Email Domain Security & Deliverability Auditor

🛡️ Bulk-audit email authentication, anti-spoofing, DNS security, and web TLS without sending a single email.

Turn domains, URLs, or email addresses into an evidence-backed security and deliverability scorecard. This standalone Apify Actor checks MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, CAA, DNSSEC deployment hints, and website TLS certificates using public DNS and HTTPS/TLS only. No paid API, proxy, email login, SMTP probe, or third-party Actor is required.

Built for:

• 📣 cold email, sales operations, and outbound agencies
• ✉️ email marketing and deliverability teams
• 🧑‍💻 IT, DevOps, security, and compliance teams
• 🏢 MSPs and agencies auditing customer domain portfolios
• 🔁 recurring domain monitoring through Apify Schedules and webhooks

Why use this email domain auditor?

Most email health checks return a few green or red icons. This Actor produces operational evidence that can be exported, automated, and handed to the person who must fix the problem:

• Two separate 0-100 scores for security and deliverability
• Recursive SPF lookup analysis, including the 10-lookup limit, include errors, redirect errors, and recursion loops
• Selector-aware DKIM discovery through TXT and CNAME records
• DMARC policy strength, enforcement percentage, alignment, and reporting destinations
• MTA-STS marker plus live HTTPS policy validation
• CAA, DNSSEC deployment hints, and website TLS certificate evidence
• Prioritized findings with severity, evidence, and a plain-English recommendation
• Professional HTML report plus portfolio summary JSON
• Three focused dataset views for management, email authentication, and transport security

🔍 Checks

Check	What is inspected	Typical problem detected
MX	Priority, host, Null MX, provider hint	Domain cannot receive email
SPF	Syntax, all policy, includes, redirect, recursive DNS lookup count	+all, multiple records, more than 10 lookups
DMARC	p, sp, pct, rua, ruf, adkim, aspf	Missing policy, p=none, partial enforcement
DKIM	Supplied selectors through TXT and CNAME	No key discovered, revoked selector
MTA-STS	_mta-sts TXT and HTTPS policy file	Marker exists but policy is invalid or unreachable
TLS-RPT	_smtp._tls reporting record	No visibility into SMTP TLS failures
BIMI	Default BIMI record and HTTPS logo location	Missing or malformed brand record
CAA	Authorized certificate issuers	No CA issuance restriction
DNSSEC hint	Public DS and DNSKEY evidence	Missing or incomplete deployment
Web TLS	Trust, hostname, protocol, expiry, issuer, cipher	Expired, untrusted, or legacy TLS

Safety: the Actor reads public infrastructure configuration only. It never sends email, never verifies whether a mailbox exists, and never performs an SMTP handshake.

🚀 Quick start

Paste domains, URLs, and email addresses into the Apify Input form:

{
  "domains": [
    "example.com",
    "security@github.com",
    "https://www.cloudflare.com"
  ],
  "checks": [
    "mx",
    "spf",
    "dmarc",
    "dkim",
    "mtaSts",
    "tlsRpt",
    "bimi",
    "caa",
    "dnssec",
    "webTls"
  ],
  "dkimSelectors": [
    "google",
    "default",
    "selector1",
    "selector2",
    "s1",
    "s2",
    "k1",
    "k2",
    "mail",
    "smtp",
    "mandrill",
    "amazonses"
  ],
  "timeoutSecs": 10,
  "concurrency": 10
}

Email addresses and URLs are normalized to a domain, leading www. is removed from URLs, internationalized domains are converted to ASCII, and duplicates are merged. Invalid values are skipped and listed in SUMMARY.

Input reference

Field	Type	Default	Description
domains	string array	["example.com"]	1-1,000 domains, URLs, or email addresses
checks	string array	all checks	Controls to run; disabled controls do not reduce scores
dkimSelectors	string array	12 common selectors	Add exact selectors used by your email providers
timeoutSecs	integer	10	Per DNS, HTTPS, or TLS operation, 2-30 seconds
concurrency	integer	10	Domains processed in parallel, 1-30

Which DKIM selectors should I use?

DKIM public keys live at <selector>._domainkey.<domain>. DNS has no operation that lists all selectors, so any DKIM checker must know which selectors to test. The defaults cover common generic, Google, Microsoft, Mailchimp, Amazon SES, and transactional-email patterns. Add the exact selectors from your email provider when known.

📦 Output

The default dataset contains one structured row per unique normalized domain. CSV, JSON, Excel, XML, and API exports are available through standard Apify datasets.

{
  "domain": "example.com",
  "status": "completed",
  "overallScore": 68,
  "securityScore": 62,
  "deliverabilityScore": 74,
  "riskLevel": "high",
  "mxFound": true,
  "mxProviders": ["Google Workspace"],
  "spfStatus": "warning",
  "spfLookupCount": 8,
  "spfLookupLimitExceeded": false,
  "dmarcPolicy": "none",
  "dkimFound": true,
  "dkimSelectorsFound": ["google"],
  "mtaStsMode": null,
  "webTlsStatus": "pass",
  "topRecommendation": "Review aggregate reports, align legitimate senders, then progress to p=quarantine and p=reject.",
  "findings": [
    {
      "check": "dmarc",
      "severity": "high",
      "code": "DMARC_MONITOR_ONLY",
      "title": "DMARC does not enforce protection",
      "message": "p=none collects reports but does not ask receivers to block or quarantine spoofed mail.",
      "evidence": {
        "policy": "none"
      },
      "recommendation": "Review aggregate reports, align legitimate senders, then progress to p=quarantine and p=reject."
    }
  ]
}

See ./examples/output.json for the complete shape.

Dataset views

• Risk overview: scores, severities, issue count, and top fix
• Email authentication: MX, provider, SPF lookup count, DMARC, and DKIM
• Transport and DNS security: MTA-STS, TLS-RPT, BIMI, CAA, DNSSEC, and web TLS

Key-value store reports

Key	Content type	Purpose
SUMMARY	application/json	Portfolio counts, score averages, coverage, common findings, and priority actions
REPORT	text/html	Standalone responsive report suitable for client review or printing

📊 How scoring works

Security and deliverability use separate weighted models:

• Deliverability: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI
• Security: SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, CAA, DNSSEC hint, and web TLS

Each score is normalized across enabled checks with successful evidence. A disabled check never reduces the score. If a network operation fails, the related weight is excluded and the coverage percentage falls. Always interpret score and coverage together.

Grades:

Score	Grade
95-100	A+
90-94	A
80-89	B
70-79	C
60-69	D
0-59	F

Severity takes precedence in riskLevel: a critical finding remains critical even if optional controls raise the numeric average.

💼 Practical workflows

Audit cold-email sending domains

Run MX, SPF, DKIM, DMARC, MTA-STS, and TLS-RPT before launching a campaign. Filter the dataset for:

• spfLookupLimitExceeded = true
• dmarcPolicy = none or empty
• dkimFound = false
• riskLevel = critical or high

Create an agency lead magnet

Audit prospect domains, export the Risk overview as CSV, and share the generated HTML report during discovery. Findings include evidence and specific remediation rather than generic sales claims.

Monitor a customer portfolio

Create a saved task, schedule it weekly, and connect a webhook to Make, n8n, Zapier, Slack, or your ticketing system. Compare current rows with the prior run in your own datastore to detect posture changes.

Support security inventory reviews

Use the API or Apify MCP integration to enrich asset inventory with CAA, DNSSEC hints, web certificate expiry, and email anti-spoofing posture.

API usage

Replace YOUR_USERNAME and APIFY_TOKEN:

curl -X POST \
  "https://api.apify.com/v2/acts/YOUR_USERNAME~email-domain-security-deliverability-auditor/runs?token=APIFY_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "domains": ["example.com", "github.com"],
    "checks": ["mx", "spf", "dmarc", "dkim"],
    "concurrency": 10
  }'

The Actor also works through the Apify JavaScript/Python clients, webhooks, schedules, Make, Zapier, n8n, and Apify MCP.

Local development

Requirements: Node.js 22 or newer.

npm install
npm test
npx apify-cli validate-schema
npm start

Local npm start reads input through the standard Apify local storage. Unit tests use dependency-injected DNS, HTTP, and TLS mocks and do not require network access.

Privacy and security

• No email is sent.
• No mailbox, SMTP recipient, or password is tested.
• No paid API or third-party Actor is called.
• Inputs and outputs use the run's private Apify storages unless the user explicitly shares them.
• Web TLS and MTA-STS connections block private, loopback, link-local, documentation, multicast, and reserved IP targets.
• HTTP responses are limited and redirects are not followed.
• Every individual check handles timeout and DNS errors without crashing other domains.

Honest limitations

1. DKIM is selector-based. A not discovered result is not proof that no outbound message is signed.
2. DNSSEC is a hint. Public DS and DNSKEY evidence is useful for inventory, but this Actor is not a full validating resolver.
3. No inbox-placement test. DNS posture is only one part of deliverability; sender reputation, message content, engagement, and list quality are not measured.
4. No SMTP probe. The Actor does not test mailbox existence, catch-all behavior, or bounce status.
5. Public-view differences are possible. Split-horizon DNS and private enterprise policies may differ from records visible to the Actor.

Monetization

The recommended predictable launch price is $0.006 per audited domain ($6 per 1,000) plus a $0.00005 run start. One dataset row equals one completed domain audit, so the synthetic Apify default dataset item event maps cleanly to user value. The HTML report and summary are included.

See ./PRICING.md for margins, discount tiers, and the exact Apify Console configuration.

License

MIT. See ./LICENSE.