# Email Security Checker — SPF, DKIM, DMARC & MX Audit (`factpipe/email-security-checker`) Actor

Audit any domain's email authentication: SPF (lookups, -all), DMARC policy, DKIM keys, MX, MTA-STS and TLS-RPT, with a 0-100 score and fix list. Bulk domains, no key. $3 per 1,000 domains.

- **URL**: https://apify.com/factpipe/email-security-checker.md
- **Developed by:** [Neo B](https://apify.com/factpipe) (community)
- **Categories:** Developer tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$3.00 / 1,000 domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Email Security Checker — SPF, DKIM, DMARC & MX Audit

Audit the **email authentication setup of any domain** — SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT — and get a **0–100 score, a letter grade and a plain-English fix list** per domain. Check one domain or thousands in bulk. Uses public DNS only: no API key, no mailbox access, no personal data.

### Quick start

1. Click **Start** with the two prefilled domains. It finishes in under a minute.
2. You get a 0–100 score, grade and fix list per domain covering SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT.
3. That first run costs $0.006, well within Apify's free monthly credit. Then swap in your own input or schedule it.

### What you get

```json
{
  "query": "github.com",
  "found": true,
  "domain": "github.com",
  "score": 77,
  "grade": "B",
  "issues": [
    "SPF ends in ~all (softfail); -all is stricter.",
    "DMARC policy is quarantine; reject gives full spoofing protection."
  ],
  "accepts_mail": true,
  "null_mx": false,
  "mx_records": [
    "0 github-com.mail.protection.outlook.com"
  ],
  "spf_present": true,
  "spf_record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all",
  "spf_all": "~all",
  "spf_dns_lookups": 8,
  "dmarc_present": true,
  "dmarc_policy": "quarantine",
  "dmarc_subdomain_policy": "reject",
  "dmarc_pct": 100,
  "dmarc_record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:***@github.com; ruf=mailto:***@github.com; fo=1",
  "dmarc_report_domains": [
    "github.com"
  ],
  "dkim_selectors_found": [
    "google",
    "selector1",
    "k1",
    "k2",
    "s1",
    "s2"
  ],
  "mta_sts": false,
  "tls_rpt": false,
  "source_url": "dns:github.com",
  "fetched_at": "2026-09-15T12:00:00.000Z"
}
```

### Use cases

- **Deliverability teams & ESPs**: find clients whose SPF exceeds 10 lookups or whose DMARC is still `p=none`.
- **Security & vendor risk**: flag suppliers whose domains can be spoofed (missing DMARC, SPF `+all`).
- **Agencies & MSPs**: generate a prospect list of domains with fixable email security gaps.
- **AI agents & automations**: deterministic JSON per domain via API, Make, Zapier or MCP.

### Input

| Field | Type | Notes |
|---|---|---|
| `domains` | string\[], required | Domains, URLs or email addresses |
| `extraDkimSelectors` | string\[] | Custom DKIM selectors to test |

### Pricing (pay per event)

| Event | Price | Meaning |
|---|---|---|
| `domain-audited` | **$3.00 per 1,000** ($0.003 each) | One domain fully audited (SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT). Invalid, nonexistent or unreachable domains are never charged. |

Example: auditing 1,000 domains costs **$3.00**. No start fee. You only pay for delivered results.

### factpipe Website Audit Toolkit

Bulk technical checks for agencies, SEO teams and deliverability owners, all pay-per-result. Feed a list of sites in, get one flat row per page or domain out.

| Workflow | Actor | What it does | Price |
|---|---|---|---|
| Website audit | [Sitemap URL Extractor & 404 Checker](https://apify.com/factpipe/sitemap-url-extractor) | Extract every URL from XML sitemaps and flag 404s and broken entries | $0.30/1k |
| Website audit | [Lighthouse Auditor](https://apify.com/factpipe/lighthouse-auditor) | Lighthouse scores and Core Web Vitals for many pages, mobile or desktop | $10/1k |
| Website audit | **Email Security Checker** (this Actor) | SPF, DKIM, DMARC and MX audit for any list of domains | $3/1k |

**Use it together:**

- **Agency site-and-domain health report:** combine these results with [Lighthouse Auditor](https://apify.com/factpipe/lighthouse-auditor) performance scores and [Sitemap URL Extractor & 404 Checker](https://apify.com/factpipe/sitemap-url-extractor) broken-URL counts.

### FAQ

**Why is DKIM sometimes reported as not found?**
DKIM keys live under selector names that cannot be listed from DNS. The Actor tests 18 common selectors (Google Workspace, Microsoft 365, and major ESPs) plus any you add in `extraDkimSelectors`.

**What does the SPF lookup count mean?**
SPF allows at most 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect). More than 10 makes SPF fail with a permanent error at receivers, so the Actor flags it.

**Do you store or expose DMARC report email addresses?**
No. Only the receiving domains of DMARC reports are returned; mailbox names are masked.

**Am I charged for domains that don't exist?**
No. Invalid inputs, nonexistent domains and DNS failures are returned as not found and never charged.

**Can I call it from Python, JavaScript, Make, Zapier or an AI agent?**
Yes. Run it through the Apify API or official Python/JavaScript clients, connect it to Make, Zapier, n8n, Slack or Google Sheets via Apify integrations, or expose it to AI agents through the Apify MCP server. Input is small and output is deterministic flat JSON.

### Reliability

Deterministic code against official sources, automatic retries with backoff, structured failure reporting, daily health checks and issue triage.

# Actor input Schema

## `domains` (type: `array`):

Domain names, website URLs or email addresses (the domain is extracted). Duplicates are checked once.

## `extraDkimSelectors` (type: `array`):

Custom DKIM selectors to test in addition to 18 common ones (google, selector1, selector2, k1, s1, mailchimp-style keys...).

## Actor input object example

```json
{
  "domains": [
    "github.com",
    "example.com"
  ]
}
```

# Actor output Schema

## `resultsDatasetUrl` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "github.com",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("factpipe/email-security-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "github.com",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("factpipe/email-security-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "github.com",
    "example.com"
  ]
}' |
apify call factpipe/email-security-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,factpipe/email-security-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/LNGrubmo3gKNWsdgh/builds/m5vK552Bpl4yIVnSM/openapi.json