Company Email Security Checker

You have a list of company domains and you need to know how each one protects its email — whether it can be spoofed, whether it will land in the inbox, which mail platform it runs on. Checking SPF, DMARC and DKIM by hand, one domain at a time in a DNS console, is a slog.

Give this a list of domains and, for each one, it reads the email-security DNS the domain publishes — SPF, DMARC (with its enforcement policy), DKIM, MX, BIMI and MTA-STS — and hands back a single A-to-F grade plus every underlying record.

It is pure DNS: no scraping, no anti-bot, nothing to block, and no JavaScript to render — so it works on every domain, every time, which the homepage-reading tools can't promise. And it is organisation-level by construction — DNS records are public infrastructure, not personal data.

Live health record: lowlanddata.com/status/company-email-security - 30-day success rate and daily canary results, failures included. Full input/output reference: tool page.

Quick start (30 seconds)

1. Paste your domains into domains, one per line — stripe.com, https://github.com or www.example.com all work.
2. Click Start. Each domain comes back with a grade and its SPF, DMARC, DKIM, MX and provider.
3. Only have company names? Run the Company Domain Finder first, then feed its domain column in here.

What you can build with it

• Screen a domain list for spoofability. Filter to grade D/F to find the companies whose email can be forged — a security risk to flag, or a prospect list for a security/deliverability vendor.
• Audit deliverability before a campaign. Confirm your own or a partner's SPF and DMARC are set before mail goes out.
• Enrich a CRM with the mail platform. mailProvider tells you which companies run Google Workspace vs Microsoft 365 vs something else.
• Monitor a portfolio. Re-run on a schedule and catch when a domain's DMARC drops from reject to none, or SPF disappears.

What you get

Each domain is one row:

{
  "input": "stripe.com",
  "domain": "stripe.com",
  "grade": "A",
  "hasMx": true,
  "mxHosts": ["aspmx.l.google.com"],
  "mailProvider": "Google Workspace",
  "spf": { "present": true, "record": "v=spf1 include:_spf.google.com ~all", "qualifier": "~all" },
  "dmarc": {
    "present": true,
    "policy": "reject",
    "pct": 100,
    "aggregateReports": true,
    "record": "v=DMARC1; p=reject; ..."
  },
  "dkim": { "present": true, "selectors": ["google", "s1"] },
  "bimi": false,
  "mtaSts": false,
  "status": "checked",
  "checkedAt": "2026-09-25T10:00:00.000Z"
}

Field notes:

• grade is the headline: A = DMARC enforced (reject) with SPF, down to F = no SPF and no DMARC (fully spoofable). It's graded on the two records a receiving server actually enforces.
• spf.qualifier is the enforceable part: -all (strict), ~all (softfail), ?all/+all (open — weak).
• dmarc.policy is none (monitor only — does not block spoofing), quarantine, or reject (the strong one).
• mailProvider is inferred from the MX hosts.
• dkim is best effort: it probes the common selectors mail providers use, so a hit proves DKIM but a miss does not disprove it — which is exactly why DKIM does not move the grade.
• bimi/mtaSts are maturity signals (inbox brand logo; enforced inbound TLS).

How the grade works

• A — SPF present and DMARC p=reject. Spoofing is rejected.
• B — SPF present and DMARC p=quarantine. Spoofed mail goes to junk.
• C — DMARC present but p=none (monitoring only, does not block).
• D — SPF only, no DMARC. Spoofable, but something is configured.
• F — neither SPF nor DMARC. Fully spoofable.

What does it cost?

$4.00 per 1,000 domains checked. A domain that does not resolve (does not exist) or an invalid input is delivered free — you pay only for a real result, and a grade F is a real, useful result (it flags an exposed domain). A run that resolves nothing costs the $0.00005 actor start.

• A 1,000-domain audit ≈ $4.00, once.
• A daily 50-domain watch ≈ $0.12/month.

The price is all-inclusive, and because it is pure DNS a run is fast and never blocked. The free plan returns a 5-item sample per run.

Not technical? Let your AI assistant set it up

Copy this into ChatGPT, Claude or any AI assistant, fill in the one line, and follow the conversation:

Help me set up the "Company Email Security Checker" actor on Apify
(https://apify.com/lowlanddata/company-email-security). Guide me one step at a time.

What I have: [E.G. "a spreadsheet of 300 company domains I want to check for SPF and DMARC"]

Guide me to:
1. Create a free Apify account (apify.com), open the actor page, and paste my
   domains into the domains field, one per line.
2. Start a run, then export the results as CSV or Excel, or read them from the API.
3. Explain the A-to-F grade and which columns (spf, dmarc, dkim) drive it.
4. If I only have company names, point me to the Company Domain Finder first.
5. If it works, remind me to leave a quick rating on the actor page.

Input

Field	Description
domains	The domains to check, one per line. A bare domain, a URL, or a www host all work. Required.
maxItems	Stop after this many domains. Default 1000; free-plan runs are capped at 5.

Use it from your code

curl -X POST "https://api.apify.com/v2/acts/lowlanddata~company-email-security/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["stripe.com", "github.com"]}'

Schedules, webhooks and the Make/Zapier/n8n integrations all apply. This is a standard Apify actor.

Use it with AI agents (MCP)

Through Apify's hosted MCP server, an agent can call this as a tool: hand over the domains, read the grades and records back.

Claude Code:

$claude mcp add apify --transport http "https://mcp.apify.com?actors=lowlanddata/company-email-security"

Cursor or Claude Desktop (add a custom connector / MCP server with this URL):

https://mcp.apify.com?actors=lowlanddata/company-email-security

Runs bill to the Apify account you sign in with. Per-client setup: Apify MCP docs.

Is it legal, and is any of this personal data?

SPF, DMARC, DKIM, MX and BIMI are public DNS records a domain publishes so that mail servers worldwide can read them — this reads exactly those, nothing gated. It is organisation-level infrastructure: there are no names, emails or people in the output, by design.

Is there a bulk SPF / DMARC / DKIM API?

This is one. Send domains to run-sync-get-dataset-items and get each domain's grade, SPF, DMARC, DKIM, MX and provider straight back as JSON, on a schedule, or as an MCP tool — without querying DNS one record at a time yourself.

FAQ

Why is DKIM sometimes empty for a domain that clearly uses DKIM? DKIM keys live under a selector name that cannot be listed from DNS, so this probes the common ones. A domain using an unusual selector shows dkim: [] — which is why DKIM never lowers the grade.

What does grade F mean for me? The domain has no SPF and no DMARC, so anyone can send email that appears to come from it. It's a risk for that company and a signal for anyone selling email security.

Does p=none count as protected? No — p=none is DMARC in monitor-only mode: it reports spoofing but does not block it. That's a grade C, not an A.

Can I export the results to Excel? Yes: any dataset exports as Excel, CSV, JSON or XML from the Apify Console or API.

Why did I only get 5 results? The Apify free plan caps this actor at a 5-item sample. Any paid plan lifts the cap to your maxItems.

The company-identity family

The domain is the key that unlocks the rest. This tool is one rung, each organisation-level, nothing personal:

• Company Domain Finder — company name → website domain, the entry point.
• Company Logo & Favicon Finder — a domain's favicon, logo and social image.
• Company Socials Finder — a domain's LinkedIn, X, Instagram and more.
• EU Company VAT Finder — the official EU VAT id behind a domain, VIES-validated.

Troubleshooting

Failures are loud and named in the run's status message:

• "Provide at least one domain." domains was empty; add at least one.
• A row came back unreachable. The domain does not resolve — it does not exist, or a typo.
• A row came back invalid. The input was not a parseable domain.
• 5 results instead of your maxItems: the free-plan sample cap; a paid Apify plan removes it.

Support

Found a grade or provider that looks wrong? Open a report on the actor's Issues tab; this tool is actively maintained.

If it earns its keep, a rating on this page takes ten seconds and tells us which enrichment tool to build next.