Email Auth Checker: Bulk SPF, DMARC, DKIM & MX + Monitor

Email Auth Checker bulk-checks the SPF, DMARC, DKIM and MX records of any list of domains using public DNS. It gives each domain a 0–100 email-authentication score, a letter grade and a plain-English list of problems, such as SPF over the 10-DNS-lookup limit, +all, DMARC stuck at p=none, or no DMARC reporting. Turn on monitor mode to get only the domains whose results changed since your last run.

Not affiliated with, endorsed by, or sponsored by Cloudflare, Google, Microsoft, Yahoo, or any email provider named in the results; names are used only to describe compatibility or identify mail providers.

It reads public DNS records only, through DNS over HTTPS (Cloudflare 1.1.1.1 or Google Public DNS) or the system resolver. It sends no email, opens no SMTP connections, uses no proxies, and doesn't output any email address it finds.

What does the SPF and DMARC checker test?

• SPF: the record is present and unique; the all qualifier (-all, ~all, ?all, +all); DNS lookups counted recursively against the RFC 7208 limit of 10; void lookups; includes with no SPF record; the deprecated ptr; include loops; overlong records.
• DMARC: present and unique; policy p and subdomain policy sp; pct; alignment (adkim, aspf); whether aggregate (rua) and forensic (ruf) report addresses are present. The addresses themselves are never output.
• MX: mail servers, a guess at the mail provider (e.g. Google Workspace, Microsoft 365, Proofpoint), and null MX.
• DKIM: about 28 common selectors (google, selector1, selector2, k1, s1, default, …) with key type, RSA key size and revoked keys. DNS can't list selectors, so "not found" is only informational and may mean the domain uses a custom selector. You can add your own selectors.

Who uses a bulk email authentication checker?

Email deliverability consultants and agencies auditing clients, MSPs and IT teams watching their customers' domains, security teams checking vendors for spoofing risk, and sales teams qualifying leads for email-security services.

How to check SPF, DKIM and DMARC for a list of domains

1. Paste your domains into Domains. Full URLs and email addresses are reduced to their domain.
2. Optional: add your own DKIM selectors if a domain uses a custom one.
3. Run it and download the results as JSON, CSV or Excel. Each domain gets a 0–100 score, a grade and a plain-English list of problems.

{ "domains": ["github.com", "example.com"], "monitorMode": true, "monitorStateName": "clients" }

Output: email authentication score per domain

Real, unedited results from the Nov 1, 2026 test run. The table shows selected fields; "DKIM selectors found" is the number of selectors in dkimSelectorsFound, and "issues" lists the code of each entry in problems.

domain	score	grade	SPF all	SPF lookups	DMARC policy	DMARC reports	DKIM selectors found	issues
microsoft.com	95	A	-all	6	reject	true	1	DKIM_1024
github.com	93	A	~all	10	quarantine	true	8	SPF_SOFTFAIL, SPF_NEAR_LOOKUP_LIMIT
intel.com	73	C	-all	3	none	true	1	DMARC_P_NONE, DKIM_1024
zendesk.com	93	A	~all	6	reject	false	6	SPF_SOFTFAIL, DMARC_NO_RUA
notion.so	63	C	~all	0	quarantine	true	0	MX_MISSING, SPF_SOFTFAIL, DKIM_NOT_FOUND

Each entry in problems has a severity, a code and a plain-English message. This is the problems list for intel.com from the same run:

[
  {
    "severity": "warning",
    "code": "DMARC_P_NONE",
    "message": "p=none only monitors; spoofed mail is still delivered."
  },
  {
    "severity": "info",
    "code": "DKIM_1024",
    "message": "1024-bit RSA key; 2048-bit is recommended: cm"
  }
]

Each record also has spfRecord, spfIncludes, dmarcSubdomainPolicy, dmarcPct, dmarcAdkim, dmarcAspf, mxHosts, mxProviders, nullMx, dkimDetails (selector, key type, key bits, revoked), checkedAt, and in monitor mode changeType, changedFields and previousScore.

Scoring (100 points): SPF 30 (single valid record 10, -all 10 / ~all 8 / ?all 2, within 10 lookups 10); DMARC 40 (valid 10, reject 20 / quarantine 15 / none 3, pct 100 5, rua present 5); DKIM 15 (2048-bit key found 15, 1024-bit 10); MX 15. Grades: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F below.

Run it on a schedule

Turn on Monitor mode and give each watch list its own Monitor state name. Then schedule the Actor daily with an Apify schedule. Each run outputs only the domains whose results changed since the last run. Unchanged domains are checked and billed at the lower unchanged rate, but not output. If a lookup fails, that domain is not charged and its saved state stays as it was.

Pricing: how much does a bulk DMARC check cost?

• $0.002 per domain checked and output (every domain in a normal run; new and changed domains in monitor mode)
• $0.0005 per unchanged domain in monitor mode (checked again, found unchanged, not output)

Example: a one-off check of 1,000 client domains costs $2.00. A daily monitor of the same 1,000 domains where 20 change on a given day costs 20 × $0.002 + 980 × $0.0005 = $0.53 for that day, about $16 a month. Lookup failures are never charged.

Users on the free Apify plan can check up to 100 domains per run.

Is it legal to check SPF, DMARC and DKIM records?

It's built to use only public data. SPF, DMARC, DKIM and MX records are published in public DNS precisely so that any mail server on the internet can read them, and a lookup is the same query a receiving mail server makes. No website is crawled, so robots.txt doesn't apply. Queries go to public resolvers (Cloudflare 1.1.1.1 / Google Public DNS over HTTPS) at a polite pace (at most about 40 queries per second and 4 domains at a time) and are cached within a run. Personal data: DMARC rua/ruf tags contain mailbox addresses. The Actor outputs only whether they are present, never the addresses. Raw DMARC and DKIM records aren't output. This isn't legal advice.

FAQ

How do I check DMARC for a list of domains? Paste the domains and run the Actor. Each row shows the DMARC policy, whether report addresses are set, and any problems found. The report addresses themselves are never output.

What do Gmail and Yahoo require from bulk senders? Gmail and Yahoo require bulk senders to authenticate with SPF, DKIM and DMARC, and every sender needs at least SPF or DKIM. This Actor shows which of those records each domain has in public DNS (DKIM is checked at common selectors and any you add).

Does it send email or log in to anything? No. It reads public DNS records only. It sends no email and opens no SMTP connections.

Why does a domain show "DKIM not found"? DNS can't list DKIM selectors, so the Actor tries about 28 common ones. The domain may use a custom selector, which you can add under DKIM selectors. Missing DKIM costs score points and is listed as an info-level note, since the domain may use a custom selector.

What counts as an SPF lookup? include, a, mx, ptr, exists and redirect, counted through every nested include. More than 10 makes SPF fail with a permanent error.

Does ~all hurt the score? Slightly (8 of 10 points). With DMARC at p=reject, ~all is common and fine.

What happens if a lookup fails? That domain is skipped, not charged, and its monitor state stays as it was.

Troubleshooting

• Domain shows DOMAIN_NO_DNS: the domain doesn't resolve. Check the spelling.
• Results differ from another tool: other tools try different DKIM selectors, and DNS caches update within the record's TTL.

Example input / example output

Example input

{
  "domains": ["github.com", "cloudflare.com"],
  "monitorMode": false
}

Example output (one domain)

{
  "domain": "github.com",
  "score": 92,
  "grade": "A",
  "problemCount": 1,
  "spfAllQualifier": "~all",
  "dmarcPolicy": "reject",
  "dkimSelectorsFound": ["google", "selector1"],
  "mxProviders": ["Google Workspace"]
}

Use it with Make, Zapier, n8n, or AI agents (Apify MCP)

• Make: In Make, add the Apify module, connect your Apify account, then run this Actor (or an Actor task) and map dataset items into your scenario. See Make integration.
• Zapier: In Zapier, use Apify as a trigger (finished Actor/task run) or action (Run Actor / Run Task / Fetch dataset items). See Zapier integration.
• n8n: Install the Apify node, authenticate, then use Run an Actor or Run an Actor and get dataset. See n8n integration.
• AI agents (Apify MCP): Connect your MCP client to https://mcp.apify.com, then use search-actors, fetch-actor-details, and call-actor. Pull results with get-dataset-items. See Apify MCP server.

Related actors: ATS Jobs Feed · SEC Form D Funding Monitor · Texas New Business Entities Feed · PageSpeed & Core Web Vitals Monitor · Podcast Activity Monitor · SAM.gov Opportunities Monitor · USPTO Trademark New Filings Feed · Copycat Store & Lookalike Domain Suspect Checker

Disclaimer

Not affiliated with, endorsed by, or sponsored by Cloudflare, Google, Microsoft, Yahoo, or any email provider named in the results; names are used only to describe compatibility or identify mail providers.