Email Deliverability Checker: SPF, DKIM & DMARC Audit

Check whether a domain's email setup will land in the inbox. This bulk SPF, DKIM and DMARC checker audits one domain or thousands. Each domain gets an A–F grade, a score out of 100, and plain-English fixes you can paste into your DNS. It also flags whether the domain has the basics Gmail and Yahoo require from bulk senders.

Checking a single domain? Try the free browser version: K09 SPF, DKIM & DMARC Checker. This Actor is for lists of domains, CSV export, the API and scheduled monitoring.

Use it to: audit your own sending domains before a campaign, check client domains (agencies, MSPs, IT consultants), qualify leads by email-security maturity, or monitor a portfolio of domains for misconfigurations.

What it checks

Check	Details
SPF	Record present, exactly one record, final all policy (-all, ~all, ?all, +all), the 10-DNS-lookup limit (counted recursively through includes and redirects), broken includes, deprecated ptr.
DMARC	Record present, policy (none / quarantine / reject), reporting address (rua), pct, duplicate records.
DKIM	Probes 40+ common selectors (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Amazon SES, Zoho, Proton, HubSpot and more). Detects revoked keys and wildcard DNS so you don't get false positives.
MX	Whether the domain can receive mail.
MTA-STS & TLS-RPT	Transport-security policies for inbound mail.
BIMI	Brand-logo record.

Grades

Points	Grade
90–100	A
75–89	B
60–74	C
40–59	D
0–39	F

Points: SPF 30, DMARC 40 (a reject policy scores highest), DKIM 20, MTA-STS / TLS-RPT / BIMI 10.

Input

Enter domains, email addresses or website URLs (they're normalized to the domain), paste a list, or upload a CSV/TXT file. Duplicates are checked once.

Output

One row per domain. The Audit view gives a quick overview, and the All issues & fixes view lists every issue with its fix:

{
  "domain": "example.com",
  "grade": "C",
  "score": 65,
  "meetsBulkSenderBasics": false,
  "spfSummary": "-all · 0 lookups",
  "dmarcSummary": "p=reject",
  "dkimSummary": "unknown (wildcard DNS)",
  "topFix": "DMARC has no \"rua\" address, so you get no reports. Add \"rua=mailto:dmarc@example.com\" ...",
  "issues": [{ "severity": "warning", "message": "...", "fix": "..." }]
}

Full raw records (SPF, DMARC, DKIM selectors found, MX hosts) are included for each domain.

Limitations

• DKIM keys can't be listed from DNS, only guessed by selector name. "Not found" means "not under a common selector name". The domain may still sign with a custom one.
• DMARC alignment and actual mail delivery can't be verified from DNS alone. meetsBulkSenderBasics means the required records exist and look valid.
• Only public DNS is queried. Nothing is sent to the domains' mail servers.

Pricing

$0.008 per domain audited (duplicates and invalid entries are free). If you set a maximum cost for the run, the Actor audits as many domains as that covers.

Use it from code or AI agents

Every run can be started from the API, and results come back as JSON, CSV or Excel. Replace YOUR_APIFY_TOKEN with the token from Apify Console → Settings → API & Integrations.

cURL (runs the Actor and returns the results in one call):

curl -X POST "https://api.apify.com/v2/acts/k09~email-domain-audit/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["example.com","yourcompany.com"]}'

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("k09/email-domain-audit").call(run_input={
    "domains": [
        "example.com",
        "yourcompany.com"
    ]
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / Node.js (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('k09/email-domain-audit').call({
  "domains": [
    "example.com",
    "yourcompany.com"
  ]
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

No-code and AI agents: the Actor works with Apify's Zapier, Make and n8n integrations, can run on a schedule from the Console, and can be used as a tool by AI agents through Apify's MCP server (see Apify's MCP documentation).