DMARC Record Checker

Send domains, get each one's DMARC record parsed into policy, subdomain policy, percentage and report addresses, with a grade and the issues found.

You give it	You get back	You pay (Free plan)
One domain or a list of up to 50	Per domain: has DMARC, policy, sp, pct, rua/ruf, raw record, grade, issues	$0.0008 per domain

Pay per result only: no subscription, no start fee. An invalid domain or DNS timeout returns {ok:false, error} and is not charged. Paid Apify plans get Store discounts on the price above.

Try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "domain": "google.com",
  "domains": [
    "github.com",
    "paypal.com"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "domain": "github.com",
    "ok": true,
    "hasDmarc": true,
    "policy": "quarantine",
    "subdomainPolicy": "reject",
    "pct": 100,
    "reports": {
      "rua": "mailto:dmarc@github.com",
      "ruf": "mailto:dmarc@github.com"
    },
    "adkim": null,
    "aspf": null,
    "fo": "1",
    "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
    "grade": "enforced",
    "issues": [
      "p=quarantine — suspicious mail quarantined; consider p=reject for full enforcement"
    ]
  }
]

Find out in seconds whether a domain is actually protected against email spoofing — or just pretending to be. Check one domain or up to 200 per run, online, by API, or as an agent tool via Apify MCP.

This actor looks up the _dmarc TXT record for any domain, parses every DMARC tag, grades the policy (monitoring-only vs. enforced), and flags the weak configurations that leave a brand open to phishing. Useful for lead generation (find prospects with no/weak DMARC), security audits, cold-email domain warmup checks, and deliverability troubleshooting.

What you get

• hasDmarc — is a valid v=DMARC1 record published at all?
• policy / subdomainPolicy — the p and sp tags (none, quarantine, reject)
• grade — enforced, monitor, missing, or invalid at a glance
• pct — what percentage of mail the policy is applied to
• reports — the rua / ruf report destinations (or null if none collected)
• adkim / aspf / fo — alignment and failure-reporting tags
• record — the raw DMARC record string, for your own parsing
• issues — plain-English flags: no record, p=none, pct<100, missing rua, unprotected subdomains
• Fail-soft: an invalid domain or a DNS timeout never fails the run — it returns {ok: false, error} and is never charged.

Input

{
  "domains": ["github.com", "paypal.com"],
  "maxDomains": 50
}

Or a single domain:

{ "domain": "google.com" }

Output (real run)

{
  "domain": "github.com",
  "ok": true,
  "hasDmarc": true,
  "policy": "quarantine",
  "subdomainPolicy": "reject",
  "pct": 100,
  "reports": { "rua": "mailto:dmarc@github.com", "ruf": "mailto:dmarc@github.com" },
  "fo": "1",
  "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
  "grade": "enforced",
  "issues": ["p=quarantine — suspicious mail quarantined; consider p=reject for full enforcement"]
}

A domain with no DMARC comes back as hasDmarc: false, grade: "missing" — exactly the prospects worth a sales call.

Pricing

$0.0008 per domain checked. No start fee. Invalid domains and DNS failures are never charged.

Measured against store incumbents (2026-08-07): andok/dmarc-spf-dkim-validator charges $0.001 per item, taroyamada/dns-dmarc-security-checker $0.001 start + $0.007 per item, nexgendata/email-dmarc-auditor $0.01 start + $0.05 per domain. A 100-domain audit here costs $0.08.

Honest limits

• DNS-only: this reads and grades the published DMARC record. It does not send test emails or analyze DMARC aggregate reports.
• Verdicts reflect DNS at run time from Apify's infrastructure; a record behind split-horizon DNS may differ from what your resolver sees.
• ESERVFAIL/ENOTFOUND are reported as grade: "missing" — for a domain that does not exist at all, "no DMARC" is still the accurate answer for spoofing exposure.

FAQ

What does grade "monitor" mean? The domain publishes p=none — DMARC is collecting data but not blocking anything. Spoofed mail is still delivered. It is the most common half-configured state.

Does p=quarantine count as protected? Yes — grade is enforced for both quarantine and reject, but the issues list will suggest moving to reject for full enforcement.

Can I check subdomains like mail.example.com? Yes. DMARC lookup happens at _dmarc.<exactly what you pass>. Note that org-domain fallback (checking example.com's policy when mail.example.com has none) is NOT applied — you see exactly what is published at that name.

How many domains per run? Up to 200 (maxDomains). Duplicates are de-duplicated, URLs are cleaned to bare domains automatically.

Why did some rows come back ok: false? Those inputs were not valid domains or their DNS query failed transiently. They are recorded for completeness and never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~dmarc-record-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"domains": ["yourdomain.com", "competitor.com"]}'

Agents: connect Apify MCP and call the EliAI/dmarc-record-checker tool.

• Capability: fetch and grade the DMARC policy of one or many domains, returned as JSON
• Required input: domain (string) or domains (array)
• Returns: one JSON record per domain; grade + issues summarize the verdict
• Bounded: maxDomains caps the run; failures isolate per domain
• Side effects: none

Who uses it

• Email security consultants finding client domains stuck on p=none monitoring
• Cold-email agencies checking a new sending domain has DMARC before warmup
• MSP sales teams listing prospect domains with no DMARC as a conversation starter
• IT admins confirming a DMARC policy change published correctly
• Brand protection teams auditing every domain the company owns for spoofing exposure

Changelog

• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.