Email Deliverability & Domain Posture Auditor

Bulk audit email deliverability posture: MX · SPF · DKIM · DMARC · DNSSEC · MTA-STS · TLS-RPT · BIMI — with a 0–100 score and a prioritized fix list.

Audit a single domain or thousands. Pure DNS-over-HTTPS — no scraping, no proxies, no API keys. Built for cold-email teams, IT/security teams, email-marketing agencies, and MSPs who need to keep customer domains out of the spam folder.

What it checks

Area	What we look for	Why it matters
MX	Mail-exchange records present and valid	Without MX, the domain can't receive mail at all
SPF	TXT record at apex, v=spf1, includes, the all= policy, +all hazard, >10 lookups	Receiving servers reject spoofed mail from non-listed IPs
DKIM	Probes common selectors (google, default, selector1, selector2, s1, k1, mail, …) for public signing keys	Cryptographic email signing — stops tampering and verifies sender
DMARC	_dmarc TXT: policy p= (none/quarantine/reject), sp, pct, rua reporting	The master policy that tells receivers what to do with mail that fails SPF/DKIM
DNSSEC	Authentic-Data flag on queries	Cryptographic chain of trust for DNS — stops cache poisoning
MTA-STS	_mta-sts TXT + policy file at mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461)	Forces TLS on inbound SMTP — stops STARTTLS downgrade / MITM
TLS-RPT	_smtp._tls TXT (RFC 8460)	Daily reports on STARTTLS failures so you can detect misconfigurations
BIMI	default._bimi TXT	Shows your logo in recipient inboxes (requires DMARC enforcement first)

Each domain gets a 0–100 posture score (A–F grade), a sorted issue list (critical → info) with an exact fix string per issue, and a top_fix summary.

Why run an email deliverability audit?

Every domain that sends email needs a correct email authentication setup. Without it:

• Cold-email campaigns land in spam. Gmail and Outlook check SPF, DKIM, and DMARC before deciding inbox vs spam folder.
• Your domain can be spoofed. Without DMARC enforcement (p=reject), anyone can send mail that looks like it's from you.
• MTA-STS gaps expose STARTTLS downgrades. A motivated attacker can strip TLS mid-session if MTA-STS isn't published.
• BIMI unlocks branded inbox logos. but only after DMARC p=quarantine or p=reject is enforced.

A single audit pass catches all eight of these surface areas and gives you exact DNS changes to fix each one.

Use cases

• Cold-email / outreach teams — audit your sending domains before a campaign to maximize inbox placement.
• MSPs & agencies — batch-audit your entire customer portfolio; flag every domain missing DMARC or with +all SPF.
• Security / IT teams — detect email spoofing exposure (p=none DMARC, no MTA-STS, no DNSSEC) across your asset list.
• Deliverability consultants — generate a prioritized fix list per domain in one run.
• Compliance — confirm enforcement (p=reject, -all) before audits.

Example input

{
  "domains": ["example.com", "github.com"],
  "dkimSelectors": ["google", "default", "selector1"]
}

Example output (per domain)

{
  "domain": "example.com",
  "posture_score": 72,
  "posture_grade": "C",
  "spf_status": "fail",
  "dkim_found": false,
  "dmarc_policy": "none",
  "mta_sts": "absent",
  "dnssec": false,
  "issue_count": 4,
  "top_fix": "Publish an SPF TXT record at the domain apex, e.g. \"v=spf1 include:_spf.google.com -all\".",
  "issues": [
    { "severity": "critical", "area": "DMARC", "message": "No DMARC record found…", "fix": "Publish a DMARC TXT at _dmarc.<domain>…" },
    { "severity": "high", "area": "DKIM", "message": "No DKIM public keys found…", "fix": "Enable DKIM signing in your email provider…" }
  ],
  "mx": [],
  "spf": { "found": true, "qualifier": "fail", "includes": [] },
  "dmarc": { "found": false },
  "dkim": { "selectors_probed": 7, "keys_found": 0, "keys": [] },
  "mta_sts": { "found": false },
  "tls_rpt": { "found": false },
  "bimi": { "found": false }
}

Pricing (pay-per-event)

Event	Unit	Price
actor-start	per run	$0.0005
domain-audited	per domain fully audited (all record sets pulled)	$0.01
issue-flagged	per issue flagged (capped at 8/domain)	$0.005

Worked cost example — auditing a portfolio of 100 domains, average 3 issues each: actor-start ($0.0005) + 100 × domain-audited (100 × $0.01 = $1.00) + 300 × issue-flagged (300 × $0.005 = $1.50) = ~$2.51 for 100 domains (≈ 2.5¢ per domain).

Compare: a one-off DMARC/SPF scan from a deliverability vendor runs $15–$50/domain.

Integration

• API / SDK — standard Apify actor; call via HTTP API, JavaScript/Python SDK, or Schedule.
• Webhooks — set an actor webhook to POST results to Make/n8n/Zapier on run completion.
• Bulk — pass up to thousands of domains in the domains array; queries run sequentially with polite timeouts.
• Clay / lead-enrichment — outputs are flat JSON, ready for Clay/GSC enrichment tables.

Frequently asked questions

What is an email deliverability audit? An email deliverability audit checks a domain's DNS records to determine whether its outgoing mail is authenticated and secure. This actor inspects MX, SPF, DKIM, DMARC, DNSSEC, MTA-STS, TLS-RPT, and BIMI, then scores the domain 0–100 with a prioritized fix list.

How do I check my DMARC policy? Run any domain through this actor. The DMARC check queries _dmarc.<domain> and returns the policy — none, quarantine, or reject — plus the parsed sp, pct, rua, and ruf tags. If no record is found, the fix field tells you exactly which TXT record to publish.

What is a good domain posture score? Scores 80–100 (A–B grade) indicate strong email authentication with DMARC enforcement, DKIM signing, and MTA-STS enabled. Scores below 60 mean critical gaps exist — typically missing DMARC or an overly permissive SPF +all policy. The output lists the highest-impact fix first.

What does SPF +all mean and how do I fix it? An SPF record ending in +all (or no explicit all qualifier) tells receiving servers to accept mail from any IP address — the domain is trivially spoofable. Fix by replacing +all with -all (hard fail) or ~all (soft fail), and ensure every legitimate sending source is listed in the include: statements.

What is MTA-STS and do I need it? MTA Strict Transport Security (RFC 8461) forces inbound mail servers to use TLS, preventing STARTTLS downgrade attacks. You need it if your domain accepts email and you want to guarantee encrypted delivery. Configure a _mta-sts TXT record and serve a policy file at mta-sts.<domain>/.well-known/mta-sts.txt.

Can I audit thousands of domains in one go? Yes. Pass an array of up to several thousand domain names in the domains input field. Each domain is audited sequentially with polite timeouts — no rate-limit risk. The output is one result object per domain for easy post-processing.

Does this check live mailbox deliverability? No — this actor inspects published DNS posture, not live SMTP responses. For mailbox-level probing (bounce detection, SMTP handshake), pair it with a dedicated SMTP-check actor.

Limitations & honest notes

• DKIM is selector-based. DKIM public keys live at <selector>._domainkey.<domain> — there is no "list all DKIM keys" DNS query. We probe the common selectors (google, default, selector1, selector2, s1, k1, mail) plus any custom selectors you provide. A domain using a non-standard selector without you supplying it will report dkim_found: false even though it signs mail.
• DNSSEC detection uses the DoH resolver's AD (Authentic Data) flag. Rare split-horizon or private-DNS setups may report differently than a validating resolver on your network.
• MTA-STS requires fetching a policy file over HTTPS from mta-sts.<domain> — a handful of domains do not have this subdomain configured even when they publish a _mta-sts TXT.
• No SMTP handshake / mailbox-probe. This actor inspects published DNS posture, not live mailbox state. Pair with a dedicated SMTP-probe actor for bounce-list cleaning.
• No personal data. All inputs are domain names; outputs are DNS records and posture scores. Incidental emails in SPF/DMARC rua reporting addresses are operator-published infrastructure config, not collected personal data.

Data sources

All DNS records resolved via DNS-over-HTTPS public resolvers (Cloudflare 1.1.1.1, Google Public DNS) using the standard DoH JSON API. MTA-STS policy fetched over HTTPS from the domain's own well-known endpoint. No third-party APIs, no scraping, no API keys.

Related Apify Actors

• SSL/TLS Certificate Expiry Monitor — Check TLS certificate expiry, issuer changes, and SAN drift across your domain portfolio. Complements email posture auditing by verifying the TLS layer your mail servers depend on.
• HTTP Security Headers & OWASP Posture Auditor — Audit your web application's security headers, CSP, and OWASP-recommended protections. Use alongside email posture checks for a full-domain security picture.
• GEO & llms.txt Readiness Auditor — Check your domain's AI crawler access policies and llms.txt, sitemap, and robots.txt configuration for generative-engine optimisation.