SPF DMARC Checker — Email Security & Deliverability Audit

🇨🇳 SPF / DMARC 检查器：批量审计任意域名的邮件安全：MX 与邮件服务商、SPF（限定符、include、查询次数）、DMARC 策略与报告、常见 DKIM 选择器、BIMI、MTA-STS 和 TLS-RPT，并给出 A–F 评分和问题清单。无需 API 密钥，按域名付费。

🇸🇬 Pemeriksa SPF DMARC: audit keselamatan e-mel pukal untuk senarai domain: MX, SPF, DMARC, DKIM, BIMI dan MTA-STS dengan gred A–F dan senarai isu. Tiada kunci API.

🤖 NEW: Connect This To Your AI!

Use this actor from Claude, ChatGPT, Cursor or any MCP client through the IntelScrape MCP Server, or call it directly over the Apify API.

🏆 Featured Bots by IntelScrape

• Skip Trace Pro
• TruePeopleSearch Scraper
• TikTok Email Scraper
• Amazon Product Reviews Scraper
• Website Contact Scraper
• Skip Trace MCP Server

⚡ Works with n8n, Make, Zapier, Google Sheets and the Apify API.

One row per domain with MX provider, SPF, DMARC, DKIM, BIMI, MTA-STS, TLS-RPT, a 0–100 score, an A–F grade and the exact issues to fix.

Honest coverage & billing: DKIM is detected only on common or supplied selectors. You pay only for results actually delivered, and a built-in cost guard stops the run at your max-charge limit.

🌍 Built for teams in the US, China and Singapore, and anyone who needs this data in a spreadsheet or pipeline.

⭐ Found it useful? Please leave a review; it helps others find it.

⚖️ Lawful business use only. Collect public data only, and comply with the source site's terms, copyright and data-protection laws (GDPR, CCPA, China PIPL, Singapore PDPA).

Examples below are illustrative; names and values may be fictional or out of date.

What is SPF DMARC Checker?

Since Google and Yahoo started enforcing sender requirements, a missing DMARC record or a broken SPF can send a whole company's email to spam. Checking one domain in a web tool is easy; checking 5,000 client, prospect or vendor domains is not. SPF DMARC Checker audits every domain in your list over public DNS and returns a score, a grade and a plain-English list of what is wrong, ready for a report, a sales pitch or a security review.

What does it do?

• MX & mail provider: MX hosts by priority and the detected provider (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast and more)
• SPF: record, all-qualifier (-all / ~all / ?all), includes, top-level DNS lookup count and multiple-record errors
• DMARC: policy (none / quarantine / reject), subdomain policy, pct, rua and ruf report addresses
• DKIM scan (on by default): 20 common selectors plus your own, with key type and revoked keys
• BIMI, MTA-STS and TLS-RPT records, including the BIMI logo URL
• Score & grade: 0–100 and A–F with a plain-English issue list per domain
• Bulk: domains, URLs or email addresses as input; 6 domains in parallel

Why choose us over cheaper scrapers?

• Honest output: limits are documented, missing data is labeled, never invented
• Clean, consistent schema ready for Excel, Sheets, BI tools or an LLM
• No account risk: no logins, no cookies, no API keys
• Pay per result with a built-in cost guard; no subscription, failed items are never charged
• Fast and light: no residential proxy, so runs finish in seconds and stay cheap
• Maintained by IntelScrape and fixed fast when the source changes

Who is it for?

• MSPs & IT security: audit every client domain and prioritise fixes
• Cold-email & deliverability teams: check sending domains before campaigns
• Agencies & SaaS sales: find prospects with p=none or no DMARC and pitch a fix
• Vendor & supply-chain risk: score partner domains for spoofing risk
• Compliance: document DMARC enforcement across a domain portfolio
• Researchers: measure DMARC adoption across industries or countries

How to use it

In Apify Console (no code)

1. Click Try for free / Start. The form is prefilled with a working example.
2. Change the inputs (see examples below).
3. Click Start, then export the results as JSON, CSV, Excel, XML or HTML, or open them in Google Sheets.
4. Optional: Schedule the actor to run hourly, daily or weekly.

Via API

curl -X POST "https://api.apify.com/v2/acts/intelscrape~dns-email-security-checker/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["google.com", "apify.com", "example.com"], "dkimScan": true}'

Or use the official Apify JavaScript and Python clients:

from apify_client import ApifyClient
client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("intelscrape/dns-email-security-checker").call(run_input={"domains": ["google.com", "apify.com", "example.com"], "dkimScan": true})
for item in client.dataset(run["default_dataset_id"]).iterate_items():
    print(item)

With AI agents (MCP)

Add Apify's MCP server (https://mcp.apify.com) or the IntelScrape MCP Server to Claude Desktop, Cursor, ChatGPT or any MCP client, then ask in plain language, e.g. "Run intelscrape/dns-email-security-checker with the default input and summarise the results."

Input examples

Three domains with DKIM scan (default)

{
  "domains": ["google.com", "apify.com", "example.com"],
  "dkimScan": true
}

Prospect list from emails, no DKIM scan

{
  "domains": ["ceo@acme.com", "https://www.shopify.com", "stripe.com"],
  "dkimScan": false
}

Custom DKIM selector

{
  "domains": ["mycompany.com"],
  "extraSelectors": ["mycorp2024", "hs1"]
}

Output fields

Field	Description
domain	Checked domain
score / grade	0–100 score and A–F grade
issues[]	Plain-English problems found
mailProvider / mx[]	Detected provider and MX hosts by priority
spfRecord / spfAllQualifier / spfIncludes / spfTopLevelLookups	SPF details
dmarcRecord / dmarcPolicy / dmarcSubdomainPolicy / dmarcPct / dmarcRua / dmarcRuf	DMARC details
dkim.found[]	selector, keyType, publicKeyLength, revoked
bimiRecord / bimiLogoUrl	BIMI record and logo
mtaStsRecord / tlsRptRecord	Transport security records
otherTxtVerifications	Service verification TXT records found (e.g. google-site-verification), a hint of the SaaS tools in use
checkedAt	Check time

Sample output

{
  "domain": "apify.com",
  "score": 100,
  "grade": "A",
  "issues": [],
  "mailProvider": "Google Workspace",
  "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com … -all",
  "spfAllQualifier": "-all",
  "spfTopLevelLookups": 6,
  "dmarcPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": "mailto:dmarc-reports@apify.com",
  "dkim": { "selectorsTested": 20, "found": [{ "selector": "google", "keyType": "rsa", "publicKeyLength": 392, "revoked": false }] }
}

Pricing (pay per event)

Event	When it is charged	Price
Actor start	once per run	$0.005
Domain check	per domain audited	$0.003
DKIM scan	per domain with the selector scan (on by default; turn off to skip)	$0.001

Cost examples

Run	Cost
Default run: 3 domains	$0.017
1,000 domains with DKIM scan	$4.005
10,000 domains, no DKIM scan	$30.005

Platform usage is included in these prices. Set Max charge per run in the run options to cap spend; the actor stops cleanly when the limit is reached and keeps everything collected so far.

Tips for best results

• Paste email addresses directly; the domain is extracted and duplicates are removed.
• If you know a domain's DKIM selector (from an email header s= tag), add it to extraSelectors.
• Sort by score to build a prospect list of domains with weak protection.
• Schedule monthly to track DMARC rollout across your clients.

FAQ

Does it send any email?

No. It only reads public DNS records over DNS-over-HTTPS (Cloudflare with Google as fallback).

Why is DKIM "not found" when the domain signs mail?

DKIM keys live under a selector name that is not published anywhere. We test 20 common ones; custom selectors need to be added in extraSelectors.

How is the score calculated?

Start at 100 and subtract for each issue: missing SPF or DMARC (-25 each), p=none (-12), soft problems like missing rua or partial pct (smaller deductions). The issue list shows exactly what was deducted.

Does it follow SPF includes recursively?

It counts top-level lookup mechanisms; deeply nested include chains are not expanded, so treat the count as a minimum.

Is it accurate?

The records are read live from public DNS at run time, the same data any mail server sees.

Do I need an API key?

No.

Honest limits

• DKIM is detected only on common or supplied selectors.
• SPF lookup count covers top-level mechanisms only (nested includes are not expanded).
• MTA-STS policy files are not downloaded; only the DNS record is checked.
• The score is a heuristic for prioritisation, not a certification.

Related IntelScrape bots

• Gravatar Lookup: email to public profile
• Email Verifier: check if emails are deliverable
• Data Breach Checker: check emails against known breaches
• WHOIS Domain Lookup: registrar, dates & owner data
• Tech Stack Detector: CMS, analytics & frameworks per domain
• Skip Trace MCP Server: IntelScrape tools for AI agents

Legal

This actor collects publicly available data only. You are responsible for using the results lawfully and in line with the source's terms and applicable privacy laws (GDPR, CCPA, PIPL, PDPA). Process personal data only with a legitimate purpose. IntelScrape is not affiliated with, endorsed by or sponsored by the data source; all trademarks belong to their owners.