# SPF DMARC Checker — Email Security & Deliverability Audit (`intelscrape/dns-email-security-checker`) Actor

SPF DMARC Checker: bulk email-security audit for any domain list. Checks MX and mail provider, SPF, DMARC policy, DKIM selectors, BIMI, MTA-STS and TLS-RPT, then grades each domain A–F with a plain-English issue list. No API key. Pay per domain.

- **URL**: https://apify.com/intelscrape/dns-email-security-checker.md
- **Developed by:** [IntelScrape](https://apify.com/intelscrape) (community)
- **Categories:** Developer tools, Lead generation, Marketing
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SPF DMARC Checker — Email Security & Deliverability Audit

![SPF DMARC Checker — Email Security & Deliverability Audit](https://api.apify.com/v2/key-value-stores/hRabN9WfDGrT4nSvV/records/dns-email-security-checker-banner.png)

🇨🇳 **SPF / DMARC 检查器**：批量审计任意域名的邮件安全：MX 与邮件服务商、SPF（限定符、include、查询次数）、DMARC 策略与报告、常见 DKIM 选择器、BIMI、MTA-STS 和 TLS-RPT，并给出 A–F 评分和问题清单。无需 API 密钥，按域名付费。

🇸🇬 **Pemeriksa SPF DMARC**: audit keselamatan e-mel pukal untuk senarai domain: MX, SPF, DMARC, DKIM, BIMI dan MTA-STS dengan gred A–F dan senarai isu. Tiada kunci API.

#### 🤖 NEW: Connect This To Your AI!

Use this actor from Claude, ChatGPT, Cursor or any MCP client through the **[IntelScrape MCP Server](https://apify.com/intelscrape/skip--trace)**, or call it directly over the Apify API.

#### 🏆 Featured Bots by IntelScrape

- [Skip Trace Pro](https://apify.com/intelscrape/skip-trace-pro)
- [TruePeopleSearch Scraper](https://apify.com/intelscrape/truepeoplesearch-scraper)
- [TikTok Email Scraper](https://apify.com/intelscrape/tiktok-scraper)
- [Amazon Product Reviews Scraper](https://apify.com/intelscrape/amazon-product-review-scraper)
- [Website Contact Scraper](https://apify.com/intelscrape/contact-info-scraper)
- [Skip Trace MCP Server](https://apify.com/intelscrape/skip--trace)

⚡ Works with n8n, Make, Zapier, Google Sheets and the Apify API.

![price](https://img.shields.io/badge/price-%243%20per%201K%20domains-blue) ![billing](https://img.shields.io/badge/billing-pay%20per%20domain-green) ![API key](https://img.shields.io/badge/API%20key-not%20required-brightgreen) ![checks](https://img.shields.io/badge/checks-7-orange)

**One row per domain with MX provider, SPF, DMARC, DKIM, BIMI, MTA-STS, TLS-RPT, a 0–100 score, an A–F grade and the exact issues to fix.**

> **Honest coverage & billing:** DKIM is detected only on common or supplied selectors. You pay only for results actually delivered, and a built-in cost guard stops the run at your max-charge limit.

🌍 Built for teams in the **US, China and Singapore**, and anyone who needs this data in a spreadsheet or pipeline.

⭐ Found it useful? Please leave a review; it helps others find it.

⚖️ **Lawful business use only.** Collect public data only, and comply with the source site's terms, copyright and data-protection laws (GDPR, CCPA, China PIPL, Singapore PDPA).

*Examples below are illustrative; names and values may be fictional or out of date.*

### What is SPF DMARC Checker?

Since Google and Yahoo started enforcing sender requirements, a missing DMARC record or a broken SPF can send a whole company's email to spam. Checking one domain in a web tool is easy; checking 5,000 client, prospect or vendor domains is not. **SPF DMARC Checker** audits every domain in your list over public DNS and returns a score, a grade and a plain-English list of what is wrong, ready for a report, a sales pitch or a security review.

### What does it do?

- **MX & mail provider**: MX hosts by priority and the detected provider (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast and more)
- **SPF**: record, all-qualifier (-all / ~all / ?all), includes, top-level DNS lookup count and multiple-record errors
- **DMARC**: policy (none / quarantine / reject), subdomain policy, pct, rua and ruf report addresses
- **DKIM scan (on by default)**: 20 common selectors plus your own, with key type and revoked keys
- **BIMI, MTA-STS and TLS-RPT** records, including the BIMI logo URL
- **Score & grade**: 0–100 and A–F with a plain-English issue list per domain
- **Bulk**: domains, URLs or email addresses as input; 6 domains in parallel

### Why choose us over cheaper scrapers?

- **Honest output**: limits are documented, missing data is labeled, never invented
- **Clean, consistent schema** ready for Excel, Sheets, BI tools or an LLM
- **No account risk**: no logins, no cookies, no API keys
- **Pay per result** with a built-in cost guard; no subscription, failed items are never charged
- **Fast and light**: no residential proxy, so runs finish in seconds and stay cheap
- **Maintained by IntelScrape** and fixed fast when the source changes

### Who is it for?

- **MSPs & IT security**: audit every client domain and prioritise fixes
- **Cold-email & deliverability teams**: check sending domains before campaigns
- **Agencies & SaaS sales**: find prospects with p=none or no DMARC and pitch a fix
- **Vendor & supply-chain risk**: score partner domains for spoofing risk
- **Compliance**: document DMARC enforcement across a domain portfolio
- **Researchers**: measure DMARC adoption across industries or countries

### How to use it

#### In Apify Console (no code)

1. Click **Try for free** / **Start**. The form is prefilled with a working example.
2. Change the inputs (see examples below).
3. Click **Start**, then export the results as **JSON, CSV, Excel, XML or HTML**, or open them in Google Sheets.
4. Optional: **Schedule** the actor to run hourly, daily or weekly.

#### Via API

```bash
curl -X POST "https://api.apify.com/v2/acts/intelscrape~dns-email-security-checker/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["google.com", "apify.com", "example.com"], "dkimScan": true}'
```

Or use the official [Apify JavaScript](https://docs.apify.com/api/client/js/) and [Python](https://docs.apify.com/api/client/python/) clients:

```python
from apify_client import ApifyClient
client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("intelscrape/dns-email-security-checker").call(run_input={"domains": ["google.com", "apify.com", "example.com"], "dkimScan": true})
for item in client.dataset(run["default_dataset_id"]).iterate_items():
    print(item)
```

#### With AI agents (MCP)

Add Apify's MCP server (`https://mcp.apify.com`) or the [IntelScrape MCP Server](https://apify.com/intelscrape/skip--trace) to Claude Desktop, Cursor, ChatGPT or any MCP client, then ask in plain language, e.g. *"Run intelscrape/dns-email-security-checker with the default input and summarise the results."*

### Input examples

**Three domains with DKIM scan (default)**

```json
{
  "domains": ["google.com", "apify.com", "example.com"],
  "dkimScan": true
}
```

**Prospect list from emails, no DKIM scan**

```json
{
  "domains": ["ceo@acme.com", "https://www.shopify.com", "stripe.com"],
  "dkimScan": false
}
```

**Custom DKIM selector**

```json
{
  "domains": ["mycompany.com"],
  "extraSelectors": ["mycorp2024", "hs1"]
}
```

### Output fields

| Field | Description |
|---|---|
| `domain` | Checked domain |
| `score / grade` | 0–100 score and A–F grade |
| `issues[]` | Plain-English problems found |
| `mailProvider / mx[]` | Detected provider and MX hosts by priority |
| `spfRecord / spfAllQualifier / spfIncludes / spfTopLevelLookups` | SPF details |
| `dmarcRecord / dmarcPolicy / dmarcSubdomainPolicy / dmarcPct / dmarcRua / dmarcRuf` | DMARC details |
| `dkim.found[]` | selector, keyType, publicKeyLength, revoked |
| `bimiRecord / bimiLogoUrl` | BIMI record and logo |
| `mtaStsRecord / tlsRptRecord` | Transport security records |
| `otherTxtVerifications` | Service verification TXT records found (e.g. google-site-verification), a hint of the SaaS tools in use |
| `checkedAt` | Check time |

#### Sample output

```json
{
  "domain": "apify.com",
  "score": 100,
  "grade": "A",
  "issues": [],
  "mailProvider": "Google Workspace",
  "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com … -all",
  "spfAllQualifier": "-all",
  "spfTopLevelLookups": 6,
  "dmarcPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": "mailto:dmarc-reports@apify.com",
  "dkim": { "selectorsTested": 20, "found": [{ "selector": "google", "keyType": "rsa", "publicKeyLength": 392, "revoked": false }] }
}
```

### Pricing (pay per event)

| Event | When it is charged | Price |
|---|---|---|
| **Actor start** | once per run | $0.005 |
| **Domain check** | per domain audited | $0.003 |
| **DKIM scan** | per domain with the selector scan (on by default; turn off to skip) | $0.001 |

#### Cost examples

| Run | Cost |
|---|---|
| Default run: 3 domains | $0.017 |
| 1,000 domains with DKIM scan | $4.005 |
| 10,000 domains, no DKIM scan | $30.005 |

Platform usage is included in these prices. Set **Max charge per run** in the run options to cap spend; the actor stops cleanly when the limit is reached and keeps everything collected so far.

### Tips for best results

- Paste email addresses directly; the domain is extracted and duplicates are removed.
- If you know a domain's DKIM selector (from an email header s= tag), add it to extraSelectors.
- Sort by score to build a prospect list of domains with weak protection.
- Schedule monthly to track DMARC rollout across your clients.

### FAQ

#### Does it send any email?

No. It only reads public DNS records over DNS-over-HTTPS (Cloudflare with Google as fallback).

#### Why is DKIM "not found" when the domain signs mail?

DKIM keys live under a selector name that is not published anywhere. We test 20 common ones; custom selectors need to be added in extraSelectors.

#### How is the score calculated?

Start at 100 and subtract for each issue: missing SPF or DMARC (-25 each), p=none (-12), soft problems like missing rua or partial pct (smaller deductions). The issue list shows exactly what was deducted.

#### Does it follow SPF includes recursively?

It counts top-level lookup mechanisms; deeply nested include chains are not expanded, so treat the count as a minimum.

#### Is it accurate?

The records are read live from public DNS at run time, the same data any mail server sees.

#### Do I need an API key?

No.

### Honest limits

- DKIM is detected only on common or supplied selectors.
- SPF lookup count covers top-level mechanisms only (nested includes are not expanded).
- MTA-STS policy files are not downloaded; only the DNS record is checked.
- The score is a heuristic for prioritisation, not a certification.

### Related IntelScrape bots

- [Gravatar Lookup](https://apify.com/intelscrape/gravatar-profile-lookup): email to public profile
- [Email Verifier](https://apify.com/intelscrape/email-verifier): check if emails are deliverable
- [Data Breach Checker](https://apify.com/intelscrape/data-breach-checker): check emails against known breaches
- [WHOIS Domain Lookup](https://apify.com/intelscrape/whois-domain-lookup): registrar, dates & owner data
- [Tech Stack Detector](https://apify.com/intelscrape/tech-stack-detector): CMS, analytics & frameworks per domain
- [Skip Trace MCP Server](https://apify.com/intelscrape/skip--trace): IntelScrape tools for AI agents

### Legal

This actor collects publicly available data only. You are responsible for using the results lawfully and in line with the source's terms and applicable privacy laws (GDPR, CCPA, PIPL, PDPA). Process personal data only with a legitimate purpose. IntelScrape is not affiliated with, endorsed by or sponsored by the data source; all trademarks belong to their owners.

# Actor input Schema

## `domains` (type: `array`):

Domains, website URLs or email addresses (the domain is extracted). One per line.

## `dkimScan` (type: `boolean`):

Probe 20 common DKIM selectors (google, selector1/2, k1, s1, mandrill, zoho…). Charged per domain.

## `extraSelectors` (type: `array`):

Your own selectors to test as well.

## `proxyConfiguration` (type: `object`):

Not needed normally. The actor switches to Apify Proxy automatically if the source starts rate-limiting.

## Actor input object example

```json
{
  "domains": [
    "google.com",
    "apify.com",
    "example.com"
  ],
  "dkimScan": true,
  "extraSelectors": [],
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "google.com",
        "apify.com",
        "example.com"
    ],
    "dkimScan": true
};

// Run the Actor and wait for it to finish
const run = await client.actor("intelscrape/dns-email-security-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "google.com",
        "apify.com",
        "example.com",
    ],
    "dkimScan": True,
}

# Run the Actor and wait for it to finish
run = client.actor("intelscrape/dns-email-security-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "google.com",
    "apify.com",
    "example.com"
  ],
  "dkimScan": true
}' |
apify call intelscrape/dns-email-security-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,intelscrape/dns-email-security-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/NVkfpXwQKWw8aF6bg/builds/xbcEw85tdGqb9D5HJ/openapi.json