Email Domain Health & Deliverability Checker — SPF, DKIM, DMARC, BIMI, Blocklists

Bulk-check the email authentication of any list of domains and get a 0-100 deliverability score with an A-F grade, a plain-English list of issues to fix, and every underlying record: MX provider, SPF (with recursive DNS lookup count), DMARC, DKIM, MTA-STS, TLS-RPT, BIMI and blocklists.

Built for cold email teams, deliverability consultants, MSPs, email agencies and security analysts.

• 📬 Everything in one row. It replaces 5-6 separate lookup tools (SPF checker, DMARC checker, DKIM lookup, MTA-STS, BIMI, blacklist check).
• 🔁 Accurate SPF. It follows include: and redirect= recursively and counts the real number of DNS lookups. More than 10 breaks SPF, and most checkers miss this.
• 🔑 DKIM discovery. It probes 36 selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid, Klaviyo, Zoho, Proton, Fastmail, Zendesk, Help Scout and others, and estimates the key size (1024 vs 2048-bit).
• 🧾 Paste anything. Domains, URLs or full email addresses (jane@acme.com → acme.com), deduplicated automatically.
• ⚡ DNS only, very cheap. $2 per 1,000 domains, and domains that don't exist are free.

---

What data do you get?

Group	Fields
Score	score (0-100), grade (A-F), issues (what to fix, in plain English)
MX	mxPresent, mxRecords, emailProvider (Google Workspace, Microsoft 365, Zoho, Proton…), emailSecurityGateway (Mimecast, Proofpoint, Barracuda…)
SPF	spf.present, spf.record, spf.valid, spf.allQualifier (-all/~all/?all/+all), spf.includes, spf.totalLookups (recursive), spf.issues, plus emailSendingServices authorized in SPF (SendGrid, Mailchimp, HubSpot, Salesforce, Klaviyo…)
DMARC	dmarc.present, dmarc.policy, dmarc.subdomainPolicy, dmarc.pct, dmarc.reportingEmails
DKIM	dkim.found, dkim.selectors, dkim.keyBits
Transport & brand	mtaSts.present, mtaSts.mode (enforce/testing), mtaSts.maxAge, tlsRpt.present, tlsRpt.reportingUris, bimi.present, bimi.logoUrl, bimi.hasVmc
Blocklists	blocklists.listed, plus the result per list (listed / clean / unknown): the domain on SURBL and Spamhaus DBL, and the sending IPs in SPF on SpamCop, PSBL and Spamhaus ZEN

Use cases

• Cold email & outbound. Before you send, check that every sending domain has SPF, DKIM and DMARC. Gmail and Yahoo require them for bulk senders.
• Deliverability consulting & MSPs. Audit hundreds of client or prospect domains in minutes, then send each one its grade and the exact issues to fix.
• Lead generation for email/security vendors. Find companies with no DMARC, a p=none policy, or a broken SPF: they're prospects for your service.
• Security & brand-protection research. Spot domains that are easy to spoof (no DMARC enforcement, +all), and track MTA-STS and BIMI adoption.

How to use it

1. Paste domains, URLs or email addresses into Domains, URLs or email addresses, or paste a whole column into Bulk paste.
2. Optional: turn off DKIM, blocklists or MTA-STS policy reading for even faster runs.
3. Click Start, then export the results as CSV, Excel or JSON, or use them via API, webhooks, Make, Zapier or Google Sheets.

Input example

{
  "domains": ["apify.com", "jane@yoast.com", "https://basecamp.com"],
  "checkDkim": true,
  "checkBlocklists": true,
  "checkMtaStsPolicy": true
}

Output example (a real result, trimmed)

{
  "domain": "basecamp.com",
  "grade": "B",
  "score": 80,
  "issues": [
    "DMARC has no rua= address: you get no reports about who sends as your domain.",
    "DKIM key is 1024-bit; 2048-bit is recommended."
  ],
  "emailProvider": "Self-hosted",
  "spf": { "present": true, "valid": true, "allQualifier": "-", "totalLookups": 3 },
  "dmarc": { "present": true, "policy": "quarantine" },
  "dkim": { "found": true, "selectors": ["google", "k1", "mail"], "keyBits": 1024 },
  "bimi": { "present": true },
  "blocklists": { "checked": 2, "listed": [] }
}

The Output tab has two ready-made views: Overview (grade and every check in one table) and Issues to fix.

How the score works

Check	Points
MX records present	10
SPF present and valid (max 10 lookups, no +all)	20 (10 if present with problems)
SPF ends in -all / ~all	5 / 3
DMARC present	15
DMARC policy reject / quarantine	15 / 10
DMARC reporting address (rua)	5
DKIM key found	15
MTA-STS enforce / testing	7 / 3
TLS-RPT	3
BIMI	5
Each blocklist listing	−25

A ≥ 85 · B ≥ 70 · C ≥ 55 · D ≥ 40 · F < 40.

Pricing

This actor uses pay-per-event pricing. Platform usage is included.

Event	Price
Domain checked	$0.002 ($2 per 1,000 domains)
Domain that doesn't exist in DNS	Free
Run start	Apify's standard start fee (a fraction of a cent per run)

FAQ

"No DKIM found": does that mean the domain has no DKIM? Not necessarily. DKIM selectors can't be listed, only guessed. We probe the 36 selectors that the most common providers use, which covers most domains, but a custom selector won't be found. The issue text says so.

Why do some blocklist results say unknown? Some blocklists refuse queries from large cloud networks. Every run first tests each list against its official test entry, and lists that don't answer correctly are reported as unknown, never as a false "clean". On Apify's network SURBL, SpamCop and PSBL answer normally, while Spamhaus usually refuses cloud queries, so its results appear as unknown.

Does it send any email or connect to mail servers? No. Everything comes from public DNS records, plus one HTTPS request to read the MTA-STS policy when the domain publishes one.

More tools from the same developer

• Website & Domain Intelligence: emails, phones, socials, 270+ technologies, email provider and domain age for any company domain.
• Shopify Store Intelligence: theme, installed apps, product count, pricing and markets for any Shopify store.