Email Security Grader - SPF, DMARC, DKIM, MTA-STS (Bulk) avatar

Email Security Grader - SPF, DMARC, DKIM, MTA-STS (Bulk)

Pricing

Pay per event + usage

Go to Apify Store
Email Security Grader - SPF, DMARC, DKIM, MTA-STS (Bulk)

Email Security Grader - SPF, DMARC, DKIM, MTA-STS (Bulk)

Grade any domain A-F on email security: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI, with a spoofable flag and the exact fixes. Bulk and cheap: leads for MSPs and security teams.

Pricing

Pay per event + usage

Rating

0.0

(0)

Developer

Musedenny

Musedenny

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

2 days ago

Last modified

Categories

Security

Limited permissions

Share

Email Security Grader – SPF, DMARC, DKIM, MTA-STS (Bulk)

Grade any domain A–F on email security from its public DNS, in bulk. Each result says whether the domain is spoofable (anyone can send email as it), lists every issue, and gives the exact fix. MSPs, security consultants and email deliverability agencies use it to find prospects and to report on clients.

Checks

CheckWhat's graded
SPFPresent, only one record, ends in -all/~all (not +all/?all), within the 10-DNS-lookup limit (includes followed)
DMARCPresent, policy none / quarantine / reject, pct, reports (rua)
DKIMKeys on 27 common selectors (Google, Microsoft, SendGrid, Mailchimp, Zendesk, HubSpot…). Wildcard DNS is detected so results aren't faked
MTA-STSRecord plus the live policy file (mode: enforce)
TLS-RPT, BIMIPresent

Domains that send no email (null MX, v=spf1 -all) are graded on lock-down, not on DKIM.

Input

FieldDefaultMeaning
domains–Domains, URLs or email addresses
onlyGradesAtOrBelow–Lead mode: e.g. C outputs only C, D and F
onlySpoofablefalseOnly domains anyone can spoof
maxDomains10000Cap per run

Output

{
"domain": "weak.com", "grade": "F", "score": 30, "spoofable": true,
"issues": ["Multiple SPF records (invalid)", "SPF allows everyone (+all)", "No DMARC record", "…"],
"fixes": ["Merge the SPF records into one…", "End the SPF record with -all…", "Publish \"v=DMARC1; p=none; rua=mailto:dmarc@weak.com\" at _dmarc.weak.com…"],
"spf": {"record": "v=spf1 +all", "count": 2, "all": "+all", "lookups": 0},
"dmarc": {"record": null, "policy": null, "pct": null, "reports": false},
"dkim": {"selectorsFound": [], "selectorsChecked": 27, "wildcardDns": false},
"mtaSts": {"record": false, "mode": null}, "tlsRpt": false, "bimi": false, "hasMx": true, "mx": ["mx.weak.com"]
}

Pricing (pay per event)

$0.001 per run and $0.0015 per domain: 1,000 domains for $1.50.

DNS-over-HTTPS lookups (Cloudflare, Google fallback). No email is sent, and the mail servers are never contacted.