# Company Email Security Checker (`lowlanddata/company-email-security`) Actor

Check SPF, DMARC, DKIM, MX and BIMI for a list of domains in bulk and get an A-to-F email-security grade plus the mail provider. Pure DNS - no scraping, no blocks. GDPR-clean. Free on a domain that doesn't resolve.

- **URL**: https://apify.com/lowlanddata/company-email-security.md
- **Developed by:** [Lowland Data](https://apify.com/lowlanddata) (community)
- **Categories:** Developer tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $4.00 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Company Email Security Checker

You have a list of company domains and you need to know how each one protects its
email — whether it can be spoofed, whether it will land in the inbox, which mail
platform it runs on. Checking SPF, DMARC and DKIM by hand, one domain at a time in
a DNS console, is a slog.

Give this a list of domains and, for each one, it reads the email-security DNS the
domain publishes — SPF, DMARC (with its enforcement policy), DKIM, MX, BIMI and
MTA-STS — and hands back a single **A-to-F grade** plus every underlying record.

It is pure DNS: **no scraping, no anti-bot, nothing to block, and no JavaScript to
render** — so it works on every domain, every time, which the homepage-reading
tools can't promise. And it is organisation-level by construction — DNS records are
public infrastructure, not personal data.

**Live health record:** [lowlanddata.com/status/company-email-security](https://lowlanddata.com/status/company-email-security/) - 30-day success rate and daily canary results, failures included. Full input/output reference: [tool page](https://lowlanddata.com/tools/company-email-security/).

### Quick start (30 seconds)

1. Paste your domains into **domains**, one per line — `stripe.com`,
   `https://github.com` or `www.example.com` all work.
2. Click **Start**. Each domain comes back with a grade and its SPF, DMARC, DKIM,
   MX and provider.
3. Only have company names? Run the
   [Company Domain Finder](https://apify.com/lowlanddata/company-domain-finder)
   first, then feed its `domain` column in here.

### What you can build with it

- **Screen a domain list for spoofability.** Filter to grade `D`/`F` to find the
  companies whose email can be forged — a security risk to flag, or a prospect list
  for a security/deliverability vendor.
- **Audit deliverability before a campaign.** Confirm your own or a partner's SPF
  and DMARC are set before mail goes out.
- **Enrich a CRM with the mail platform.** `mailProvider` tells you which companies
  run Google Workspace vs Microsoft 365 vs something else.
- **Monitor a portfolio.** Re-run on a schedule and catch when a domain's DMARC
  drops from `reject` to `none`, or SPF disappears.

### What you get

Each domain is one row:

```json
{
  "input": "stripe.com",
  "domain": "stripe.com",
  "grade": "A",
  "hasMx": true,
  "mxHosts": ["aspmx.l.google.com"],
  "mailProvider": "Google Workspace",
  "spf": { "present": true, "record": "v=spf1 include:_spf.google.com ~all", "qualifier": "~all" },
  "dmarc": {
    "present": true,
    "policy": "reject",
    "pct": 100,
    "aggregateReports": true,
    "record": "v=DMARC1; p=reject; ..."
  },
  "dkim": { "present": true, "selectors": ["google", "s1"] },
  "bimi": false,
  "mtaSts": false,
  "status": "checked",
  "checkedAt": "2026-09-25T10:00:00.000Z"
}
```

Field notes:

- `grade` is the headline: `A` = DMARC enforced (`reject`) with SPF, down to `F` =
  no SPF and no DMARC (fully spoofable). It's graded on the two records a receiving
  server actually enforces.
- `spf.qualifier` is the enforceable part: `-all` (strict), `~all` (softfail),
  `?all`/`+all` (open — weak).
- `dmarc.policy` is `none` (monitor only — does not block spoofing), `quarantine`,
  or `reject` (the strong one).
- `mailProvider` is inferred from the MX hosts.
- `dkim` is best effort: it probes the common selectors mail providers use, so a
  hit proves DKIM but a miss does not disprove it — which is exactly why DKIM does
  **not** move the grade.
- `bimi`/`mtaSts` are maturity signals (inbox brand logo; enforced inbound TLS).

### How the grade works

- **A** — SPF present and DMARC `p=reject`. Spoofing is rejected.
- **B** — SPF present and DMARC `p=quarantine`. Spoofed mail goes to junk.
- **C** — DMARC present but `p=none` (monitoring only, does not block).
- **D** — SPF only, no DMARC. Spoofable, but something is configured.
- **F** — neither SPF nor DMARC. Fully spoofable.

### What does it cost?

$4.00 per 1,000 domains **checked**. A domain that does not resolve (does not
exist) or an invalid input is delivered **free** — you pay only for a real result,
and a grade `F` is a real, useful result (it flags an exposed domain). A run that
resolves nothing costs the $0.00005 actor start.

- **A 1,000-domain audit ≈ $4.00**, once.
- **A daily 50-domain watch ≈ $0.12/month.**

The price is all-inclusive, and because it is pure DNS a run is fast and never
blocked. The free plan returns a 5-item sample per run.

### Not technical? Let your AI assistant set it up

Copy this into ChatGPT, Claude or any AI assistant, fill in the one line, and
follow the conversation:

```text
Help me set up the "Company Email Security Checker" actor on Apify
(https://apify.com/lowlanddata/company-email-security). Guide me one step at a time.

What I have: [E.G. "a spreadsheet of 300 company domains I want to check for SPF and DMARC"]

Guide me to:
1. Create a free Apify account (apify.com), open the actor page, and paste my
   domains into the domains field, one per line.
2. Start a run, then export the results as CSV or Excel, or read them from the API.
3. Explain the A-to-F grade and which columns (spf, dmarc, dkim) drive it.
4. If I only have company names, point me to the Company Domain Finder first.
5. If it works, remind me to leave a quick rating on the actor page.
```

### Input

| Field      | Description                                                                                 |
| ---------- | ------------------------------------------------------------------------------------------- |
| `domains`  | The domains to check, one per line. A bare domain, a URL, or a www host all work. Required. |
| `maxItems` | Stop after this many domains. Default 1000; free-plan runs are capped at 5.                 |

### Use it from your code

```bash
curl -X POST "https://api.apify.com/v2/acts/lowlanddata~company-email-security/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["stripe.com", "github.com"]}'
```

Schedules, webhooks and the Make/Zapier/n8n integrations all apply. This is a
standard Apify actor.

### Use it with AI agents (MCP)

Through Apify's hosted MCP server, an agent can call this as a tool: hand over the
domains, read the grades and records back.

Claude Code:

```bash
claude mcp add apify --transport http "https://mcp.apify.com?actors=lowlanddata/company-email-security"
```

Cursor or Claude Desktop (add a custom connector / MCP server with this URL):

```text
https://mcp.apify.com?actors=lowlanddata/company-email-security
```

Runs bill to the Apify account you sign in with. Per-client setup: [Apify MCP docs](https://docs.apify.com/platform/integrations/mcp).

### Is it legal, and is any of this personal data?

SPF, DMARC, DKIM, MX and BIMI are public DNS records a domain publishes so that
mail servers worldwide can read them — this reads exactly those, nothing gated. It
is organisation-level infrastructure: there are no names, emails or people in the
output, by design.

### Is there a bulk SPF / DMARC / DKIM API?

This is one. Send domains to `run-sync-get-dataset-items` and get each domain's
grade, SPF, DMARC, DKIM, MX and provider straight back as JSON, on a schedule, or
as an MCP tool — without querying DNS one record at a time yourself.

### FAQ

**Why is DKIM sometimes empty for a domain that clearly uses DKIM?** DKIM keys live
under a selector name that cannot be listed from DNS, so this probes the common
ones. A domain using an unusual selector shows `dkim: []` — which is why DKIM never
lowers the grade.

**What does grade `F` mean for me?** The domain has no SPF and no DMARC, so anyone
can send email that appears to come from it. It's a risk for that company and a
signal for anyone selling email security.

**Does `p=none` count as protected?** No — `p=none` is DMARC in monitor-only mode:
it reports spoofing but does not block it. That's a grade `C`, not an `A`.

**Can I export the results to Excel?** Yes: any dataset exports as Excel, CSV, JSON
or XML from the Apify Console or API.

**Why did I only get 5 results?** The Apify free plan caps this actor at a 5-item
sample. Any paid plan lifts the cap to your `maxItems`.

### The company-identity family

The domain is the key that unlocks the rest. This tool is one rung, each
organisation-level, nothing personal:

- [Company Domain Finder](https://apify.com/lowlanddata/company-domain-finder) — company name → website domain, the entry point.
- [Company Logo & Favicon Finder](https://apify.com/lowlanddata/company-logo-finder) — a domain's favicon, logo and social image.
- [Company Socials Finder](https://apify.com/lowlanddata/company-socials-finder) — a domain's LinkedIn, X, Instagram and more.
- [EU Company VAT Finder](https://apify.com/lowlanddata/company-vat-finder) — the official EU VAT id behind a domain, VIES-validated.

### Troubleshooting

Failures are loud and named in the run's status message:

- **"Provide at least one domain."** `domains` was empty; add at least one.
- **A row came back `unreachable`.** The domain does not resolve — it does not exist, or a typo.
- **A row came back `invalid`.** The input was not a parseable domain.
- **5 results instead of your maxItems**: the free-plan sample cap; a paid Apify plan removes it.

### Support

Found a grade or provider that looks wrong? Open a report on the actor's **Issues
tab**; this tool is actively maintained.

If it earns its keep, a **rating on this page** takes ten seconds and tells us which
enrichment tool to build next.

# Actor input Schema

## `domains` (type: `array`):

The domains to check email security for, one per line. A bare domain (stripe.com), a URL or a www host all work. Only have company names? Run the Company Domain Finder first.

## `maxItems` (type: `integer`):

Stop after this many domains. Default 1000; free-plan runs are capped at 5.

## Actor input object example

```json
{
  "domains": [
    "stripe.com",
    "github.com",
    "example.com"
  ],
  "maxItems": 1000
}
```

# Actor output Schema

## `results` (type: `string`):

One JSON object per domain, with its SPF, DMARC, DKIM, MX and grade.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "stripe.com",
        "github.com",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("lowlanddata/company-email-security").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "stripe.com",
        "github.com",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("lowlanddata/company-email-security").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "stripe.com",
    "github.com",
    "example.com"
  ]
}' |
apify call lowlanddata/company-email-security --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,lowlanddata/company-email-security"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Q8tQU11smbgskeNIe/builds/EeUQxofco3hba6UKB/openapi.json