# SPF, DMARC & DKIM Checker: Bulk Email Domain DNS Audit (`datawright-labs/email-domain-dns-checker`) Actor

DMARC, SPF DKIM and MX records check for any list of domains or emails: a bulk email DNS audit with SPF 10-lookup count, DMARC policy, DKIM keys, BIMI and MTA-STS. 0-100 score, grade and plain-English fix list per domain. Callable by AI agents via MCP. $1 per 1,000 domains.

- **URL**: https://apify.com/datawright-labs/email-domain-dns-checker.md
- **Developed by:** [Datawright Labs](https://apify.com/datawright-labs) (community)
- **Categories:** Developer tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.80 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

**For AI agents:** Use when asked to check DMARC, SPF or DKIM, find why email lands in spam, or audit sending domains before outreach. Call with `domains` (domains, emails or URLs; required), optional `dkimSelectors`, `onlyProblems: true` to return only domains that need work. Returns one row per domain: `status` (ok/warning/error), `score`, `grade`, `mailProvider`, `spfAll`, `spfLookups` (10-lookup limit), `dmarcEffectivePolicy`, `dkimSelectorsFound`, `mtaStsMode`, `problems`. Cost: $0.001 per domain checked ($1 per 1,000); nonexistent domains free.

**For people:** Tell your AI agent "check DMARC, SPF and DKIM for these 50 domains and list the ones with problems" and it hands the list to this tool, then reads back a scored table with the exact record to fix. No DNS knowledge needed, and 1,000 domains cost $1.

**Check SPF, DMARC and DKIM for hundreds or thousands of domains in one run.** Paste a list of domains, email addresses or website URLs and this email domain checker reads each domain's DNS and tells you whether its mail is properly authenticated: **SPF** (with the recursive **10-DNS-lookup limit** counted for you), **DMARC policy**, **DKIM keys** on common selectors, **MX records and mail provider** (Google Workspace, Microsoft 365, Zoho, Proton and 35+ more), plus **BIMI, MTA-STS and TLS-RPT**. Every domain gets a **score from 0 to 100**, an A-F grade, a status (`ok`, `warning`, `error`) and a **plain-English list of problems** to fix.

No proxies, no API keys, no paid data sources: it uses public DNS resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8, with DNS-over-HTTPS fallback), exports to **CSV, Excel, JSON or Google Sheets**, and can run on a **schedule** so you hear about a broken SPF record before your emails land in spam.

### What does this SPF, DMARC & DKIM checker do?

- 📮 **MX records** sorted by priority, the **detected mail provider** (Google Workspace, Microsoft 365, Zoho Mail, Proton Mail, Fastmail, iCloud, Amazon SES, Mimecast, Proofpoint, Barracuda, Cloudflare Email Routing, GoDaddy, IONOS, OVH...) and **null MX** detection (domains that don't accept mail).
- 🛡️ **SPF check**: the raw record, final `all` qualifier, **DNS lookups counted recursively** through every `include:` and `redirect=` (flags more than 10 = permerror, and 9-10 as "one more include breaks it"), void lookups, multiple SPF records, `+all` / `?all`, deprecated `ptr`, broken includes, and the **sending services** detected from includes (SendGrid, Mailchimp, HubSpot, Salesforce, Zendesk, Mailgun, Amazon SES, Postmark...).
- 📜 **DMARC check**: `p=` policy, `sp=` subdomain policy, `pct=`, `rua=` / `ruf=` report addresses, alignment modes; flags a missing record, `p=none`, partial `pct`, missing reports and multiple records. Subdomains inherit the organizational domain's policy, exactly like receivers do.
- 🔑 **DKIM lookup** on 19 common selectors (`google`, `selector1`/`selector2` for Microsoft 365, `k1`-`k3` for Mailchimp, `s1`/`s2`, `default`, `mail`, `dkim`, `mandrill`, `smtp`, `pm`, `sig1`, `zendesk1`...) or your own list, with **key type and size** (1024 vs 2048-bit) and revoked keys.
- 🏷️ **BIMI** (brand logo and VMC URL), **MTA-STS** (record + policy file mode `enforce`/`testing` and `max_age`) and **TLS-RPT** report addresses.
- 🚦 **Score 0-100, grade A-F, status and problems list** per domain, plus optional recommendations. Domains that don't send mail (null MX / `v=spf1 -all`) are scored on spoofing protection only.
- 🧹 **Bulk-friendly input**: domains, emails (`jane@acme.com` -> `acme.com`) and URLs are normalized and de-duplicated; 10-50 domains are checked in parallel.

### Use cases

- **Cold email deliverability**: audit your own sending domains (and every new inbox domain) for SPF, DKIM and DMARC before a campaign, as Google and Yahoo now require for bulk senders.
- **Lead list cleaning and enrichment**: run a list of prospect emails or company domains to drop domains that don't exist or can't receive mail, and learn each company's **email provider** (Google Workspace vs Microsoft 365) and marketing stack from SPF.
- **Client audits for agencies and MSPs**: one run over every client domain, exported to Google Sheets, with a score and fix list per client.
- **Security and brand protection**: find domains (including parked ones) that can be spoofed because DMARC is missing or `p=none`.
- **DMARC rollout tracking**: schedule a weekly run and watch domains move from `p=none` to `quarantine` and `reject`.

### How to use it

1. Paste domains, emails or URLs into **Domains, emails or URLs**, one per line.
2. Optionally add your own **DKIM selectors** (e.g. the one your ESP gave you) and turn on **Only output problems** for alert-style runs.
3. Click **Start**, then open the **Overview** table or export the results. For monitoring, add a **Schedule** and an email, Slack or webhook integration in Apify Console.

#### Input example

```json
{
  "domains": ["apify.com", "jane@github.com", "https://www.example.com/contact"],
  "dkimSelectors": [],
  "onlyProblems": false
}
```

### Output example

```json
{
  "domain": "github.com",
  "status": "warning",
  "score": 80,
  "grade": "B",
  "problems": ["SPF uses 10 of 10 allowed DNS lookups (one more include breaks it)"],
  "recommendations": ["A DKIM key is 1024-bit RSA; 2048-bit is recommended", "No MTA-STS record (_mta-sts): inbound TLS is not enforced"],
  "mailProvider": "Microsoft 365",
  "mxRecords": [{ "priority": 0, "host": "github-com.mail.protection.outlook.com" }],
  "spfRecord": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com ... ~all",
  "spfAll": "~all",
  "spfLookups": 10,
  "spfSenders": ["Microsoft 365", "Zendesk", "Salesforce / Marketing Cloud", "Mailchimp", "Marketo", "SendGrid"],
  "dmarcRecord": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
  "dmarcPolicy": "quarantine",
  "dmarcSubdomainPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": ["mailto:dmarc@github.com"],
  "dkimSelectorsFound": ["google", "selector1", "k1", "s1", "s2", "k2", "k3", "zendesk1"],
  "dkim": [{ "selector": "google", "keyType": "rsa", "keyBits": 2048, "revoked": false }],
  "bimiRecord": null,
  "mtaStsRecord": null,
  "tlsRptRecord": null,
  "checkedAt": "2026-10-22T16:23:39.065Z"
}
```

Domains that don't exist come back as `status: "error"` with `domainExists: false` and the problem "Domain does not exist (NXDOMAIN)". A **SUMMARY** record in the key-value store has counts per status.

### How much does it cost to check SPF, DMARC and DKIM?

You pay **$0.001 per domain checked** ($1 per 1,000 domains), covering every check above. **Nonexistent (NXDOMAIN) and unresolvable domains are free**, and with **Only output problems** on, domains that are fully OK are skipped and **free** too. No start fee.

| Job | Domains | Cost |
|---|---|---|
| Your 10 sending domains, checked daily | ~300/month | **~$0.30/month** |
| Agency: 200 client domains, weekly | ~800/month | **~$0.80/month** |
| Clean a lead list of 25,000 company domains | 25,000 | **$25** (less for dead domains) |

- Apify's **free plan includes $5 of monthly credit**, enough for about **5,000 domains a month**.
- Paid Apify plans get automatic discounts: **Silver -10%**, **Gold and above -20%**.
- Set **Maximum cost per run** to cap spend; the Actor stops cleanly at the limit.

### Email DNS checker vs. the alternatives

| | This Actor | Free online SPF/DMARC checkers | DMARC monitoring SaaS |
|---|---|---|---|
| Bulk lists (thousands of domains) | ✅ | ❌ one at a time | by plan |
| SPF + DMARC + DKIM + MX + BIMI + MTA-STS + TLS-RPT in one row | ✅ | usually one check per page | partial |
| Recursive SPF lookup count | ✅ | some | ✅ |
| Mail provider and sending-service detection | ✅ | ❌ | ❌ |
| API, schedules, webhooks, Google Sheets | ✅ | ❌ | partial |
| Cost model | $1 per 1,000 domains, no subscription | free, manual | monthly subscription per domain |

### Use it as an API (Python, JavaScript, cURL)

#### Python

```python
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("datawright-labs/email-domain-dns-checker").call(run_input={"domains": ["example.com", "jane@acme.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["domain"], item["status"], item.get("score"), item.get("dmarcPolicy"), item.get("problems"))
```

#### JavaScript / Node.js

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('datawright-labs/email-domain-dns-checker').call({ domains: ['example.com'] });
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);
```

#### cURL

```bash
curl -X POST "https://api.apify.com/v2/acts/datawright-labs~email-domain-dns-checker/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" -d '{"domains":["example.com"],"onlyProblems":true}'
```

### Use it from your AI agent (MCP)

Your AI assistant or agent can run this Actor as a tool through [Apify's MCP server](https://docs.apify.com/platform/integrations/mcp), so it can run SPF, DMARC and DKIM checks on its own while you chat. Add this server to any MCP client that supports remote (Streamable HTTP) servers:

```json
{
  "mcpServers": {
    "datawright-email-domain-dns-checker": {
      "url": "https://mcp.apify.com?tools=datawright-labs/email-domain-dns-checker"
    }
  }
}
```

On first use your browser opens to sign in to Apify (OAuth). If your client can't do OAuth, add `"headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }` instead. The tool shows up as `datawright-labs--email-domain-dns-checker`, with the same input fields as above, and the agent reads the results with `get-dataset-items`. Then just ask, for example:

> Audit SPF, DMARC and DKIM for these 15 sending domains and list the ones that fail.

Want several Datawright tools at once? Comma-separate them: `https://mcp.apify.com?tools=datawright-labs/email-domain-dns-checker,datawright-labs/pagespeed-auditor`. Runs are billed per result, exactly like normal runs.

### FAQ

#### How do I check a domain's SPF record?

Add the domain and run the Actor. `spfRecord` is the published record, `spfAll` the final qualifier and `spfLookups` the number of DNS lookups a receiver needs (including nested includes). Anything over 10 makes SPF fail with a permerror, so it's reported as an error.

#### How do I check if DMARC is set up?

Look at `dmarcRecord` and `dmarcPolicy`. A missing record is an error; `p=none` is a warning because spoofed mail is still delivered. For subdomains, the Actor falls back to the organizational domain's record and reports the effective policy (`sp=` if set).

#### Why does it say no DKIM key was found when I use DKIM?

DKIM keys live at `<selector>._domainkey.<domain>` and DNS can't list selectors, so the Actor tries 19 common ones. If your provider uses a custom selector (you'll see it in the `DKIM-Signature: s=` header of an email you sent), add it to **DKIM selectors to try**.

#### Can I check a list of email addresses?

Yes. Emails and URLs are reduced to their domain and de-duplicated, so 5,000 addresses at 900 companies cost 900 checks. Domains that don't exist or have no MX are flagged, which helps clean a lead list before sending.

#### What's the difference between ~all and -all?

`-all` (hard fail) tells receivers to reject mail from servers not listed; `~all` (soft fail) asks them to accept but mark it. With DMARC at `quarantine` or `reject`, both are fine; `?all` and `+all` give no protection and are flagged.

#### Does it check blacklists or send test emails?

No. It only reads public DNS records (and the public MTA-STS policy file), so it's fast, cheap and never touches the domain's mail servers.

### More tools from Datawright Labs

- [SSL Certificate Checker](https://apify.com/datawright-labs/ssl-certificate-checker): bulk SSL certificate and domain expiry checks with alerts for expiring, invalid or outdated TLS.
- [Sitemap URL Extractor](https://apify.com/datawright-labs/sitemap-url-extractor): get every URL of a site from its sitemaps.
- [Bulk PageSpeed & Core Web Vitals Checker](https://apify.com/datawright-labs/pagespeed-auditor): audit PageSpeed / Lighthouse scores for many URLs.
- [Website Screenshot API](https://apify.com/datawright-labs/website-screenshot): bulk full-page screenshots and PDFs.
- [Google Autocomplete Keyword Scraper](https://apify.com/datawright-labs/autocomplete-keyword-scraper): long-tail keyword ideas from Google, YouTube and Bing.
- [Greenhouse, Lever & Ashby Jobs Scraper](https://apify.com/datawright-labs/ats-jobs-scraper): normalized job feeds from 5 ATS platforms.
- [Broken Link Checker](https://apify.com/datawright-labs/broken-link-checker): find broken links, images and redirects across a whole site.
- [App Store Top Charts & Rank Tracker](https://apify.com/datawright-labs/app-store-top-charts): daily top free/paid/grossing app rankings with rank changes.

Made by **Datawright Labs**: reliable, fairly priced web data tools. Questions or a missing feature? Open an issue on the Issues tab; we usually reply within a day.

# Actor input Schema

## `domains` (type: `array`):

One per line: bare domains (example.com), email addresses (jane@example.com) or URLs (https://www.example.com/page). Each is reduced to its domain (a leading www. is removed) and duplicates are merged.

## `dkimSelectors` (type: `array`):

DKIM keys can't be listed from DNS, so the Actor tries these selectors (<selector>.\_domainkey.<domain>). Leave empty for the built-in list of common ones: google, selector1, selector2 (Microsoft 365), default, k1-k3 (Mailchimp), s1, s2, mail, dkim, mandrill, smtp, pm (Postmark), sig1 (iCloud), zendesk1 and Google's dated selectors. Add your own selector to verify a specific key.

## `onlyProblems` (type: `boolean`):

Save only domains with status warning or error. Domains whose setup is fully OK are skipped and not charged.

## `checkMtaStsPolicy` (type: `boolean`):

When a domain publishes an \_mta-sts record, also download https://mta-sts.<domain>/.well-known/mta-sts.txt to read the mode (enforce/testing/none) and max_age.

## `resolver` (type: `string`):

How DNS queries are sent. Auto is right for almost everyone.

## `timeoutSecs` (type: `integer`):

Timeout per DNS query and for the MTA-STS policy download.

## `concurrency` (type: `integer`):

How many domains to check at the same time.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "github.com",
    "example.com"
  ],
  "onlyProblems": false,
  "checkMtaStsPolicy": true,
  "resolver": "auto",
  "timeoutSecs": 10,
  "concurrency": 10
}
```

# Actor output Schema

## `results` (type: `string`):

Per-domain email DNS audit results.

## `summary` (type: `string`):

SUMMARY record: domains checked and counts by status.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "github.com",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("datawright-labs/email-domain-dns-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "github.com",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("datawright-labs/email-domain-dns-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "github.com",
    "example.com"
  ]
}' |
apify call datawright-labs/email-domain-dns-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,datawright-labs/email-domain-dns-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/QE72qZ65b5OYg0BzH/builds/KbRhQ7CsHLJ5dq03V/openapi.json