SPF, DKIM & DMARC Checker – Bulk Email Deliverability Audit

Check SPF, DKIM, DMARC, MX, BIMI, MTA-STS and TLS-RPT for thousands of domains in one run. Paste domains, URLs or email addresses and get one row per domain with a 0–100 email authentication score, an A–F grade, a Gmail/Yahoo bulk-sender readiness flag, a prioritized list of issues, and the exact DNS fix for each one.

No API key, no SMTP connections, no proxies: only public DNS (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 or your own resolver) plus the public MTA-STS policy file. $1 per 1,000 domains.

What does the Email Auth Checker do?

Check	Details
MX	Mail servers sorted by priority, whether each MX host resolves, Null MX detection, and the email provider (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast and about 40 more)
SPF checker	Full record, parsed mechanisms, includes, all policy, redirect, a recursive DNS-lookup count with the RFC 7208 10-lookup limit, void lookups, broken includes, multiple records, +all/?all, deprecated ptr
DMARC checker	Policy p, subdomain policy sp, pct, rua/ruf, adkim/aspf alignment, fallback to the organizational domain, and external report authorization for rua addresses at DMARC vendors (RFC 7489 §7.1)
DKIM checker	Probes ~65 common selectors (Google, Microsoft 365 selector1/2, Mailchimp k1–k3, SendGrid, Mailgun, Amazon SES, Postmark, HubSpot, Klaviyo, Brevo, Zoho, Proton, Fastmail, Zendesk…) plus your own selectors. Returns key type, key size (flags 1024-bit keys) and revoked keys.
MTA-STS	_mta-sts TXT, plus download and validation of https://mta-sts.<domain>/.well-known/mta-sts.txt (mode, max_age, and whether every MX host is covered)
TLS-RPT	_smtp._tls record and report address
BIMI	default._bimi record, logo SVG URL, VMC URL, and a warning when DMARC is not enforced (logos are not shown then)
Score & grade	Starts at 100 and subtracts points per issue (missing DMARC −30, missing SPF −25, p=none −15, no DKIM −15, SPF > 10 lookups −10…). A ≥ 90, B ≥ 80, C ≥ 65, D ≥ 50, F < 50
Fix list	recommendations[] with code, severity, points, a plain-English message and the DNS fix. topFix holds the most important one.

Use cases

• Cold email & outbound agencies: audit every sending domain and every client domain before a campaign. Find SPF over 10 lookups, missing DKIM or DMARC at p=none before they hurt inbox placement.
• Gmail & Yahoo bulk-sender requirements (2024+): the bulkSenderReady column shows whether a domain has SPF, DKIM and DMARC published.
• Lead qualification for email security / deliverability services: run a list of prospect domains and filter by grade D/F or dmarcPolicy = missing. Every row includes a ready-made talking point (topFix).
• Security & compliance: spot domains open to spoofing (no DMARC enforcement, +all), parked domains without a v=spf1 -all lockdown, and weak 1024-bit DKIM keys.
• MSPs & IT teams: monitor client domains on a schedule and export to Google Sheets or Excel.

Input example

{
  "domains": ["apify.com", "https://www.github.com/apify", "jane@stripe.com"],
  "dkimSelectors": ["s1", "mailo"],
  "lookupTarget": "rootDomain",
  "fetchMtaStsPolicy": true,
  "resolver": "cloudflare"
}

You can also paste a long list or a whole CSV into Bulk list, or give a file URL (TXT or CSV, for example a published Google Sheet). URLs and emails are reduced to the domain, and duplicates are removed. Use As entered to check a sending subdomain such as mail.example.com.

Output example

One row per domain. The flat columns fit Excel or Google Sheets, and full details sit in nested objects (spf, dmarc, dkim, mx, mtaStsDetails, recommendations). Example (shortened):

{
  "domain": "apify.com",
  "status": "OK",
  "score": 95,
  "grade": "A",
  "bulkSenderReady": "yes",
  "emailProvider": "Google Workspace",
  "mxHosts": "1 aspmx.l.google.com, 5 alt1.aspmx.l.google.com, ...",
  "spfPolicy": "-all (fail)",
  "spfLookups": 10,
  "spfIncludes": "_spf.google.com, mailgun.org, amazonses.com, 19497222.spf05.hubspotemail.net",
  "dmarcPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": "mailto:dmarc-reports@apify.com",
  "dkimSelectors": "google (rsa 2048), intercom (rsa 1024)",
  "mtaSts": true,
  "tlsRpt": true,
  "bimi": true,
  "issues": ["dkim_weak_key"],
  "topFix": "Rotate to a 2048-bit RSA key."
}

Statuses: OK, NO_MX (the domain exists but has no MX), NXDOMAIN, TIMEOUT/SERVFAIL and INVALID_INPUT. Only OK and NO_MX rows are charged.

Pricing

$0.001 per domain checked ($1 per 1,000 domains), plus a tiny per-run start fee. Everything is included: DKIM probing, MTA-STS policy fetch, report authorization and the score. Non-existent domains, DNS failures and invalid inputs are free.

Actor (Apify Store, Oct 2026)	Price per domain
This Actor	$0.001
thoob/dns-bulk-lookup	$0.003
ryanclinton/dns-record-lookup	$0.003
drumlinlabs/email-auth-auditor	$0.004
q_services/email-deliverability-auditor	$0.001 + $0.005 per run
weiseer/email-deliverability-checker	$0.01
nexgendata/email-dmarc-auditor	$0.05 + $0.01 per run

You can cap spending with the run's maximum total charge: the Actor stops cleanly when the limit is reached.

FAQ

Why is DKIM "not found" for a domain that signs its mail? DNS cannot list DKIM keys. The Actor checks about 65 common selectors, but many senders use custom ones (Gmail's current selectors are not public, for example). Open a sent email, read the s= value in the DKIM-Signature header, and add it to Your DKIM selectors.

Does it verify mailboxes or connect to mail servers? No. It does not open SMTP connections and does not send email. It only reads public DNS records and the public MTA-STS policy file.

Does it check blacklists? No. Public DNSBLs such as Spamhaus do not allow commercial queries through public resolvers.

How fast is it? About 200 domains in under a minute with the defaults (≈75 DNS queries per domain).

Can I check a subdomain? Yes. Set What to check to As entered. DMARC falls back to the organizational domain as receivers do.

Is the score an official standard? No. It is a transparent checklist; every deduction is listed in recommendations with its points.

Use with AI agents (Apify MCP)

The Actor works as a tool in the Apify MCP server: an agent can call gazidev/email-auth-checker with {"domains": ["example.com"]} and read grade, issues and topFix to explain a domain's deliverability problems or write the DNS records to fix them. You can also call it through the Apify API, a Zapier/Make/n8n integration, or on a schedule.

Related Actors

• DNS Lookup – Bulk DNS Records: all record types, reverse DNS and DNS change monitoring.
• Email Syntax & MX Validator: validate email address lists.