Domain Security & Email Deliverability Checker

Give it a list of domains. For each one you get the email authentication setup (MX, SPF, DMARC, DKIM, MTA-STS, BIMI), DNS hardening (CAA, DNSSEC), the HTTPS setup of the homepage (certificate, TLS version, redirect, security headers), a 0-100 score and a short list of fixes in plain English.

All checks are passive and public: DNS queries plus one HTTPS GET and one HTTP GET of the homepage. No port scanning, no crawling, no login, no exploitation.

Who it is for

• Sales and marketing teams: check a lead list before outreach, or use missing DMARC/SPF as a conversation opener if you sell email or security services.
• MSPs and IT providers: audit all client domains in one run and track the score over time.
• Security consultants: get a quick, repeatable baseline before a deeper engagement.
• Email senders: confirm your own sending domains are set up correctly before a campaign.

What it checks

Area	Check	Notes
Email	MX records	Sorted by priority.
Email	SPF	Record, final qualifier (-all, ~all, ?all, +all), includes, total DNS lookups including nested includes (limit is 10). Multiple SPF records are flagged.
Email	DMARC	Record at _dmarc.<domain>, policy (none, quarantine, reject), subdomain policy, pct, whether rua reporting is set.
Email	DKIM	Best effort. DKIM selectors cannot be listed from DNS, so only common names are tried: google, selector1, selector2, default, k1, s1, s2, mail. "Not found" does not mean DKIM is off.
Email	MTA-STS	v=STSv1 TXT record at _mta-sts.<domain>. The policy file is not fetched.
Email	BIMI	v=BIMI1 TXT record at default._bimi.<domain>.
DNS	CAA	All CAA records.
DNS	DNSSEC	Signal only: a DS record exists at the parent zone. The signature chain is not validated.
Web	Certificate	Valid and trusted, issuer, expiry date, days to expiry.
Web	TLS	Negotiated version (TLS 1.2 or 1.3).
Web	Redirect	Whether http://<domain>/ answers with a redirect to an https:// URL.
Web	Security headers	Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, read from the final homepage response after following up to 5 redirects.

DNS queries go to public resolvers (1.1.1.1 and 8.8.8.8) so results match what mail servers on the internet see.

Score rubric

Each check is pass or fail. The score is points earned divided by points possible, times 100. Every result includes a breakdown array with each check and its points, so you can see exactly where the number comes from.

Check	Points
MX records present	5
Exactly one SPF record	10
SPF ends in -all or ~all	5
SPF needs 10 DNS lookups or fewer	5
DMARC record present and valid	10
DMARC policy is quarantine or reject	10
DMARC rua reporting address set	5
DKIM key found on a common selector (best effort)	5
MTA-STS record present	3
BIMI record present	2
CAA records present	5
DNSSEC (DS record) present	5
HTTPS works with a valid certificate	10
Certificate valid for 14 more days or longer	2
TLS 1.3 negotiated	1
HTTP redirects to HTTPS	5
Each of the 6 security headers present	2 each, 12 total
Total	100

Email checks are worth 60 points, DNS 10, web 30. When HTTPS checks are turned off, the score is computed from the 70 DNS and email points and scaled to 0-100. A domain that does not exist scores 0.

The score is a checklist, not a risk rating. A domain that does not send email can still be perfectly safe with a low email score (although publishing v=spf1 -all and p=reject for such domains is good practice).

Input

{
    "domains": ["google.com", "https://www.github.com/", "mercadolibre.com.ar"],
    "timeoutSecs": 10,
    "includeHttpChecks": true
}

• domains (required): domains or URLs. URLs are reduced to the hostname and a leading www. is removed. Duplicates are checked once. Invalid entries are skipped with a warning in the log and are not charged.
• timeoutSecs (default 10): time limit for each DNS query and each HTTP request.
• includeHttpChecks (default true): set to false for DNS-only results.

Output

One dataset item per domain. Shortened example (full real output for 5 domains is in ejemplos/salida.json in the source):

{
    "input": "google.com",
    "domain": "google.com",
    "domain_exists": true,
    "email": {
        "mx": [{ "priority": 10, "host": "smtp.google.com" }],
        "spf": { "present": true, "record": "v=spf1 include:_spf.google.com ~all", "all": "~all", "dns_lookups": 1 },
        "dmarc": { "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com", "policy": "reject", "rua_present": true },
        "dkim": { "note": "Best effort: ...", "selectors_found": [] },
        "mta_sts_present": true,
        "bimi_present": false
    },
    "dns": { "caa": ["0 issue \"pki.goog\""], "dnssec_ds_present": false },
    "https": {
        "final_url": "https://www.google.com/",
        "certificate_valid": true,
        "certificate_issuer": "Google Trust Services",
        "certificate_expires": "2026-12-30",
        "days_to_expiry": 62,
        "tls_version": "TLSv1.3",
        "http_redirects_to_https": false,
        "security_headers_missing": ["Strict-Transport-Security", "Content-Security-Policy", "..."]
    },
    "errors": [],
    "score": 73,
    "breakdown": [{ "check": "mx_present", "passed": true, "points": 5, "max": 5 }, "..."],
    "recommendations": [
        "Enable DNSSEC at your DNS host and registrar to protect DNS answers from tampering.",
        "Redirect http:// to https:// for the homepage.",
        "..."
    ],
    "spf_policy": "~all",
    "dmarc_policy": "reject",
    "dkim_selectors_found": [],
    "cert_days_to_expiry": 62,
    "security_headers_missing": ["Strict-Transport-Security", "..."]
}

The flat fields at the end (spf_policy, dmarc_policy, ...) repeat the most used values so CSV and Excel exports are easy to read.

Problems are reported in errors for that domain instead of failing the run. One bad domain never stops the others.

Pricing

Pay per event: you pay for each domain checked (domain-checked event), including domains that turn out not to exist, because the lookups were still done. Invalid input lines are not charged. The price is shown on the Actor page. You can cap the cost of a run with the "Maximum cost per run" setting; the Actor stops cleanly when the cap is reached.

Limitations

• DKIM is best effort. Many providers use custom selectors (for example Google Workspace often uses google, but Google itself uses dated selectors), so a missing DKIM result is common and not proof of a problem.
• DNSSEC is a signal (DS record present), not full validation.
• SPF lookup counting follows include and redirect up to 20 nested records. Macros such as %{i} are not expanded.
• MTA-STS and BIMI only check the TXT record, not the policy file or the logo/certificate.
• Only the apex domain (without www.) is checked. Subdomains in the input are checked as given.
• The redirect check looks at the first response from http://<domain>/. A redirect to http://www.<domain>/ that later goes to HTTPS counts as "no redirect".
• Some sites block automated requests or answer differently by region. In that case the HTTPS part may show an error while DNS results are still complete.
• Results are a snapshot of public DNS and the homepage at the time of the run.

Run locally

python -m venv .venv
.venv/Scripts/pip install -r requirements.txt   # on Linux/macOS: .venv/bin/pip
# put input in storage/key_value_stores/default/INPUT.json
.venv/Scripts/python -m my_actor
python -m unittest discover -s tests -t .

Author: Matias Isnard.