DNS and Email Auth — records, SPF, DMARC, MTA-STS and DKIM

Give it domains; it returns their DNS records (A, AAAA, CNAME, MX, NS, TXT, CAA, SOA) and an email-authentication assessment: SPF parsed with its DNS-lookup count against the limit of ten, DMARC policy and alignment, MTA-STS and TLS-RPT presence, BIMI, DKIM keys for selectors you name, and DNSSEC — as findings with severity. Reporting addresses in DMARC records are reported as present, by domain only.

Development validation produced actual successful public-input records using the production Dockerfile and SDK entrypoint on GitHub-hosted Linux. The smoke input, all three tasks and every defined benchmark passed their exact expectations. The independent review completed on 2026-10-19; its findings are tracked in the committed fix report. Platform costs, settlement, publication and daily tests remain unverified.

Call it from an agent

Through Apify's MCP server (https://mcp.apify.com) use call-actor:

{
  "actor": "hermeskd/dns-and-email-auth",
  "input": {
    "domains": [
      "apify.com"
    ]
  },
  "callOptions": {
    "maxTotalChargeUsd": 0.05,
    "timeout": 600
  },
  "waitSecs": 30
}

Then call get-dataset-items with the returned defaultDatasetId. Dedicated tool URL: https://mcp.apify.com?tools=hermeskd/dns-and-email-auth

Input

Field	Type	Meaning
domains	array	Domain names, not URLs or IP addresses; internationalized names use IDNA.
dkimSelectors	array	Only these selectors are queried; no selector enumeration.

Output

Field	Meaning
domain	Normalized domain, or original invalid input.
ok	True when records were resolved and a readable assessment was produced.
records	A, AAAA, CNAME, MX, NS, TXT, CAA and SOA; report mailboxes redacted and SOA rname omitted.
spf	Static recursive SPF term assessment; macro-dependent validity null, not a sender/IP authorization verdict.
dmarc	Policy/alignment and reporting destination domains only.
mtaSts	MTA-STS TXT presence/id validation only; no HTTPS policy claim.
tlsRpt	TLS-RPT TXT presence and reporting domains only.
bimi	Default-selector BIMI TXT presence only; no logo/certificate validation.
dkim	Caller-named selector key assessments; RSA DER parsed; unsupported algorithms unassessed.
dnssec	Recursive resolver evidence, not local cryptographic validation.
findings	Authentication findings.
error	Failure, always uncharged.

Actual production-container record from 2026-10-18T20:24:14.998485+00:00 (code f063187693578dd7551fa2bec552281e2f0f3e33, smoke input, SDK local storage). The saved record is unchanged; local event logs do not prove Apify settlement.

{
  "domain": "apify.com",
  "ok": true,
  "records": {
    "A": [
      "3.170.42.100",
      "3.170.42.68",
      "3.170.42.109",
      "3.170.42.76"
    ],
    "AAAA": [
      "2600:9000:2870:5800:9:a03e:6540:93a1",
      "2600:9000:2870:1800:9:a03e:6540:93a1",
      "2600:9000:2870:1600:9:a03e:6540:93a1",
      "2600:9000:2870:5000:9:a03e:6540:93a1",
      "2600:9000:2870:400:9:a03e:6540:93a1",
      "2600:9000:2870:c800:9:a03e:6540:93a1",
      "2600:9000:2870:e200:9:a03e:6540:93a1",
      "2600:9000:2870:9a00:9:a03e:6540:93a1"
    ],
    "CNAME": [],
    "MX": [
      {
        "preference": 1,
        "exchange": "aspmx.l.google.com"
      },
      {
        "preference": 10,
        "exchange": "aspmx2.googlemail.com"
      },
      {
        "preference": 10,
        "exchange": "aspmx3.googlemail.com"
      },
      {
        "preference": 5,
        "exchange": "alt1.aspmx.l.google.com"
      },
      {
        "preference": 5,
        "exchange": "alt2.aspmx.l.google.com"
      }
    ],
    "NS": [
      "ns-449.awsdns-56.com.",
      "ns-839.awsdns-40.net.",
      "ns-1225.awsdns-25.org.",
      "ns-1928.awsdns-49.co.uk."
    ],
    "TXT": [
      "aisle-domain-verification-ymx7gd=j3J4hCmXHIc9R0RNQCfa8xdSf",
      "google-site-verification=R_4agUZyHorQrO5QGFa6ZB_o-uDxq82NY-EteDUpPvo",
      "google-site-verification=XU737OZxx6NvGd3NQK9MRt98qxRMjx3RByq-O0cy16I",
      "google-site-verification=ZqRh2_YSBHj2bo_KsEdu6MfmTMKJYLpDDL3oPtOrN_A",
      "google-site-verification=jrECJwBG9eeO_FUrOMhp7JY1oF8JSBxhzmLsLGvrt9s",
      "mixpanel-domain-verify=44615d9c-27f2-4587-a781-8a0a1c734e9a",
      "openai-domain-verification=dv-WTM7Nna92Owwh4sgmDOVUyyt",
      "tito-domain-verification=pbg2696rvzbax2t4dl7h5ynqm",
      "v=MCPv1; k=ed25519; p=1rDnoEigwTr+4JjG89+sLbdNnswCnLjmaeT34srW53Y=",
      "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
      "zapier-domain-verification-challenge=2c358aa9-fa36-419f-b21a-ca9eb6f2791d"
    ],
    "CAA": [
      "0 issue \"amazonaws.com\"",
      "0 issue \"digicert.com\"",
      "0 issue \"letsencrypt.org\"",
      "0 issuewild \"amazonaws.com\"",
      "0 issuewild \"letsencrypt.org\""
    ],
    "SOA": [
      {
        "mname": "ns-839.awsdns-40.net",
        "serial": 1,
        "refresh": 7200,
        "retry": 900,
        "expire": 1209600,
        "minimum": 86400
      }
    ]
  },
  "spf": {
    "record": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
    "mechanisms": [
      "a",
      "mx",
      "include:_spf.google.com",
      "include:mailgun.org",
      "include:amazonses.com",
      "include:19497222.spf05.hubspotemail.net",
      "-all"
    ],
    "lookups": 10,
    "allQualifier": "-",
    "valid": true
  },
  "dmarc": {
    "policy": "reject",
    "subdomainPolicy": "reject",
    "pct": 100,
    "alignment": {
      "dkim": "r",
      "spf": "r"
    },
    "reportingDomains": [
      "apify.com"
    ]
  },
  "mtaSts": {
    "present": true,
    "id": "29919a352ef9476a",
    "valid": true
  },
  "tlsRpt": {
    "present": true,
    "valid": true,
    "reportingDomains": [
      "apify.com"
    ]
  },
  "bimi": {
    "present": true
  },
  "dkim": {},
  "dnssec": {
    "validated": false,
    "evidence": "recursive-resolver AD flag on NS response; no local signature validation"
  },
  "findings": []
}

Events and prices

Event	Title	Charged when	FREE / BRONZE	SILVER	GOLD / PLATINUM / DIAMOND
domain-checked	Domain checked	One domain resolved and assessed successfully.	$0.002	$0.0018	$0.0016

Platform usage is not passed through. Apify's automatic actor-start event remains $0.00005 per started GB (one GB or less counts once). The synthetic dataset-item event is absent. Charge limits stop further paying work; unprocessed inputs receive uncharged errors. Completed readable pending events are settled on abort.

Worked cost example: ten successful primary events cost $0.02 at list, plus actor start. Failures are not included in that count.

Limits and run time

1–100 domains and at most 20 caller-named DKIM selectors. Queries use the configured recursive resolver with a five-second lifetime; no selector guessing. SPF reports the known recursive lookup-causing term count, stopping at eleven; it does not authenticate a sender/IP. Macro-dependent validity is null. DNSSEC validated is the resolver AD flag on the NS response, not local cryptographic validation or mere DS presence. MTA-STS is a TXT check, not an HTTPS policy check. BIMI is default-selector TXT presence only. Report mailboxes are removed even from raw TXT/CAA values, and SOA rname is omitted.

Default run timeout is 600 seconds. Typical cold platform time, costs and the smallest passing memory have not been measured for this new implementation. Memory probes are evidence to collect later; configured memories are specification defaults, not measured claims.

Errors

Code	Meaning
nxdomain	The DNS name does not exist.
servfail	The configured recursive resolver could not answer.
invalid_domain	Input is not a valid domain name.
timeout	The input did not finish within the run's time budget.
invalid_input	The run input passed the input schema but cannot be used; the message names the field.
internal_error	Unexpected failure; the message carries the error class.
charge_limit_reached	The run reached its maximum total charge; this input was not processed.
robots_disallowed	robots.txt forbids fetching the URL; no request was made to it.
blocked_host	The host is on the deny-list or resolves to a private or local address; no request was made.
download_failed	The request or connection failed within its bounded deadline.

No failure record is charged. A run fails only when all input outcomes are Actor-side failures; caller errors and a mixture of caller/Actor failures do not fail the run.

Sources and terms

Public DNS protocol records are queried through the configured recursive resolver under a five-second query lifetime, with no alternate resolver selected by the Actor. Queries are a few dozen per domain; use resolvers fairly. Only caller-named DKIM selectors are queried. Reporting mailbox local parts are removed from raw records and assessments; SOA rname is omitted. DNSSEC validated reports recursive-resolver AD evidence, not local cryptographic validation. BIMI is presence only; no certificate, logo or identity verification is claimed. No caller credentials, cookies, SMTP login or sending is involved. The 2026-10-18 GitHub-hosted production-container run resolved public DNS and produced the genuine record shown above. Cloud resolver access remains blocked; platform execution and settlement are unverified.

Not affiliated

This Actor is not affiliated with Google, Apify, IANA, Verisign or other named protocol/source providers. Third-party names describe compatibility and source material.

Related Hermes Actors

website-screenshot, lighthouse-audit, seo-page-audit, domain-availability, dns-and-email-auth, broken-links and sitemap-urls.

Changelog

2026-10-17 (historical): initial implementation and fixture contracts; packaging and public production validation were incomplete on that date.

2026-10-18: all six production images, public smoke inputs, three tasks per Actor and defined benchmarks passed on GitHub-hosted Linux; exact code, records and image provenance are retained with the examples. These local SDK runs do not prove platform costs, settlement, publication, minimum memory, daily tests or payouts.

2026-10-19: independent-review repairs cover DNS privacy, malformed publisher URLs, empty sitemap failures, responsive assets and schema prefill, as applicable to this Actor. See the committed unit 4 fix report for measured verification and remaining platform NO-COVERAGE.