DMARC & SPF Checker - Google/Yahoo Bulk Sender Compliance (Bulk)

Will your sending domains pass the Gmail and Yahoo bulk sender requirements? Paste a domain list and get a pass/fail for each domain on the DNS side of those rules: valid SPF, a DMARC record at p=none or stricter, and a DKIM key found. Each row also flags SPF records over the 10-lookup limit, +all, missing rua reporting and spoofable domains with no enforced DMARC, with every issue in plain English. Check thousands of domains before a campaign, not one at a time, for $1 per 1,000 domains.

What does it check?

For each domain:

• SPF: published, valid, not +all, and within the 10-DNS-lookup limit (counted through all includes).
• DMARC: published and valid, the effective policy (none / quarantine / reject, including policies inherited from the parent domain), pct, and rua reporting.
• DKIM: looks for a public key under 30 common selectors (Microsoft selector1/2, Google google, Mailchimp k1...). You can add your own in extraDkimSelectors.
• Spoofable: true unless DMARC is enforced (quarantine/reject at 100%).

Pass/fail result (bulkSenderResult)

Result	Meaning
pass	Valid SPF, DMARC published (p=none or stricter), DKIM key found
pass-dkim-unverified	SPF and DMARC OK; no DKIM key found among common selectors (it may use a custom one)
fail	SPF or DMARC missing, invalid, or SPF +all

issues lists every problem in plain English.

The result is measured against the Gmail and Yahoo rules only. Google and Yahoo also require alignment (the From domain matching SPF/DKIM), one-click unsubscribe and a low spam rate. Those can only be seen in real email, so this tool checks the DNS requirements only.

Who is it for?

• Cold-email and deliverability teams / agents: check sending domains before a campaign.
• Agencies, MSPs and security sellers: check client domains, or find spoofable prospects (spoofable = true, DMARC p=none).
• IT teams: audit every domain you own in one run.
• AI agents: a cheap compliance pass/fail through the Apify API or MCP server.

How much does it cost?

$0.001 per domain ($1 per 1,000 domains). No subscription. Duplicates, invalid input, non-existent (NXDOMAIN) domains and DNS failures are free. Set a maximum total charge per run and the Actor stops cleanly at your budget. On Apify's free plan, the $5 monthly usage credit covers up to about 5,000 domains a month (less if you use other Apify Actors or services).

How does it work?

Passive public DNS queries only. It sends no email and makes no web requests. It collects no personal data.

Use it only on domains you own or are authorized to assess, or for research on public DNS data. Results come only from public DNS records; no personal data is collected.

FAQ

What are the Gmail bulk sender requirements? From February 1, 2024, senders of more than 5,000 messages a day to Gmail must use SPF and DKIM, publish DMARC (p=none is allowed), align the From domain with SPF or DKIM, support one-click unsubscribe, keep the spam rate below 0.3%, use TLS and have valid PTR records (Google).

What are the Yahoo bulk sender requirements? Yahoo requires SPF and DKIM, a valid DMARC policy of at least p=none that passes, a From domain aligned with SPF or DKIM, one-click unsubscribe honored within 2 days, and a spam rate below 0.3% (Yahoo).

Does it check Microsoft Outlook's requirements too? Not as a separate verdict. Since May 5, 2025, Outlook.com (hotmail.com, live.com, outlook.com) has required SPF, DKIM and DMARC (at least p=none) from domains sending more than 5,000 emails a day, and Microsoft's April 29, 2025 update says non-compliant mail is rejected with "550; 5.7.515 Access denied" (Microsoft). The SPF, DKIM and DMARC fields in each row are useful for that check, but bulkSenderResult is defined against the Gmail and Yahoo rules.

Does a "pass" mean my domain is fully compliant? No. It means the DNS side passes. Alignment, one-click unsubscribe, spam rate, TLS and PTR can only be seen in real mail or your sending infrastructure, so the Actor doesn't claim to check them.

Is DMARC p=none enough for Gmail and Yahoo? For their bulk-sender rules, yes. Both accept p=none. But p=none takes no action on failing mail, so the domain stays spoofable. RFC 9989, the current DMARC standard that obsoletes RFC 7489, describes quarantine and reject as the enforcement policies (RFC 9989).

Why does my SPF record show "too many lookups"? RFC 7208 §4.6.4 caps SPF at 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). Going over the cap is a permerror (RFC 7208). The Actor counts lookups through nested includes.

Why is DKIM "unverified" when we do sign mail? DKIM selectors can't be listed from DNS. If your provider uses a custom selector, add it in extraDkimSelectors. Otherwise the result is pass-dkim-unverified, not fail.

Use it from an AI agent or API

Call the Actor through the Apify API (run-sync-get-dataset-items) or Apify's MCP server (https://mcp.apify.com?tools=lentic_labs/dmarc-spf-bulk-sender-check), with JSON input {"domains": ["example.com"]}. Agents without an Apify account can use Apify's agentic payments (experimental): buy a prepaid token with x402, or pay per request with Skyfire.

Related Lentic Labs Actors

• Need MTA-STS, TLS-RPT, BIMI, the mail provider, a 0-100 score and a fix list? DMARC Checker Bulk - SPF, DKIM & Email Security
• Segment the list by email provider first: Email Provider Lookup - Bulk MX for Microsoft 365 & Google
• Check the sites' certificates too: SSL Certificate Expiry Checker

---

Microsoft 365 and Outlook are trademarks of Microsoft Corporation. Google Workspace and Gmail are trademarks of Google LLC. Yahoo is a trademark of Yahoo. Names are used only to describe the providers checked; Lentic Labs is not affiliated with or endorsed by them.