MX Lookup & Email DNS Checker

Introduction

MX Lookup & Email DNS Checker performs comprehensive DNS email infrastructure analysis for any domain. Provide a list of domains and the actor looks up MX records, validates SPF records, checks DKIM selectors, verifies DMARC policies, detects the email provider (Google Workspace, Microsoft 365, Zoho, ProtonMail, and more), and scores each domain on a 0-100 email security scale.

Primary use cases:

• Email deliverability auditing — check your sending domains for SPF, DKIM, and DMARC compliance before launching campaigns
• Security compliance — audit your entire domain portfolio for email authentication gaps (missing SPF, weak DMARC, no DKIM)
• Lead qualification by tech stack — detect whether a prospect uses Google Workspace (SMB signal) or Microsoft 365 (enterprise signal)
• MSP domain management — batch-check hundreds of client domains in one run
• Pre-outreach verification — confirm a domain's email infrastructure is configured before cold outreach

Key differentiators:

• Batch process up to 10,000 domains per run at $1.00 per 1,000 domains
• Detects 14+ email providers from MX hostnames — no guessing
• Parses SPF mechanisms, counts DNS lookup depth, and flags RFC violations
• Checks 10 DKIM selectors in parallel — finds active DKIM even for non-standard selectors
• DMARC policy parsing: extracts p=, sp=, rua=, ruf=, alignment modes
• Actionable misconfiguration codes with specific recommendations
• Uses Node.js built-in dns module — zero external API dependencies

---

Why Use This Actor

Tools like MXToolbox and EasyDMARC are excellent for manual one-off lookups but cost $129+/month for subscriptions and process one domain at a time. This actor is purpose-built for batch workflows.

Feature	This Actor	MXToolbox	DNSChecker.org	EasyDMARC
Price per 1K domains	$1.00	$129+/mo	Manual only	$24+/mo
Batch processing	Yes (10K+)	1 at a time	1 at a time	CSV upload
MX lookup	Yes	Yes	Yes	Yes
SPF validation	Yes (parsed)	Yes	Yes	Yes
DKIM check	Yes (10 selectors)	Yes	No	Yes
DMARC parsing	Yes (full)	Yes	Yes	Yes
Provider detection	Yes (14+ providers)	No	No	Partial
Structured JSON	Yes	HTML only	HTML only	JSON
Zero-config	Yes	Requires account	Manual	Requires account
Apify integration	Full	None	None	None

---

How to Use

Zero-config: Just provide a list of domains. All checks run with sensible defaults.

{
  "domains": ["yourdomain.com", "clientdomain.org", "competitor.io"]
}

The actor immediately returns MX records, SPF validation, DKIM status, DMARC policy, provider detection, security scores, and any detected misconfigurations — no API keys required.

Via Apify API:

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });

const run = await client.actor('junipr/mx-lookup').call({
  domains: ['google.com', 'microsoft.com', 'zoho.com'],
  checkTls: false,
  onlyMisconfigured: false,
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Audit your sending domains before email campaigns:

{
  "domains": ["send.yourcompany.com", "campaigns.yourcompany.com", "yourcompany.com"],
  "checkDkim": true,
  "checkDmarc": true,
  "dkimSelectors": ["google", "selector1", "s1", "mail", "default"]
}

Misconfiguration scan across a domain list:

{
  "domains": ["domain1.com", "domain2.com", "domain3.com"],
  "onlyMisconfigured": true
}

---

Input Configuration

Parameter	Type	Default	Description
domains	array	["gmail.com", "outlook.com", "yahoo.com"]	Domains to check. Email addresses are also accepted — domain is extracted automatically.
checkMx	boolean	true	Look up MX records and detect email provider.
checkSpf	boolean	true	Parse SPF TXT records, validate mechanisms, count DNS lookups.
checkDkim	boolean	true	Check DKIM selectors listed in dkimSelectors.
checkDmarc	boolean	true	Parse DMARC policy record from _dmarc.{domain}.
checkTls	boolean	false	Test STARTTLS on primary MX server (port 25). Adds ~2-3s per domain.
dkimSelectors	array	["google","selector1","selector2","default","k1","k2","s1","s2","dkim","mail"]	DKIM selectors to probe.
detectProvider	boolean	true	Identify email provider from MX hostnames.
includeRawRecords	boolean	false	Include raw DNS record strings alongside parsed fields.
onlyMisconfigured	boolean	false	Filter dataset to only domains with detected misconfigurations.
maxConcurrency	integer	20	Concurrent DNS lookups. Min 1, max 50.
dnsTimeout	integer	5000	Per-DNS-lookup timeout in milliseconds. Min 1000, max 30000.
dnsServer	string	null	Custom DNS resolver IP. Empty = system default.

Common configurations:

• Quick MX check — checkSpf: false, checkDkim: false, checkDmarc: false
• Full email audit — all checks enabled, checkTls: true
• Lead qualification — default settings with detectProvider: true
• Misconfiguration scan — onlyMisconfigured: true

---

Output Format

One dataset item is produced per domain. A run summary is stored in the Key-Value Store under key OUTPUT.

Example — well-configured domain:

{
  "domain": "google.com",
  "mx": {
    "records": [{ "priority": 10, "exchange": "aspmx.l.google.com" }],
    "hasMx": true,
    "provider": "Google Workspace",
    "providerType": "google_workspace"
  },
  "spf": {
    "record": "v=spf1 include:_spf.google.com ~all",
    "isValid": true,
    "mechanisms": ["include:_spf.google.com", "~all"],
    "includes": ["_spf.google.com"],
    "policy": "softfail",
    "lookupCount": 1,
    "exceedsLookupLimit": false,
    "errors": []
  },
  "dkim": {
    "selectors": {
      "google": { "found": true, "record": "v=DKIM1; k=rsa; p=...", "keyType": "rsa", "keyLength": 2048 }
    },
    "hasAnyDkim": true,
    "activeSelectors": ["google"]
  },
  "dmarc": {
    "record": "v=DMARC1; p=reject; rua=mailto:dmarc@google.com",
    "isValid": true,
    "policy": "reject",
    "subdomainPolicy": null,
    "percentage": 100,
    "reportingEmails": ["dmarc@google.com"],
    "forensicEmails": [],
    "alignmentMode": { "spf": null, "dkim": null },
    "errors": []
  },
  "tls": null,
  "misconfigurations": [],
  "score": { "overall": 96, "mx": 100, "spf": 85, "dkim": 100, "dmarc": 100 },
  "checkedAt": "2025-01-15T12:00:00.000Z",
  "errors": []
}

Misconfiguration severity levels:

Severity	Meaning
critical	Domain cannot receive email or is actively spoofable
warning	Reduced security posture, deliverability risk
info	Best practice gaps, not immediately harmful

Score breakdown: Each component (MX, SPF, DKIM, DMARC) contributes 25% to the overall score. A score of 100 means fully configured, enforcing policy, DKIM key ≥ 2048 bits, DMARC policy is reject, and aggregate reporting is configured.

---

Tips and Advanced Usage

Custom DKIM selectors: If your email provider uses a non-standard selector (e.g., acme._domainkey.yourdomain.com), add "acme" to dkimSelectors. The actor checks all selectors in parallel, so adding more selectors has minimal time cost.

Understanding SPF lookup limits: RFC 7208 limits SPF evaluation to 10 DNS lookups. If your SPF chain exceeds this, some receiving servers may reject or fail your mail. Use a tool like dmarcian's SPF Surveyor to flatten your record.

DMARC policy progression: Start with p=none to monitor, then move to p=quarantine after reviewing aggregate reports for 2-4 weeks, then advance to p=reject for maximum protection. The actor flags none policy as a warning — use the onlyMisconfigured filter to prioritize domains needing attention.

Lead qualification by email provider: providerType: "google_workspace" typically indicates SMBs and startups. providerType: "microsoft_365" often signals mid-market or enterprise organizations. Use this to route leads to the appropriate sales motion.

Combining with other Junipr actors: This actor pairs naturally with our Disposable Email Checker and Email Validator actors for a complete email intelligence pipeline.

---

Pricing

Pay-Per-Event: $1.00 per 1,000 domains checked (billed per domain, $0.001/domain).

Pricing includes all platform compute costs — no hidden fees.

Batch Size	Estimated Cost
1 domain	$0.001
10 domains	$0.01
100 domains	$0.10
1,000 domains	$1.00
10,000 domains	$10.00

Domains that fail format validation are not billed. Invalid domain inputs are returned with errors: ["INVALID_DOMAIN_FORMAT"] at no charge.

---

FAQ

Does this send emails to test deliverability?

No. This actor only performs passive DNS lookups. It queries public DNS records (MX, TXT, CNAME) — no email is sent, no SMTP connection is established (unless checkTls is enabled, which only tests the STARTTLS handshake on port 25 without sending any message content).

How accurate is email provider detection?

Provider detection is heuristic-based on MX hostnames. It correctly identifies Google Workspace, Microsoft 365, Zoho, ProtonMail, Fastmail, Amazon SES, Mailgun, SendGrid, Mimecast, Proofpoint, and several others. Self-hosted Postfix or obscure providers are returned as providerType: "other" with the raw MX hostname in provider.

What DKIM selectors does it check by default?

The default selectors are: google, selector1, selector2, default, k1, k2, s1, s2, dkim, mail. These cover the most common commercial email providers. You can add custom selectors via the dkimSelectors input — useful for self-hosted mail servers or custom signing configurations.

Can I use this to fix my email deliverability issues?

This actor diagnoses problems but does not fix them. Each misconfiguration includes a recommendation field with specific guidance. For SPF and DMARC issues, changes are made in your DNS provider's control panel. For DKIM, changes are made in your email platform and DNS.

What does a score of 75 mean?

Scores are calculated per component: MX (25%), SPF (25%), DKIM (25%), DMARC (25%). A score of 75 typically means three components are fully configured and one is missing or weak. Scores below 50 indicate critical gaps. Target 90+ for domains used in email campaigns.

Does it check BIMI records?

Not currently. BIMI (Brand Indicators for Message Identification) lookup is on the roadmap. BIMI requires a valid DMARC reject policy, so checking DMARC first is a prerequisite anyway.

Can I check subdomains separately?

Yes. Subdomains can have their own MX, SPF, and DMARC records. Provide the full subdomain (e.g., send.yourdomain.com) and the actor checks it independently. If the subdomain has no DMARC record, the parent domain's sp= tag applies.

How does this complement the Disposable Email Checker?

The Disposable Email Checker identifies domains from throwaway email services (Mailinator, Guerrilla Mail, etc.). This actor checks if a domain's email infrastructure is properly configured. Together they answer: "Is this email real?" and "Is this domain's email setup legitimate?" — essential for lead validation and email list hygiene.