DMARC Checker Bulk - SPF, DKIM & Email Security

Need to check DMARC, SPF and DKIM for a whole list of domains, not one at a time in an online DMARC checker? Paste domains, URLs or email addresses and get one CSV-ready row per domain: the mail provider, the DMARC policy (p=none, quarantine or reject), the SPF record and its recursive lookup count, DKIM selectors found, MTA-STS, TLS-RPT, BIMI and website certificate expiry. You also get a 0-100 score, a plain-English fix list and a High/Medium/Low prospect priority. Find spoofable p=none domains, run an email deliverability audit, or check the DNS side of the Gmail and Yahoo bulk sender requirements. Passive checks only: no port scans, no SMTP.

What does the bulk DMARC & SPF checker do?

For every domain you get the mail provider (Microsoft 365, Google Workspace, Zoho, Proofpoint, Mimecast or other), SPF validity and recursive DNS-lookup count, the DMARC policy (none / quarantine / reject, pct, sp, rua/ruf), DKIM selectors found, MTA-STS, TLS-RPT, BIMI, the website's HTTPS certificate expiry and HSTS, a 0-100 score, a plain-English verdict, a fix list and flags such as p=none on M365 or SPF over 10 lookups.

Which email security records does it check? (SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI)

Area	Fields
Summary	score (0-100, higher = better protected), grade (A-F), prospectPriority (High/Medium/Low), verdict, flags + flagsText, fixes + fixesText, fixCount
Mail provider	mailProvider, mailProviderDetail (e.g. Barracuda, Cisco, Cloudflare), mxHosts, nullMx, spfSendingServices (M365, Google, SendGrid, Mailchimp, Amazon SES ... seen in SPF includes)
SPF	spfPresent, spfValid, spfRecordCount, spfLookupCount, spfOverLookupLimit, spfAll (-all, ~all, ?all, +all), spfRecord, spfErrors
DMARC	dmarcPolicy (p), dmarcSubdomainPolicy (sp), dmarcEffectivePolicy, dmarcPct, dmarcRuaPresent, dmarcRufPresent, dmarcCoverage (own record / inherited from the organizational domain / none), dmarcRecord, dmarcErrors
DKIM	dkimSelectorsFound among 30 common selectors (selector1, selector2, google, k1, k2, s1, s2, default, mxvault, dkim, mail, smtp, zoho, mandrill, everlytickey1, Google's date-based selectors, ...) plus your extraDkimSelectors, dkimRevokedSelectors, dkimWildcard
Transport	mtaStsTxt, mtaStsMode (read from the policy file over HTTPS), mtaStsError, tlsRpt, tlsRptRua, bimi, bimiLogo, bimiVmc
Website	certValid, certDaysLeft, certExpiresAt, hsts, hstsMaxAge, hstsIncludeSubdomains, hstsPreload, httpsStatus
Other	referenceUrl (optional link you supply, copied into every row), checkedAt, status

Is it passive? (no port scans, no SMTP, no personal data)

Yes. The Actor reads only public DNS records, makes at most one HTTPS GET to the website (falling back to www. only if the apex is unreachable; the page body is not downloaded), and fetches the public MTA-STS policy file when one is advertised. It never opens SMTP connections, never verifies mailboxes, never scans ports, and doesn't collect names, email addresses or other personal data.

Use cases

MSP and MSSP lead generation: find domains with DMARC p=none

Find prospects with p=none, no DMARC or a broken SPF record and lead with a concrete finding. Filter by Microsoft 365 or Google Workspace to match your stack, and sort by prospectPriority.

Email deliverability audit for cold-email agencies

Pre-check client and sending domains for SPF, DKIM and DMARC before a campaign. Spot SPF records over the 10-lookup limit that silently fail.

Gmail and Yahoo bulk sender requirements (DNS side)

Check a whole portfolio of brands or customer domains for the SPF, DKIM and DMARC records that Gmail and Yahoo require from bulk senders (see the FAQ below). For a dedicated pass/fail column, use the DMARC & SPF Checker.

AI agents

Call it through the Apify API or the Apify MCP server to answer questions like "which of these domains are spoofable?" (see below).

Vendor and third-party email security risk

Add an email-security posture snapshot to supplier reviews and security questionnaires.

Research: how many domains are spoofable

Measure how many domains in a list have no enforced DMARC, with aggregate counts in the OUTPUT summary.

How to bulk check DMARC for a list of domains

1. Paste domains into Domains, or paste a CSV column into Paste domains / CSV. URLs, www. hosts and email addresses are normalized and duplicates removed.
2. Optionally turn on Generate summary report and set a reference link (for example your DMARC rollout guide) to copy into every row.
3. Click Start, then download the dataset as CSV, Excel or JSON, or read the OUTPUT summary.

The default input contains 10 well-known domains, so you can try it immediately.

Input example

{ "domains": ["contoso.com", "fabrikam.com", "northwind.example"], "summary": true, "maxConcurrency": 10 }

Advanced options: domainsText, maxDomains, dnsServers (default 1.1.1.1, 8.8.8.8), dnsTransport (auto / classic DNS / DNS-over-HTTPS), dnsTimeoutMs, httpTimeoutMs, maxConcurrency (max 20), checkDkim, extraDkimSelectors, fetchMtaStsPolicy, checkHttps, stripWww, referenceUrl.

Output example

One dataset row (real run on mit.edu, 2026-10-18, trimmed to the main fields):

{
  "domain": "mit.edu",
  "status": "ok",
  "score": 50,
  "grade": "D",
  "prospectPriority": "High",
  "verdict": "Spoofable: DMARC is monitor-only (p=none) (M365).",
  "mailProvider": "M365",
  "spfPresent": true,
  "spfLookupCount": 10,
  "spfAll": "-all",
  "spfOverLookupLimit": false,
  "dmarcPolicy": "none",
  "dmarcPct": 100,
  "dmarcRuaPresent": true,
  "dmarcCoverage": "own-record",
  "dkimSelectorsFound": "selector2, google, k1, k2, s1, s2",
  "mtaStsMode": null,
  "tlsRpt": false,
  "bimi": false,
  "certDaysLeft": 25,
  "hsts": false,
  "flags": [
    "SPF near lookup limit (10/10)",
    "p=none on M365"
  ],
  "fixes": [
    "Move DMARC from p=none to p=quarantine, then p=reject, once reports show legitimate mail passes.",
    "Add MTA-STS (TXT at _mta-sts plus a policy at https://mta-sts.mit.edu/.well-known/mta-sts.txt).",
    "Add a TLS-RPT record at _smtp._tls to receive SMTP TLS failure reports.",
    "Send a Strict-Transport-Security (HSTS) header on the website."
  ],
  "checkedAt": "2026-10-19T00:52:56.344Z"
}

Also written: an OUTPUT record in the key-value store (counts by mail provider, DMARC policy distribution, grades, average score, % spoofable, top flags, lowest-scoring domains) and, with summary on, a Markdown REPORT. Non-existent domains get a status: "nxdomain" row and are not charged.

Score and fix list explained

Area	Points
SPF: single record (8), -all/~all (6/4), at most 10 lookups (6); +all scores 0	20
DMARC: valid (8), reject/quarantine scaled by pct (17/12), rua (5), subdomains enforced (5)	35
DKIM found on a common selector	10
MTA-STS enforce/testing (10/5), TLS-RPT (5)	15
BIMI	5
Website: valid certificate (5), not expiring within 14 days (2), HSTS (8)	15

Domains with a null MX (no inbound mail) are not penalized for DKIM or MTA-STS. prospectPriority is High when the domain is spoofable (no enforced DMARC), uses +all, or exceeds 10 SPF lookups. Each finding adds a plain-English fix to fixes.

How much does it cost to check 1,000 domains?

Pay per event: from $0.004 per audited domain (cheaper on paid Apify plans) and an optional $0.01 per run for the summary report. No subscription and no monthly fee.

Apify plan (Store discount tier)	Per domain	1,000 domains	10,000 domains
Free	$0.004	$4.00	$40.00
Starter	$0.0035	$3.50	$35.00
Scale	$0.003	$3.00	$30.00
Business	$0.0025	$2.50	$25.00

Tiers follow Apify's Store discount tier for your plan. Enterprise pricing is available on request.

Duplicates, invalid input and non-existent (NXDOMAIN) domains are free. Set a maximum total charge per run to cap spend; the Actor stops cleanly when it's reached and keeps everything audited so far.

A domain is charged only after its row is saved to the dataset. Every row has a rowId, stable per domain. In the rare case a dataset save times out after the row was stored, an uncharged error row with the same rowId follows; keep the non-error row for each rowId.

Can I try it for free?

Yes. The Apify free plan includes $5 of usage credit every month with no credit card, enough to audit up to about 1,250 domains a month (each optional summary report adds $0.01 per run; other Apify usage draws on the same credit). Start with the 10 sample domains in the input (about $0.04), check the output, then paste your own prospect or client list.

Use from AI agents (Apify MCP, x402/Skyfire)

Add the hosted Apify MCP server to Claude, Cursor, VS Code or any MCP client and expose just this Actor as a tool:

{ "mcpServers": { "apify": { "url": "https://mcp.apify.com?tools=lentic_labs/email-dmarc-security-prospector" } } }

The client signs in with OAuth on first use (or send Authorization: Bearer <APIFY_TOKEN>). Then ask: "Audit these 200 domains and list the M365 ones with DMARC p=none."

x402 agent payments (no Apify account): per Apify's x402 docs, an agent makes one x402 payment in USDC to buy a prepaid, spend-capped Apify token and then uses it as a normal bearer token with the API or MCP server. See docs.apify.com/integrations/x402 for the current minimum, token lifetime and wallet setup. Agentic payments are marked experimental by Apify and may change.

Skyfire (pay per request): agents with pre-funded Skyfire payment tokens can run this Actor through the Apify MCP server or API. It qualifies because it is pay-per-event, charges only for events, and runs with limited permissions. See docs.apify.com/agents/payments.

Use it via API (Python, JavaScript, cURL)

curl -X POST "https://api.apify.com/v2/acts/lentic_labs~email-dmarc-security-prospector/run-sync-get-dataset-items?maxTotalChargeUsd=1" \
  -H "Authorization: Bearer $APIFY_TOKEN" -H "Content-Type: application/json" \
  -d '{"domains": ["contoso.com", "fabrikam.com"]}'

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('lentic_labs/email-dmarc-security-prospector').call({ domains: ['contoso.com'], summary: true }, { maxTotalChargeUsd: 2 });
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items.map((r) => [r.domain, r.score, r.verdict]));

from apify_client import ApifyClient
client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("lentic_labs/email-dmarc-security-prospector").call(run_input={"domains": ["contoso.com"]})
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row["score"], row["flagsText"])

FAQ

Is DMARC checking legal / is this scanning?

The Actor reads only records that domain owners publish in public DNS for exactly this purpose, plus one ordinary HTTPS request to the website and the public MTA-STS policy file. It does no port scanning, no SMTP probing and no vulnerability testing.

Why is DKIM "not found" when my domain signs mail?

DKIM selectors can't be listed from DNS, so the Actor probes 30 common ones. Large senders often use custom or rotating selectors (Google does), so "not found" doesn't prove DKIM is missing. Add known selectors in extraDkimSelectors.

How are SPF lookups counted (10-lookup limit)?

Following RFC 7208: every include, a, mx, ptr, exists and redirect costs one DNS lookup, counted recursively through nested includes. More than 10 is a permanent error and receivers treat SPF as failing ("too many DNS lookups"); see RFC 7208 §4.6.4. The Actor reports spfLookupCount and spfOverLookupLimit, so you can see which includes to remove or flatten.

What does DMARC p=none mean, and is p=none enough?

p=none asks receivers to take no action on mail that fails DMARC and only send reports. Under RFC 9989, the current DMARC standard (it obsoletes RFC 7489), quarantine and reject are the enforcement policies. Gmail and Yahoo accept p=none for bulk senders, but the domain can still be spoofed. The Actor treats any domain without an enforced policy at 100% as spoofable.

How do I bulk check DMARC for a list of domains?

Paste the domains, or a CSV column of websites or email addresses, into the input and click Start. Input is normalized and deduplicated, and you get one row per domain. Set maxDomains or a maximum total charge to cap the run.

What is MTA-STS and why does it matter?

MTA-STS (RFC 8461) lets a domain tell sending servers to deliver mail only over verified TLS to its listed MX hosts, which blocks downgrade attacks. It needs a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt; mode: enforce is the protective setting. The Actor flags domains whose TXT exists but whose policy can't be fetched.

What do I need to show a BIMI logo in Gmail?

An enforced DMARC policy (quarantine or reject), a default._bimi TXT record pointing to an SVG logo, and for Gmail a Verified Mark Certificate (VMC) or Common Mark Certificate. The Actor reports bimi, bimiLogo and whether a certificate (a=) is referenced (bimiVmc).

What are Google and Yahoo's bulk sender requirements?

Since 2024, Gmail and Yahoo require bulk senders (roughly 5,000+ messages a day) to authenticate with SPF and DKIM, publish a DMARC record (at least p=none) with alignment, offer one-click unsubscribe, and keep spam rates low. Primary sources: Google sender guidelines and Yahoo sender best practices. Since May 2025, Outlook.com has also required SPF, DKIM and DMARC (at least p=none) from domains sending more than 5,000 emails a day (Microsoft). This Actor checks the DNS side (SPF, DKIM selectors, DMARC); alignment, unsubscribe headers and spam rates can only be seen in real mail.

Which resolvers are used?

Public resolvers 1.1.1.1 and 8.8.8.8 by default (configurable). If classic DNS is blocked in the runtime network, it falls back to DNS-over-HTTPS with the same providers.

Related Actors by Lentic Labs

• Email Provider Lookup - Bulk MX for Microsoft 365 & Google: MX-only provider lookup, $0.50 per 1,000 domains.
• DMARC & SPF Checker - Google/Yahoo Bulk Sender: quick pass/fail, $1 per 1,000 domains.
• SSL Certificate Expiry Checker: days left, issuer and chain per host, $1 per 1,000 hosts.

Changelog

• 0.1: first release. Bulk SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI and HTTPS audit with score, verdict and fix list.

---

Microsoft 365 and Outlook are trademarks of Microsoft Corporation. Google Workspace and Gmail are trademarks of Google LLC. Yahoo is a trademark of Yahoo. Names are used only to describe the providers checked; Lentic Labs is not affiliated with or endorsed by them.