# Email Deliverability & Domain Posture Auditor (`gp005/email-deliverability-auditor`) Actor Audit email deliverability and domain posture in bulk: MX, SPF, DKIM (common selectors), DMARC policy, DNSSEC, MTA-STS, TLS-RPT, and BIMI. Returns a 0-100 posture score, a prioritized fix list, and per-record detail. Pure DNS-over-HTTPS — no scraping, no API keys. - **URL**: https://apify.com/gp005/email-deliverability-auditor.md - **Developed by:** [Geo](https://apify.com/gp005) (community) - **Categories:** Developer tools, Marketing - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $30.00 / 1,000 domain auditeds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Email Deliverability & Domain Posture Auditor > Bulk audit email deliverability posture: **MX · SPF · DKIM · DMARC · DNSSEC · MTA-STS · TLS-RPT · BIMI** — with a 0–100 score and a prioritized fix list. Audit a single domain or thousands. Pure **DNS-over-HTTPS** — no scraping, no proxies, no API keys. Built for **cold-email teams, IT/security teams, email-marketing agencies, and MSPs** who need to keep customer domains out of the spam folder. ### What it checks | Area | What we look for | Why it matters | |---|---|---| | **MX** | Mail-exchange records present and valid | Without MX, the domain can't receive mail at all | | **SPF** | TXT record at apex, `v=spf1`, includes, the `all=` policy, +all hazard, >10 lookups | Receiving servers reject spoofed mail from non-listed IPs | | **DKIM** | Probes common selectors (`google`, `default`, `selector1`, `selector2`, `s1`, `k1`, `mail`, …) for public signing keys | Cryptographic email signing — stops tampering and verifies sender | | **DMARC** | `_dmarc` TXT: policy `p=` (none/quarantine/reject), `sp`, `pct`, `rua` reporting | The master policy that tells receivers what to do with mail that fails SPF/DKIM | | **DNSSEC** | Authentic-Data flag on queries | Cryptographic chain of trust for DNS — stops cache poisoning | | **MTA-STS** | `_mta-sts` TXT + policy file at `mta-sts./.well-known/mta-sts.txt` (RFC 8461) | Forces TLS on inbound SMTP — stops STARTTLS downgrade / MITM | | **TLS-RPT** | `_smtp._tls` TXT (RFC 8460) | Daily reports on STARTTLS failures so you can detect misconfigurations | | **BIMI** | `default._bimi` TXT | Shows your logo in recipient inboxes (requires DMARC enforcement first) | Each domain gets a **0–100 posture score** (A–F grade), a sorted issue list (critical → info) with an exact **fix** string per issue, and a `top_fix` summary. ### Use cases - **Cold-email / outreach teams** — audit your sending domains before a campaign to maximize inbox placement. - **MSPs & agencies** — batch-audit your entire customer portfolio; flag every domain missing DMARC or with `+all` SPF. - **Security / IT teams** — detect email spoofing exposure (`p=none` DMARC, no MTA-STS, no DNSSEC) across your asset list. - **Deliverability consultants** — generate a prioritized fix list per domain in one run. - **Compliance** — confirm enforcement (`p=reject`, `-all`) before audits. ### Example input ```json { "domains": ["example.com", "github.com"], "dkimSelectors": ["google", "default", "selector1"] } ```` ### Example output (per domain) ```json { "domain": "example.com", "posture_score": 72, "posture_grade": "C", "spf_status": "fail", "dkim_found": false, "dmarc_policy": "none", "mta_sts": "absent", "dnssec": false, "issue_count": 4, "top_fix": "Publish an SPF TXT record at the domain apex, e.g. \"v=spf1 include:_spf.google.com -all\".", "issues": [ { "severity": "critical", "area": "DMARC", "message": "No DMARC record found…", "fix": "Publish a DMARC TXT at _dmarc.…" }, { "severity": "high", "area": "DKIM", "message": "No DKIM public keys found…", "fix": "Enable DKIM signing in your email provider…" } ], "mx": [], "spf": { "found": true, "qualifier": "fail", "includes": [] }, "dmarc": { "found": false }, "dkim": { "selectors_probed": 7, "keys_found": 0, "keys": [] }, "mta_sts": { "found": false }, "tls_rpt": { "found": false }, "bimi": { "found": false } } ``` ### Pricing (pay-per-event) | Event | Unit | Price | |---|---|---| | `actor-start` | per run | $0.0005 | | `domain-audited` | per domain fully audited (all record sets pulled) | $0.01 | | `issue-flagged` | per issue flagged (capped at 8/domain) | $0.005 | **Worked cost example** — auditing a portfolio of 100 domains, average 3 issues each: `actor-start` ($0.0005) + 100 × `domain-audited` (100 × $0.01 = $1.00) + 300 × `issue-flagged` (300 × $0.005 = $1.50) = **~$2.51 for 100 domains** (≈ 2.5¢ per domain). Compare: a one-off DMARC/SPF scan from a deliverability vendor runs $15–$50/domain. ### Integration - **API / SDK** — standard Apify actor; call via HTTP API, JavaScript/Python SDK, or Schedule. - **Webhooks** — set an actor webhook to POST results to Make/n8n/Zapier on run completion. - **Bulk** — pass up to thousands of domains in the `domains` array; queries run sequentially with polite timeouts. - **Clay / lead-enrichment** — outputs are flat JSON, ready for Clay/GSC enrichment tables. ### Limitations & honest notes - **DKIM is selector-based.** DKIM public keys live at `._domainkey.` — there is no "list all DKIM keys" DNS query. We probe the common selectors (`google`, `default`, `selector1`, `selector2`, `s1`, `k1`, `mail`) plus any custom selectors you provide. A domain using a non-standard selector without you supplying it will report `dkim_found: false` even though it signs mail. - **DNSSEC detection** uses the DoH resolver's AD (Authentic Data) flag. Rare split-horizon or private-DNS setups may report differently than a validating resolver on your network. - **MTA-STS** requires fetching a policy file over HTTPS from `mta-sts.` — a handful of domains do not have this subdomain configured even when they publish a `_mta-sts` TXT. - **No SMTP handshake / mailbox-probe.** This actor inspects published DNS posture, not live mailbox state. Pair with a dedicated SMTP-probe actor for bounce-list cleaning. - **No personal data.** All inputs are domain names; outputs are DNS records and posture scores. Incidental emails in SPF/DMARC `rua` reporting addresses are operator-published infrastructure config, not collected personal data. ### Data sources All DNS records resolved via **DNS-over-HTTPS** public resolvers (Cloudflare 1.1.1.1, Google Public DNS) using the standard DoH JSON API. MTA-STS policy fetched over HTTPS from the domain's own well-known endpoint. No third-party APIs, no scraping, no API keys. # Actor input Schema ## `domains` (type: `array`): Domains to audit for email deliverability posture. Ideally your own domains. The auditor queries DNS records (MX, TXT, A, AAAA, NS) via DNS-over-HTTPS and fetches the domain's published MTA-STS policy file. No login, no proxy, no API key. ## `dkimSelectors` (type: `array`): DKIM selectors to probe for public keys (e.g. google, default, selector1). Common ones are tried automatically; add your custom selectors here. ## `checkMTASTS` (type: `boolean`): Fetch the domain's MTA-STS policy file from mta-sts./.well-known/mta-sts.txt (RFC 8461). ## `checkBIMI` (type: `boolean`): Check for a BIMI record at default.\_bimi. (Brand Indicators for Message Identification). ## `timeoutSecs` (type: `integer`): Timeout for each DNS-over-HTTPS query or MTA-STS fetch. ## Actor input object example ```json { "domains": [ "yourbrand.com", "mail.yourbrand.com" ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "s1", "k1", "mail" ], "checkMTASTS": true, "checkBIMI": true, "timeoutSecs": 10 } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "example.com" ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "s1", "k1", "mail" ] }; // Run the Actor and wait for it to finish const run = await client.actor("gp005/email-deliverability-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": ["example.com"], "dkimSelectors": [ "google", "default", "selector1", "selector2", "s1", "k1", "mail", ], } # Run the Actor and wait for it to finish run = client.actor("gp005/email-deliverability-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "example.com" ], "dkimSelectors": [ "google", "default", "selector1", "selector2", "s1", "k1", "mail" ] }' | apify call gp005/email-deliverability-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=gp005/email-deliverability-auditor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Email Deliverability & Domain Posture Auditor", "description": "Audit email deliverability and domain posture in bulk: MX, SPF, DKIM (common selectors), DMARC policy, DNSSEC, MTA-STS, TLS-RPT, and BIMI. Returns a 0-100 posture score, a prioritized fix list, and per-record detail. Pure DNS-over-HTTPS — no scraping, no API keys.", "version": "0.1", "x-build-id": "mkFbFWDhoGCBdbPi4" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/gp005~email-deliverability-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-gp005-email-deliverability-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/gp005~email-deliverability-auditor/runs": { "post": { "operationId": "runs-sync-gp005-email-deliverability-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/gp005~email-deliverability-auditor/run-sync": { "post": { "operationId": "run-sync-gp005-email-deliverability-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Domains to audit", "type": "array", "description": "Domains to audit for email deliverability posture. Ideally your own domains. The auditor queries DNS records (MX, TXT, A, AAAA, NS) via DNS-over-HTTPS and fetches the domain's published MTA-STS policy file. No login, no proxy, no API key.", "items": { "type": "string" } }, "dkimSelectors": { "title": "DKIM selectors to probe", "type": "array", "description": "DKIM selectors to probe for public keys (e.g. google, default, selector1). Common ones are tried automatically; add your custom selectors here.", "default": [ "google", "default", "selector1", "selector2", "s1", "k1", "mail", "amazon", "sendgrid" ], "items": { "type": "string" } }, "checkMTASTS": { "title": "Check MTA-STS policy", "type": "boolean", "description": "Fetch the domain's MTA-STS policy file from mta-sts./.well-known/mta-sts.txt (RFC 8461).", "default": true }, "checkBIMI": { "title": "Check BIMI record", "type": "boolean", "description": "Check for a BIMI record at default._bimi. (Brand Indicators for Message Identification).", "default": true }, "timeoutSecs": { "title": "Per-request timeout (seconds)", "minimum": 3, "maximum": 30, "type": "integer", "description": "Timeout for each DNS-over-HTTPS query or MTA-STS fetch.", "default": 10 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```