Email Deliverability Checker - MX, SPF, DMARC, DKIM Health Score

One run tells you why a domain's mail lands in spam - or proves it won't. Full email-auth audit (MX + SPF + DMARC + DKIM) with a weighted 0-100 score, letter grade, and concrete fixes. Up to 100 domains per run, online, by API, or as an agent tool via Apify MCP.

Before a cold-email campaign, after a mail-provider migration, or while qualifying leads (a broken email setup is a warm conversation starter for agencies), this actor checks everything receivers check: can the domain receive mail, is SPF valid and enforced, is DMARC published and enforcing, is DKIM discoverable on common selectors.

What you get

• score (0-100, weighted: MX 30, DMARC 30, SPF 25, DKIM 15) + grade (A-F)
• mx - records sorted by priority, pass/fail
• spf - record, policy (hardfail/softfail/neutral/allow-all), DNS-lookup count vs the RFC limit, issues
• dmarc - record, policy, pct, rua presence, issues
• dkim - which of 9 common selectors publish keys (google, default, selector1/2, k1, mail, 20230601, s1, s2)
• recommendations - ordered, copy-paste-ready fixes ("Publish a DMARC record at _dmarc.yourdomain...")
• Fail-soft: invalid inputs never fail the run - {ok: false, error}, never charged.

Input

{ "domains": ["github.com", "cloudflare.com"], "maxDomains": 25 }

Accepts domains or email addresses (user@company.com -> company.com), single or bulk.

Output (real run, trimmed)

{
  "domain": "google.com",
  "ok": true,
  "score": 88,
  "grade": "B",
  "mx": { "found": true, "count": 1, "status": "pass" },
  "spf": { "found": true, "policy": "softfail", "status": "warn" },
  "dmarc": { "found": true, "policy": "reject", "status": "pass" },
  "dkim": { "found": true, "selectorsFound": ["20230601"] },
  "recommendations": []
}

Even google.com grades B here - its SPF ends in ~all (softfail). The score is mechanical and honest.

Pricing

$0.002 per domain audited - one domain-checked event covering all four checks (MX + SPF + DMARC + DKIM across 9 selectors) plus the score, grade and recommendations. No actor-start fee. Invalid inputs and transient DNS failures are recorded and never charged, and maxDomains caps both the run and the spend.

A 100-domain audit costs $0.20. A single domain costs $0.002.

Honest comparison

Measured from each actor's live pricing on 2026-08-15, for a 100-domain audit:

Actor	Price shape	100 domains
codeblix/email-deliverability-checker	$0.00001 start + $0.001 per domain	$0.10
eliai/email-deliverability-checker (this one)	$0.002 per domain, no start fee	$0.20
logiover/bulk-email-deliverability-checker	$0.00005 start + $0.005 per item	$0.50
mambalabs/domain-deliverability-checker	$0.00005 start + $0.005 per item	$0.50
weiseer/email-deliverability-checker	$0.01 per item	$1.00
renzomacar/domain-health-enricher	$0.02 per domain	$2.00
nexgendata/email-dmarc-auditor	$0.01 start + $0.05 per domain	$5.01

We are second cheapest of that set, not first, and codeblix is genuinely half our price - check it if cost is the only axis you care about. What is priced in here is the scoring layer: a weighted 0-100 number, a letter grade, and copy-paste-ready records to fix what failed, rather than a raw dump of DNS answers you still have to interpret.

Honest limits

• DKIM detection probes 9 common selectors; a domain using a custom selector shows dkim.found: false with status warn, not fail - absence of common selectors is not proof DKIM is missing, and the score weights it accordingly.
• DNS-level audit only: no test emails are sent, no IP/domain reputation or blocklist lookups. It measures configuration, which is the part you control.
• SPF lookup counting is top-level (nested includes are not recursively resolved).

When NOT to use this

• You want to know if a specific address is deliverable. This audits the domain's mail configuration. For a list of addresses use Bulk Email List Verifier.
• You want to know why a specific message went to spam. Configuration is one input; content, sending history, list hygiene, and the recipient's own filters are the others, and none of them are visible from DNS.
• You want IP or domain reputation, or blocklist status. Not checked. This is configuration only.
• You need proof that DKIM is absent. Only 9 common selectors are probed. dkim.found: false means "not on the usual selectors", not "not configured" - which is why it scores as a warning.
• You want the grade to be an industry standard. It is not. The 0-100 weighting (MX 30, DMARC 30, SPF 25, DKIM 15) is ours, it is mechanical, and it is documented above so you can disagree with it and use the raw mx / spf / dmarc / dkim blocks instead.

FAQ

What does a grade of C or D actually mean? Typically: mail can be received but anti-spoofing is weak - SPF present but no enforcement, DMARC missing or p=none. The recommendations list the exact records to add or tighten.

Why do you weight DMARC as heavily as MX? Gmail and Yahoo now require DMARC for bulk senders. No DMARC = throttled or spam-foldered even with perfect SPF, so it is co-equal with basic deliverability.

Can I audit my prospects' domains? Yes - agencies run client/prospect lists through it; a failing grade is a concrete, verifiable talking point. 100 domains per run.

Does it find every DKIM key? No (see limits) - it finds keys on the 9 most common selectors, which covers Google Workspace (incl. its date-style selectors), Microsoft 365, SendGrid, Zoho and default setups.

Why did some rows come back ok: false? Those inputs were not valid domains/emails or DNS failed transiently. Recorded for completeness, never charged.

What is the difference between SPF, DKIM and DMARC? SPF lists which servers may send as your domain. DKIM signs each message so the receiver can check it was not altered and really came from you. DMARC tells receivers what to do when SPF and DKIM disagree with the From address, and where to send reports. You need all three: SPF and DKIM are the evidence, DMARC is the policy that makes the evidence count.

Why does my domain score badly when my email works fine? Because "arrives today" and "cannot be spoofed, and will keep arriving at Gmail and Yahoo" are different properties. The usual pattern is valid MX, an SPF record that ends in ~all, and DMARC missing or at p=none - mail flows, but nothing is enforced and bulk-sender rules are not met. The recommendations list is ordered by how much each fix moves the score.

Can I feed it email addresses instead of domains? Yes. user@company.com is reduced to company.com before the lookup, so you can pass a raw lead list without cleaning it first. Duplicate domains still cost one event each - dedupe upstream if that matters.

Does it send test emails or connect to my mail server? No. DNS queries only. Nothing touches your mail flow or anyone's inbox, so it is safe to run against domains you do not own.

How current are the results? They are live DNS reads at run time, subject to the records' own TTLs. Publish a new DMARC record and re-run a few minutes later to see it.

Related actors

• Bulk Email List Verifier - clean the list you send to
• DNS Records Lookup - A, AAAA, MX, TXT, NS in one call
• Email Validator - syntax-level address validation
• JSON to CSV Converter - turn the audit into a spreadsheet

Built by Broke to Built.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~email-deliverability-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"domain": "yourdomain.com"}'

Agents: connect Apify MCP and call the EliAI/email-deliverability-checker tool.

• Capability: full email-auth audit (MX/SPF/DMARC/DKIM) of one or many domains with score + fixes
• Required input: domain/email (string) or domains/emails (array)
• Returns: one JSON record per domain; score, grade, recommendations summarize it
• Bounded: maxDomains caps the run; failures isolate per domain
• Side effects: none (DNS queries only)

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/email-deliverability-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~email-deliverability-checker/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.