DMARC Record Checker

Find out in seconds whether a domain is actually protected against email spoofing — or just pretending to be. Check one domain or up to 200 per run, online, by API, or as an agent tool via Apify MCP.

This actor looks up the _dmarc TXT record for any domain, parses every DMARC tag, grades the policy (monitoring-only vs. enforced), and flags the weak configurations that leave a brand open to phishing. Useful for lead generation (find prospects with no/weak DMARC), security audits, cold-email domain warmup checks, and deliverability troubleshooting.

What you get

• hasDmarc — is a valid v=DMARC1 record published at all?
• policy / subdomainPolicy — the p and sp tags (none, quarantine, reject)
• grade — enforced, monitor, missing, or invalid at a glance
• pct — what percentage of mail the policy is applied to
• reports — the rua / ruf report destinations (or null if none collected)
• adkim / aspf / fo — alignment and failure-reporting tags
• record — the raw DMARC record string, for your own parsing
• issues — plain-English flags: no record, p=none, pct<100, missing rua, unprotected subdomains
• Fail-soft: an invalid domain or a DNS timeout never fails the run — it returns {ok: false, error} and is never charged.

Input

{
  "domains": ["github.com", "paypal.com"],
  "maxDomains": 50
}

Or a single domain:

{ "domain": "google.com" }

Output (real run)

{
  "domain": "github.com",
  "ok": true,
  "hasDmarc": true,
  "policy": "quarantine",
  "subdomainPolicy": "reject",
  "pct": 100,
  "reports": { "rua": "mailto:dmarc@github.com", "ruf": "mailto:dmarc@github.com" },
  "fo": "1",
  "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
  "grade": "enforced",
  "issues": ["p=quarantine — suspicious mail quarantined; consider p=reject for full enforcement"]
}

A domain with no DMARC comes back as hasDmarc: false, grade: "missing" — exactly the prospects worth a sales call.

Pricing

$0.0008 per domain checked. No start fee. Invalid domains and DNS failures are never charged.

Measured against store incumbents (2026-08-07): andok/dmarc-spf-dkim-validator charges $0.001 per item, taroyamada/dns-dmarc-security-checker $0.001 start + $0.007 per item, nexgendata/email-dmarc-auditor $0.01 start + $0.05 per domain. A 100-domain audit here costs $0.08.

Honest limits

• DNS-only: this reads and grades the published DMARC record. It does not send test emails or analyze DMARC aggregate reports.
• Verdicts reflect DNS at run time from Apify's infrastructure; a record behind split-horizon DNS may differ from what your resolver sees.
• ESERVFAIL/ENOTFOUND are reported as grade: "missing" — for a domain that does not exist at all, "no DMARC" is still the accurate answer for spoofing exposure.

FAQ

What does grade "monitor" mean? The domain publishes p=none — DMARC is collecting data but not blocking anything. Spoofed mail is still delivered. It is the most common half-configured state.

Does p=quarantine count as protected? Yes — grade is enforced for both quarantine and reject, but the issues list will suggest moving to reject for full enforcement.

Can I check subdomains like mail.example.com? Yes. DMARC lookup happens at _dmarc.<exactly what you pass>. Note that org-domain fallback (checking example.com's policy when mail.example.com has none) is NOT applied — you see exactly what is published at that name.

How many domains per run? Up to 200 (maxDomains). Duplicates are de-duplicated, URLs are cleaned to bare domains automatically.

Why did some rows come back ok: false? Those inputs were not valid domains or their DNS query failed transiently. They are recorded for completeness and never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~dmarc-record-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"domains": ["yourdomain.com", "competitor.com"]}'

Agents: connect Apify MCP and call the EliAI/dmarc-record-checker tool.

• Capability: fetch and grade the DMARC policy of one or many domains, returned as JSON
• Required input: domain (string) or domains (array)
• Returns: one JSON record per domain; grade + issues summarize the verdict
• Bounded: maxDomains caps the run; failures isolate per domain
• Side effects: none