript / Node.js

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('datawright-labs/email-domain-dns-checker').call({ domains: ['example.com'] });
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

cURL

curl -X POST "https://api.apify.com/v2/acts/datawright-labs~email-domain-dns-checker/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" -d '{"domains":["example.com"],"onlyProblems":true}'

Use it from your AI agent (MCP)

Your AI assistant or agent can run this Actor as a tool through Apify's MCP server, so it can run SPF, DMARC and DKIM checks on its own while you chat. Add this server to any MCP client that supports remote (Streamable HTTP) servers:

{
  "mcpServers": {
    "datawright-email-domain-dns-checker": {
      "url": "https://mcp.apify.com?tools=datawright-labs/email-domain-dns-checker"
    }
  }
}

On first use your browser opens to sign in to Apify (OAuth). If your client can't do OAuth, add "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" } instead. The tool shows up as datawright-labs--email-domain-dns-checker, with the same input fields as above, and the agent reads the results with get-dataset-items. Then just ask, for example:

Audit SPF, DMARC and DKIM for these 15 sending domains and list the ones that fail.

Want several Datawright tools at once? Comma-separate them: https://mcp.apify.com?tools=datawright-labs/email-domain-dns-checker,datawright-labs/pagespeed-auditor. Runs are billed per result, exactly like normal runs.

FAQ

How do I check a domain's SPF record?

Add the domain and run the Actor. spfRecord is the published record, spfAll the final qualifier and spfLookups the number of DNS lookups a receiver needs (including nested includes). Anything over 10 makes SPF fail with a permerror, so it's reported as an error.

How do I check if DMARC is set up?

Look at dmarcRecord and dmarcPolicy. A missing record is an error; p=none is a warning because spoofed mail is still delivered. For subdomains, the Actor falls back to the organizational domain's record and reports the effective policy (sp= if set).

Why does it say no DKIM key was found when I use DKIM?

DKIM keys live at <selector>._domainkey.<domain> and DNS can't list selectors, so the Actor tries 19 common ones. If your provider uses a custom selector (you'll see it in the DKIM-Signature: s= header of an email you sent), add it to DKIM selectors to try.

Can I check a list of email addresses?

Yes. Emails and URLs are reduced to their domain and de-duplicated, so 5,000 addresses at 900 companies cost 900 checks. Domains that don't exist or have no MX are flagged, which helps clean a lead list before sending.

What's the difference between ~all and -all?

-all (hard fail) tells receivers to reject mail from servers not listed; ~all (soft fail) asks them to accept but mark it. With DMARC at quarantine or reject, both are fine; ?all and +all give no protection and are flagged.

Does it check blacklists or send test emails?

No. It only reads public DNS records (and the public MTA-STS policy file), so it's fast, cheap and never touches the domain's mail servers.

More tools from Datawright Labs

• SSL Certificate Checker: bulk SSL certificate and domain expiry checks with alerts for expiring, invalid or outdated TLS.
• Sitemap URL Extractor: get every URL of a site from its sitemaps.
• Bulk PageSpeed & Core Web Vitals Checker: audit PageSpeed / Lighthouse scores for many URLs.
• Website Screenshot API: bulk full-page screenshots and PDFs.
• Google Autocomplete Keyword Scraper: long-tail keyword ideas from Google, YouTube and Bing.
• Greenhouse, Lever & Ashby Jobs Scraper: normalized job feeds from 5 ATS platforms.
• Broken Link Checker: find broken links, images and redirects across a whole site.
• App Store Top Charts & Rank Tracker: daily top free/paid/grossing app rankings with rank changes.

Made by Datawright Labs: reliable, fairly priced web data tools. Questions or a missing feature? Open an issue on the Issues tab; we usually reply within a day.