DNS Lookup — Records, SPF Lookup Counts, DKIM & DMARC by Domain

DNS lookup and email authentication checks for domain lists: return DNS records, SPF lookup counts, DMARC alignment and DKIM keys for supplied selectors, with severity-ranked findings. AI agents can call and pay through Apify MCP. List event rates are $0.002 per domain checked; start is extra, usage is included and failed results are uncharged.

Example result

Example record for the minimal input under How to use it, as this Actor returned it on 2026-10-18 in a run of its production image; the record is kept unchanged with the release.

{
  "domain": "apify.com",
  "ok": true,
  "records": {
    "A": [
      "3.170.42.100",
      "3.170.42.68",
      "3.170.42.109",
      "3.170.42.76"
    ],
    "AAAA": [
      "2600:9000:2870:5800:9:a03e:6540:93a1",
      "2600:9000:2870:1800:9:a03e:6540:93a1",
      "2600:9000:2870:1600:9:a03e:6540:93a1",
      "2600:9000:2870:5000:9:a03e:6540:93a1",
      "2600:9000:2870:400:9:a03e:6540:93a1",
      "2600:9000:2870:c800:9:a03e:6540:93a1",
      "2600:9000:2870:e200:9:a03e:6540:93a1",
      "2600:9000:2870:9a00:9:a03e:6540:93a1"
    ],
    "CNAME": [],
    "MX": [
      {
        "preference": 1,
        "exchange": "aspmx.l.google.com"
      },
      {
        "preference": 10,
        "exchange": "aspmx2.googlemail.com"
      },
      {
        "preference": 10,
        "exchange": "aspmx3.googlemail.com"
      },
      {
        "preference": 5,
        "exchange": "alt1.aspmx.l.google.com"
      },
      {
        "preference": 5,
        "exchange": "alt2.aspmx.l.google.com"
      }
    ],
    "NS": [
      "ns-449.awsdns-56.com.",
      "ns-839.awsdns-40.net.",
      "ns-1225.awsdns-25.org.",
      "ns-1928.awsdns-49.co.uk."
    ],
    "TXT": [
      "aisle-domain-verification-ymx7gd=j3J4hCmXHIc9R0RNQCfa8xdSf",
      "google-site-verification=R_4agUZyHorQrO5QGFa6ZB_o-uDxq82NY-EteDUpPvo",
      "google-site-verification=XU737OZxx6NvGd3NQK9MRt98qxRMjx3RByq-O0cy16I",
      "google-site-verification=ZqRh2_YSBHj2bo_KsEdu6MfmTMKJYLpDDL3oPtOrN_A",
      "google-site-verification=jrECJwBG9eeO_FUrOMhp7JY1oF8JSBxhzmLsLGvrt9s",
      "mixpanel-domain-verify=44615d9c-27f2-4587-a781-8a0a1c734e9a",
      "openai-domain-verification=dv-WTM7Nna92Owwh4sgmDOVUyyt",
      "tito-domain-verification=pbg2696rvzbax2t4dl7h5ynqm",
      "v=MCPv1; k=ed25519; p=1rDnoEigwTr+4JjG89+sLbdNnswCnLjmaeT34srW53Y=",
      "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
      "zapier-domain-verification-challenge=2c358aa9-fa36-419f-b21a-ca9eb6f2791d"
    ],
    "CAA": [
      "0 issue \"amazonaws.com\"",
      "0 issue \"digicert.com\"",
      "0 issue \"letsencrypt.org\"",
      "0 issuewild \"amazonaws.com\"",
      "0 issuewild \"letsencrypt.org\""
    ],
    "SOA": [
      {
        "mname": "ns-839.awsdns-40.net",
        "serial": 1,
        "refresh": 7200,
        "retry": 900,
        "expire": 1209600,
        "minimum": 86400
      }
    ]
  },
  "spf": {
    "record": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
    "mechanisms": [
      "a",
      "mx",
      "include:_spf.google.com",
      "include:mailgun.org",
      "include:amazonses.com",
      "include:19497222.spf05.hubspotemail.net",
      "-all"
    ],
    "lookups": 10,
    "allQualifier": "-",
    "valid": true
  },
  "dmarc": {
    "policy": "reject",
    "subdomainPolicy": "reject",
    "pct": 100,
    "alignment": {
      "dkim": "r",
      "spf": "r"
    },
    "reportingDomains": [
      "apify.com"
    ]
  },
  "mtaSts": {
    "present": true,
    "id": "29919a352ef9476a",
    "valid": true
  },
  "tlsRpt": {
    "present": true,
    "valid": true,
    "reportingDomains": [
      "apify.com"
    ]
  },
  "bimi": {
    "present": true
  },
  "dkim": {},
  "dnssec": {
    "validated": false,
    "evidence": "recursive-resolver AD flag on NS response; no local signature validation"
  },
  "findings": []
}

How to use it

Start a run in Apify Console, by API or from an agent with an input like this one — it is the input Apify runs every day to test this Actor:

{"domains": ["apify.com"]}

Start with the minimal JSON example above, then adjust the fields in the table below. Read the Example result and Output fields sections for the returned record, Errors for failure codes, and Events and prices for result events and the separate platform start.

Field	Type	Meaning
domains	array	Domain names, not URLs or IP addresses; internationalized names use IDNA.
dkimSelectors	array	Only these selectors are queried; no selector enumeration.

Events and prices

Event	Title	Charged when	FREE / BRONZE	SILVER	GOLD / PLATINUM / DIAMOND
domain-checked	Domain checked	One domain resolved and assessed successfully.	$0.002	$0.0018	$0.0016

Platform usage is not passed through. Apify's automatic actor-start event remains $0.00005 per started GB (one GB or less counts once). The synthetic dataset-item event is absent. Charge limits stop further paying work; unprocessed inputs receive uncharged errors. Completed readable pending events are settled on abort.

Worked cost example: ten successful primary events cost $0.02 at list, plus actor start. Failures are not included in that count.

Call it from an agent

Through Apify's MCP server (https://mcp.apify.com) use call-actor:

{
  "actor": "hermeskd/dns-and-email-auth",
  "input": {
    "domains": [
      "apify.com"
    ]
  },
  "callOptions": {
    "maxTotalChargeUsd": 0.05,
    "timeout": 600
  },
  "waitSecs": 30
}

Then call get-dataset-items with the returned defaultDatasetId. Dedicated tool URL: https://mcp.apify.com?tools=hermeskd/dns-and-email-auth

Output fields

Field	Meaning
domain	Normalized domain, or original invalid input.
ok	True when records were resolved and a readable assessment was produced.
records	A, AAAA, CNAME, MX, NS, TXT, CAA and SOA; report mailboxes redacted and SOA rname omitted.
spf	Static recursive SPF term assessment; macro-dependent validity null, not a sender/IP authorization verdict.
dmarc	Policy/alignment and reporting destination domains only.
mtaSts	MTA-STS TXT presence/id validation only; no HTTPS policy claim.
tlsRpt	TLS-RPT TXT presence and reporting domains only.
bimi	Default-selector BIMI TXT presence only; no logo/certificate validation.
dkim	Caller-named selector key assessments; RSA DER parsed; unsupported algorithms unassessed.
dnssec	Recursive resolver evidence, not local cryptographic validation.
findings	Authentication findings.
error	Failure, always uncharged.

Limits and run time

1–100 domains and at most 20 caller-named DKIM selectors. Queries use the configured recursive resolver with a five-second lifetime; no selector guessing. SPF reports the known recursive lookup-causing term count, stopping at eleven; it does not authenticate a sender/IP. Macro-dependent validity is null. DNSSEC validated is the resolver AD flag on the NS response, not local cryptographic validation or mere DS presence. MTA-STS is a TXT check, not an HTTPS policy check. BIMI is default-selector TXT presence only. Report mailboxes are removed even from raw TXT/CAA values, and SOA rname is omitted.

The default run timeout is 600 seconds. Typical run time on Apify, measured by its deploy of 2026-10-21: the minimal input under How to use it took 3–4 seconds a run at the default 512 MB (three runs, peak memory 51 MiB). The same input also ran and passed the pricing floor at 256 MB and 1,024 MB (the deploy's memory probes).

Errors

Code	Meaning
nxdomain	The DNS name does not exist.
servfail	The configured recursive resolver could not answer.
invalid_domain	Input is not a valid domain name.
timeout	The input did not finish within the run's time budget.
invalid_input	The run input passed the input schema but cannot be used; the message names the field.
internal_error	Unexpected failure; the message carries the error class.
charge_limit_reached	The run reached its maximum total charge; this input was not processed.
robots_disallowed	robots.txt forbids fetching the URL; no request was made to it.
blocked_host	The host is on the deny-list or resolves to a private or local address; no request was made.
download_failed	The request or connection failed within its bounded deadline.

No failure record is charged. A run fails only when all input outcomes are Actor-side failures; caller errors and a mixture of caller/Actor failures do not fail the run.

Sources and terms

Public DNS protocol records are queried through the configured recursive resolver under a five-second query lifetime, with no alternate resolver selected by the Actor. Queries are a few dozen per domain; use resolvers fairly. Only caller-named DKIM selectors are queried. Reporting mailbox local parts are removed from raw records and assessments; SOA rname is omitted. DNSSEC validated reports recursive-resolver AD evidence, not local cryptographic validation. BIMI is presence only; no certificate, logo or identity verification is claimed. No caller credentials, cookies, SMTP login or sending is involved. The 2026-10-18 GitHub-hosted production-container run resolved public DNS and produced the genuine record shown above.

Not affiliated

This Actor is not affiliated with Google, Apify, IANA, Verisign or other named protocol/source providers. Third-party names describe compatibility and source material.

Related Hermes Actors

• AI Crawler Checker: Which AI Bots robots.txt Allows per URL — check declared robots.txt permissions for six AI crawlers at URL paths.
• Article Extractor — News & Blog Text, Date and Markdown by URL — an article's clean text, title and publish date, without the rest of the page.
• ATS Job Search — Jobs Confirmed Open on Company Career Boards — search open jobs in the Hermes directory of Greenhouse and Lever boards, each confirmed live.
• Speech to Text — Transcribe Audio & Video URLs, Speaker Labels — speech to text with SRT and VTT subtitles.
• Video Converter — MP4 to MP3, Trim, GIF and Audio Extraction — audio and video conversion: MP4 to MP3, trim, GIF.
• Broken Links Checker — Links, Assets, Redirects and Their Pages — broken links, 404s and redirects on a site.
• ATS Detector — Company Hiring System & Job Board Lookup — which hiring system and job board a company uses.
• SEC EDGAR Filings — Recent Company Forms, Dates and XBRL Flags — Read recent company financial filing metadata from the official SEC JSON API
• DOI Lookup — Crossref Titles, Venues, Dates and Citation Counts — crossref doi metadata.
• CVE Vulnerability Lookup — NVD CVSS Scores and Exploited Flags — look up NVD CVE dates, status, numeric CVSS scores and severity.
• Merge JSON Datasets — Deduplicate Rows, Export JSON and CSV — json dataset cleaner.
• DOCX to Markdown — Word, Excel, PowerPoint and EPUB Converter — Word, Excel, PowerPoint and other office files to Markdown.
• Domain Availability Checker — Bulk RDAP Status and Registrar — whether domain names are available, from registry RDAP.
• USGS Earthquake Lookup — Event Magnitude, Depth, Coordinates — Read numeric USGS earthquake metadata for known event identifiers.
• Currency Exchange Rates — ECB Daily Euro Rates and Cross Pairs — Read latest ECB daily currency reference rates and calculated cross pairs.
• Bulk File Downloader — Save URL Lists to Storage With SHA-256 — files and images from URLs, saved with a public link each.
• GitHub Repo Stats — Stars, Forks, Subscribers and Open Issues — Read numeric metrics for known public GitHub repositories.
• Greenhouse Jobs — Live Openings, Offices and Apply Links — every open job on a company's Greenhouse board.
• Hacker News Story Metrics — Scores, Comment Counts, Timestamps — read numeric Hacker News story scores, timestamps and comment counts by ID.
• HTTP GET Request — Bulk Response Bodies, Status and SHA-256 — public http get.
• Security Headers Checker — HSTS, CSP, Framing, Nosniff by URL — Check seven declared HTTP security header families without returning raw values.
• Image Background Remover — U2NetP Cutouts for JPEG, PNG, WebP — Remove image backgrounds with the small U2NetP model and return transparent PNG pixels as base64
• Image Converter — JPEG, PNG and WebP With Resize and Quality — image format converter.
• Image Metadata Remover — EXIF and GPS Scrub, Pixels Verified — GPS location, camera serial numbers and other private metadata removed from photos, losslessly.
• Image to Text OCR — Text With Word Positions and Confidence — OCR: the text in images.
• Image Upscaler — Real-ESRGAN 2x/4x for Photos and Graphics — image upscaling 2x or 4x, and photo restoration.
• Lever Jobs Scraper — Job Board Postings With Salary, US & EU — every published job on a company's Lever site, global or EU.
• Lighthouse Audit — Lab Web Vitals and Scores, Mobile & Desktop — Lighthouse scores and Core Web Vitals.
• npm Package Lookup — Latest Version, License, Dependency Count — read latest npm package versions, license tokens and dependency counts.
• Website Change Monitor — Page Text Diffs Against Your Snapshots — what changed on a page since the last check.
• PDF to Markdown — PDF Parser & Text Extractor With OCR — PDF to Markdown and text, with OCR for scanned pages.
• Public Holidays Calendar — Holiday Dates for Five Countries — build offline public-holiday calendars for five countries and bounded years.
• Remote Jobs Search — Remote OK Jobs by Keyword, Tag and Salary — current remote jobs from Remote OK, with salary and listing links.
• Research Paper Search — OpenAlex Papers, DOIs, Citation Counts — Search OpenAlex for work-level paper metadata without authors, affiliations, abstracts or full text
• RSS Feed Reader — Atom and JSON Feed Parser With Enclosures — every item of an RSS, Atom or JSON feed.
• SEO Audit — On-Page Score, Meta Tags, Schema & Fix Guidance — an on-page SEO audit: meta tags, schema, headings and links.
• Sitemap Extractor — Unique URLs From XML, Gzip & Index Sitemaps — the URLs in a site's sitemaps.
• Text to Speech — Offline English, German, Spanish WAV Voices — Convert short nonpersonal texts to offline formant WAV speech for agents
• Time Zone Converter API — Convert one offset-qualified instant to named IANA time zones using pinned data.
• URL to Markdown — Clean Text for LLM & RAG, With Selectors — a public job page as clean Markdown where the site allows it (deny-listed job sites are refused).
• Extract Video Frames — Timed Stills by Interval or Scene Cut — frames, thumbnails and scenes from a video.
• Website Color Palette — CSS Colors With Alpha and Usage Counts — Extract declared website CSS color literals and counts from public HTML and bounded linked stylesheets
• Favicon Extractor — Icons, Touch Icons, Manifests, Theme Color — declared website icons, theme colors and manifest links.
• Website Screenshot — Full Pages, Elements, Dark Mode & PDF — screenshots and PDF prints of web pages.
• Tech Stack Detector — Website Technologies With Match Evidence — the technologies a website runs, detected live.
• Website Crawler to Markdown — Same-Site Pages for LLM and RAG — bounded whole-site Markdown with robots and crawl-delay enforced

Changelog

• 1.0 (2026-10-26) — store listing rewritten for the people and agents searching for this job: title, description, search-engine title and description, categories, and the README in the order a searcher reads it (what it does, a real result, how to use it, prices, the agent call).
• 1.0 (2026-10-21) — first public release on Apify Store, after the deploy's typical calls, memory probes, benchmarks and pricing floor passed on the platform.
• 1.0 (2026-10-19) — repairs from an independent review: DNS privacy, malformed publisher URLs, empty sitemap failures, responsive assets and schema prefill, as applicable to this Actor.
• 1.0 (2026-10-18) — the production image, smoke input, three example tasks and benchmarks passed on GitHub-hosted Linux.
• 1.0 (2026-10-17) — first implementation.