# Email DNS Audit: SPF, DMARC & DKIM Evidence (`kirozhang/email-dns-auth-audit`) Actor

Audit public email DNS records in bulk: SPF include trees, DMARC policy evidence, MX and optional DKIM selectors. Export findings and track DNS changes.

- **URL**: https://apify.com/kirozhang/email-dns-auth-audit.md
- **Developed by:** [Kiro Zhang](https://apify.com/kirozhang) (community)
- **Categories:** Developer tools, Business
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 domain dns audits

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Email DNS Audit: SPF, DMARC & DKIM Evidence

Collect verifiable email-domain configuration evidence for agency onboarding, DNS change reviews and recurring checks. Each domain gets its MX records, SPF dependency tree, DMARC records and optional DKIM key-presence checks.

### Who this is for

For agencies onboarding client domains and IT teams reviewing DNS changes. Bring domain names and any known DKIM selectors; the output supports configuration review without sending mail.

Start with at most 10 result rows: the Actor event charges for that batch are at most $0.05 at the listed rate. Set both `maxResults` and the run's maximum charge before starting.

### Quick start

Open the Input tab, paste your input and run. A small example:

```json
{
  "domains": [
    "github.com",
    "google.com"
  ],
  "dkimSelectors": [],
  "maxResults": 10
}
```

### Evidence instead of a deliverability score

The output includes raw DNS records, a bounded SPF include/redirect tree, static DNS-term counts, cycles and selected configuration findings. For DMARC, the Actor returns the exact-domain policy, DNS tree evidence and a legacy Public Suffix List candidate. RFC 9989 introduced a new discovery model in 2026; the output helps compare the evidence without claiming to reproduce every receiver's policy decision.

DKIM requires the selectors you already know. `keyPublished` indicates a non-empty public key field in DNS; it does not verify message signatures, key strength or sender authorization. No emails are sent, inboxes read, addresses discovered or mail servers probed.

### Changes between runs

Supply earlier output rows in `previousResults`. Each domain's normalized DNS evidence is fingerprinted, and the Actor returns `comparison` and `changedFields`. DNS answers are taken from Google Public DNS over HTTPS at the stated `checkedAt` time; resolver caches and propagation can affect what is observed.

### Important interpretation limits

SPF analysis expands at most 20 nodes and does not evaluate a sender IP. Macros require message context; MX/PTR subqueries are not counted in the static estimate. DMARC checks cover selected tags and tree evidence, not full RFC compliance or an effective inherited-policy verdict. Legacy `pct`, `rf` and `ri` tags are flagged for transition review. A monitoring policy is a factual finding, not an automatic vulnerability. Unknown selectors and absent records remain explicit; resolver failures are errors rather than false missing-policy findings.

Technical references: [SPF RFC 7208](https://www.rfc-editor.org/rfc/rfc7208), [DMARC RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html).

### Pricing and limits

$5 per 1,000 delivered domain DNS audit results ($0.005 each). There is no Actor startup fee. Standard platform usage is included in this Actor's event price. A successfully delivered dataset row triggers one charge; error diagnostics live in `RUN_SUMMARY` and are not chargeable rows. Repeated runs are new checks and may return the same item again. The Pricing tab is authoritative.

Use the run's maximum charge setting and `maxResults` to control spending. No proxy subscription or external API key is required. Runs use 256 MB by default. For large batches, raise the run timeout or split the input; a hard timeout may leave an incomplete dataset. The presence of a finished `RUN_SUMMARY` helps distinguish completed processing from interrupted runs.

### Export and integrations

Use the Output tab to inspect results and the summary. Download JSON, CSV or Excel from the dataset, or use Apify's API, Make, Zapier or n8n to pass the output into your existing workflow. Nested evidence is most faithfully preserved in JSON. The default dataset belongs to the run; no external destination receives results automatically.

An API client can start `kirozhang/email-dns-auth-audit` with the JSON above, wait for completion and read its default dataset. Set your Apify token in the client's credential store, never inside the input URLs.

### Troubleshooting

Read `RUN_SUMMARY.errors` and `limitReasons` first. A partial run may contain useful rows; it must not be treated as exhaustive. All-target failure marks the run failed. A valid search with no matches can succeed with zero rows. For support, open an Issue on this Actor with the run ID, expected behavior and a public example target. Remove credentials and private data from your report.

### Example output

Illustrative excerpt from a real verification run; values change over time.

```json
{
  "domain": "github.com",
  "mx": [
    "0 github-com.mail.protection.outlook.com."
  ],
  "findings": [
    "LEGACY_DMARC_TAG_PCT"
  ],
  "comparison": "no_baseline",
  "checkedAt": "2026-11-06T12:35:56.490Z"
}
```

### Workflows and questions

#### Client-domain checks after a DNS change

1. Run the supplied domain example first. For your domains, add only the DKIM selectors confirmed by the mail provider.
2. Export JSON and retain `key`, the normalized evidence and fingerprint fields.
3. Repeat with the earlier rows in `previousResults`. Review changed evidence alongside your DNS change record.
4. For a weekly task, pass the preceding dataset into the next run through your workflow. A saved task does not advance its own baseline automatically.

#### Common questions

**Does this test inbox placement or send a message?** No. It inspects public DNS only; it cannot establish deliverability or verify a message signature.

**Will it find my DKIM selector?** No. Ask the provider or inspect a message you control, then supply the selector. An empty selector list skips DKIM checks.

**Is a DMARC monitoring policy a failure?** It is a configuration fact for review. The Actor does not invent an overall security grade or claim to reproduce every receiver's DMARC decision.

### API quick start

Save the Quick start JSON as `input.json`. Put your Apify token in the `APIFY_TOKEN` environment variable through your usual secret store, then run:

```bash
curl --fail-with-body --max-time 200 \
  --request POST \
  --header "Authorization: Bearer $APIFY_TOKEN" \
  --header "Content-Type: application/json" \
  --data-binary @input.json \
  "https://api.apify.com/v2/acts/kirozhang~email-dns-auth-audit/run-sync-get-dataset-items?timeout=180&memory=256&maxTotalChargeUsd=0.10&format=json&clean=true" \
  --output results.json
```

This example starts a real run and applies a $0.10 charge ceiling. The smaller `maxResults` cap still applies. An empty array can be a valid no-match result; inspect the run and `RUN_SUMMARY` in Console. If the connection times out, check Console before retrying, since the run may already exist. For larger exports, use the asynchronous API shown on this Actor's API tab and read the dataset after the run finishes.

### Scheduling and workflow tools

After a successful small run, save a task with your production input. [Apify schedules](https://docs.apify.com/actors/running/schedules) can run that task regularly. In Make, Zapier or n8n, store the token in the connection credentials, run this Actor, wait for completion, and read its dataset. Configure your own destination explicitly; this Actor does not send emails or post messages automatically. Each scheduled run may incur charges, including repeated results.

### Related tools for different steps

- [Extend client onboarding with a public website technology inventory.](https://apify.com/kirozhang/website-tech-stack-evidence)
- [For a website move on the same domain, check redirects and canonical URLs separately.](https://apify.com/kirozhang/website-migration-redirect-audit)

# Actor input Schema

## `domains` (type: `array`):

1–100 domain names, without URLs, email addresses or wildcards. Duplicate normalized domains are checked once.

## `dkimSelectors` (type: `array`):

Optional: up to five selectors supplied by your mail provider. Selectors are not guessed or brute-forced.

## `previousResults` (type: `array`):

Paste up to 500 prior result objects to compare the same key. No persistent baseline is shared between runs or users.

## `maxResults` (type: `integer`):

Additional global cap for this run. Stops before another paid result is saved. The lower of this value, product-specific caps and your charge budget applies.

## Actor input object example

```json
{
  "domains": [
    "github.com",
    "google.com"
  ],
  "dkimSelectors": [],
  "maxResults": 500
}
```

# Actor output Schema

## `results` (type: `string`):

Delivered rows, exportable as JSON, CSV or Excel.

## `summary` (type: `string`):

Counts, limits and unbilled errors. Check complete before treating the result as exhaustive.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "github.com",
        "google.com"
    ],
    "dkimSelectors": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("kirozhang/email-dns-auth-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "github.com",
        "google.com",
    ],
    "dkimSelectors": [],
}

# Run the Actor and wait for it to finish
run = client.actor("kirozhang/email-dns-auth-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "github.com",
    "google.com"
  ],
  "dkimSelectors": []
}' |
apify call kirozhang/email-dns-auth-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,kirozhang/email-dns-auth-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Sp0TSbPgPmlzyWX6B/builds/mb2IFcVeRks04laaj/openapi.json