DNS Lookup & Email Security Checker (SPF, DMARC, DKIM, MX)

Check DNS records and email security of thousands of domains in one run. It is fast and cheap, and you need no API key.

DNS records: A, AAAA, MX, NS, TXT, CAA and SOA.

Email security:

• SPF: the record, its validity, the all qualifier (-all, ~all, ?all, +all), multiple-record errors and DNS lookup count
• DMARC: policy (none, quarantine, reject), subdomain policy, pct and reporting domains
• DKIM: tests common selectors (Google, Microsoft 365 and others; you can add your own)
• MTA-STS, TLS-RPT and BIMI: whether each is present
• Score and grade: a score from 0 to 100 and a grade from A to F, for quick prioritisation

Detection:

• Mail provider from the MX records: Google Workspace, Microsoft 365, Proofpoint, Mimecast, IONOS, Strato, Zoho and more
• Email services that SPF allows to send: HubSpot, Salesforce, Mailchimp, SendGrid, Mailgun, Amazon SES, Zendesk, Brevo and more

Delta mode: schedule it and receive only domains whose DNS or email security changed.

Use cases

• Deliverability audits: check your own domains or your clients' domains for SPF, DKIM and DMARC errors.
• IT and security teams, MSPs: review the email security of the domains you manage and prioritise fixes by grade.
• Market research: see how common Google Workspace, Microsoft 365, DMARC or MTA-STS are in a list of company domains (aggregated analysis).
• Monitoring: run it daily in delta mode to get alerts when MX, NS, SPF or DMARC records change, for example after a provider switch or a misconfiguration.

Input example

{ "domains": ["apify.com", "https://www.example.com/contact", "info@example.org"], "checkEmailSecurity": true }

Output (one item, shortened)

{
  "domain": "apify.com",
  "resolves": true,
  "a": ["3.162.79.115"],
  "aaaa": ["2600:9000:2759:1a00:9:a03e:6540:93a1"],
  "mx": [{ "exchange": "aspmx.l.google.com", "priority": 1 }],
  "ns": ["ns-1.awsdns-00.com"],
  "txt": ["v=spf1 include:_spf.google.com include:mailgun.org ... -all"],
  "caa": [{ "critical": 0, "tag": "issue", "value": "amazon.com" }],
  "soa": { "primaryNameServer": "ns-1.awsdns-00.com", "serial": 1, "refresh": 7200, "retry": 900, "expire": 1209600, "minTtl": 86400 },
  "mailProvider": "Google Workspace",
  "emailSenders": ["Google", "Mailgun", "Amazon SES", "HubSpot"],
  "spf": { "record": "v=spf1 ...", "valid": true, "multipleRecords": false, "allQualifier": "-all", "topLevelDnsLookups": 6 },
  "dmarc": { "record": "v=DMARC1; p=reject; ...", "policy": "reject", "subdomainPolicy": null, "pct": 100, "reportingDomains": ["apify.com"] },
  "dkimSelectorsFound": ["google"],
  "mtaSts": true,
  "tlsRpt": true,
  "bimi": false,
  "emailSecurityScore": 100,
  "emailSecurityGrade": "A",
  "fetchedAt": "2026-10-08T14:00:00.000Z"
}

(Values are illustrative.) The email security fields are omitted for domains that do not resolve. In delta mode, items include changeType, and the SOA serial is omitted so that routine zone edits do not trigger changes.

How the score is calculated: SPF present (20), SPF with -all or ~all (10), DMARC present (25), DMARC policy quarantine or reject (20), DKIM selector found (10), MTA-STS (10) and TLS-RPT (5). Grades: A ≥ 85, B ≥ 70, C ≥ 50, D ≥ 30, F < 30. DKIM can only be detected for the tested selectors, so a domain can use DKIM with a selector that is not in the list.

Pricing

Pay per event: USD 2.00 per 1,000 domains (event result), with lower prices on higher Apify subscription plans. There is no start fee. Users on the Apify Free plan are limited to 50 domains per run.

Speed: the actor checks 10 domains in parallel, which is about 1,000 domains in 2–4 minutes.

Privacy and limits

• The actor uses only public DNS. It sends no email, does not verify mailboxes and does not test SMTP.
• Email addresses that appear in DNS records (for example in DMARC rua tags or CAA iodef) are reduced to their domain (*@example.com). The SOA hostmaster mailbox is not returned.
• Results come from the resolver in the actor's data center. TTLs and caching can delay changes by up to the record's TTL.

Responsibility

DNS records are public technical data. You are responsible for using the results in line with applicable law. In particular, the results do not permit unsolicited marketing emails or calls: in the EU (e.g. § 7 UWG in Germany) such outreach generally requires prior consent. This actor is not affiliated with any of the providers it names; product names are used only to describe detected services.

Impressum / Legal notice

Anbieter dieses Actors (Angaben gemäß § 5 DDG) / Provider of this actor:

Friedrich Köhler
Spatzenweg 7
04720 Döbeln
Deutschland
E-Mail: actorcreater_010@web.de