Email Authentication Auditor

Grades a domain's email authentication — SPF, DKIM, DMARC, MX, blacklists, basic DNS — and returns the exact DNS records to publish to fix what is broken.

Most tools in this category tell you what is wrong. This one tells you what to type.

Why this exists

Measured across the Apify Store: 394 monetised actors in the email/DNS audit category, 1.76M combined runs — and every single one of them only reads. None of them automates the fix. That is the gap this Actor fills.

A scan tells you "no DKIM key found". That sentence does not get your mail delivered. The useful output is a record set you can publish, for the provider you actually use.

What you get

Per domain, one row in the dataset:

Field	What it means
score	0–100 deliverability score (SPF 20, DMARC 25, DKIM 25, blacklists 20, MX 5, DNS 5)
grade	A–F
checks	Status of every check, Name=status
actionable	Every critical/high finding, with severity
fix_provider	The mail provider the fix plan is written for
fix_spf	The exact SPF TXT value to publish
fix_dmarc	The exact DMARC TXT value to publish
fix_dkim_selector	The DKIM selector the key belongs under
fix_steps	Ordered, unambiguous steps — each one actionable without interpretation
fix_caution	The warning that applies to this domain, if any

Example output

{
  "domain": "example.com",
  "score": "75",
  "grade": "B",
  "summary": "Close - a couple of fixes will do it",
  "providers": "Google Workspace / Gmail",
  "checks": "SPF=pass; DMARC=pass; DKIM=critical; MX=pass; Blacklists=pass; Basic DNS=pass",
  "actionable": "[critical] DKIM: DKIM record(s) exist at 20230601 but the key is REVOKED (empty p=), so this domain is not signing new mail.",
  "fix_provider": "Google Workspace / Gmail",
  "fix_spf": "",
  "fix_dmarc": "",
  "fix_dkim_selector": "google._domainkey",
  "fix_dkim_note": "Enable DKIM in Google Admin > Apps > Gmail > Authenticate email, then send one test message so the key appears.",
  "fix_steps": "SPF already exists and was left untouched. A wrong SPF record locks a domain out of its own inbox. | Enable DKIM with Google Workspace / Gmail. Expect a TXT record at google._domainkey under _domainkey. | Re-run this audit after publishing.",
  "fix_caution": "SPF already exists and was left untouched. A wrong SPF record locks a domain out of its own inbox.",
  "report_url": "https://mailcluster.net/audit?domain=example.com"
}

Accuracy: what this tool refuses to get wrong

A public scanner that renders verdicts about other people's configuration spends credibility it cannot get back. It is correct on ordinary inputs and wrong on exactly the inputs people check first. Four rules this Actor holds to, each one learned from a real failure:

1. Date-based and rotating DKIM selectors are covered. Google publishes its key at 20230601._domainkey.google.com, not google._domainkey. A fixed selector list reports "no DKIM found" on one of the most famous domains on the internet. This Actor scans 60 months of month-start selectors, so it finds keys that are years old.

2. A wildcard *._domainkey record is detected, not believed. A wildcard makes every selector answer. Without a control query against a selector that cannot exist, an auditor credits a guessed selector with a key it does not own — a false pass. This Actor probes for the wildcard before trusting any DKIM result.

3. A revoked key is not an absent key. A record with an empty p= is revoked: the infrastructure exists, the key is dead, and the fix is different. This Actor reports the two cases separately instead of collapsing them into "no DKIM found".

4. A working SPF record is never proposed over. A wrong SPF record locks a domain out of its own inbox. When SPF already exists, this Actor leaves it alone and says so, rather than handing you a value to paste that might break deliverability you already have.

Verified against known-good targets: microsoft.com, enbotix.com, github.com, stripe.com, shopify.com and sendgrid.com all score 100/A. mailcluster.net scores 28/D. google.com scores 75/B — correctly identifying a genuinely revoked key.

Deliberate non-findings

~all in SPF is reported at medium severity, not as a failure. Most of the internet uses it on purpose; a tool that cries wolf on a correct configuration loses its credibility. +all (authorising the entire internet) is reported as high severity.

A generic DKIM selector (mail, default, k1, s1, pm, smtp, email) is treated as evidence of nothing. Half the internet names its selector mail; inferring a provider from it is a false positive.

Input

{ "domains": ["example.com", "mailcluster.net"] }

A comma-separated string also works. Up to 50 domains per run.

Pricing

Pay per event — $0.05 per domain audited. You are never charged for a domain that could not be audited.

Built by

mailcluster.net — free email authentication audit, $29 one-off fix, $19/month monitoring. Also available as a hosted API with automatic record application.