Domain Deliverability Checker SPF DKIM DMARC Blacklist Clay

📬 What can Domain Deliverability Checker do?

Give it a domain and it returns a complete email deliverability verdict in one flat row: SPF, DKIM and DMARC with policy, MX records and mail provider, DNS blacklist status, catch-all detection, domain age, and a single 0 to 100 health score.

Pure DNS and SMTP. No browser, no proxy, no paid third-party APIs.

📦 What you get	⚙️ Features and integrations
🛡️ SPF, DKIM and DMARC with the actual policy 💯 A 0 to 100 score and a low/medium/high risk level 🚫 DNS blacklist status with the zones queried 🧾 27 flat fields, always present, null when absent	📮 Mail provider detection from MX 📅 Domain age via RDAP, with a SOA fallback 🧊 24 hour cache, repeat lookups skip the network, not the per-row charge ⬇️ Export to JSON, CSV, Excel, HTML or XML

Bought by outbound agencies, sales operations teams and Clay users who need to check domain health before sending cold email. Where most actors check one slice, just DNS or just blacklists or just DMARC, this returns the whole verdict in a single row.

🚫 This audits a domain, not a mailbox. It does not verify individual email addresses. If you need per-address verification, use Work Email Waterfall Finder.

💡 Why use Domain Deliverability Checker?

If you want	Read these fields
One number to gate on	deliverability_score, risk_level
Whether authentication is actually set up	spf_valid, spf_policy, dkim_present, dmarc_policy
Who runs their mail	mail_provider, mx_records
Reputation problems	blacklisted, blacklists_listed, blacklist_status
Early warning signs	spam_trap_risk, spam_trap_flags, domain_age_days
Whether the domain even sends	has_mx, has_website

💯 The score model, stated in full

has_mx +20; valid SPF +20 (hard -all +5); DKIM present +15; valid DMARC +15 (quarantine +5, reject +10); blacklist clean +15 (unknown +7); catch-all not detected +5 (detected -10). Capped 0 to 100.

Risk level: 80 or more low, 50 to 79 medium, under 50 high.

The model is published so you can disagree with it and rebuild your own from the raw fields, all of which are on the row.

▶️ Ready-to-run examples

Each is a preconfigured version of this actor. Open one and run it immediately.

Example	What it does
SPF DKIM DMARC Checker for Any Domain	Full email authentication check on any domain
Bulk Email Deliverability Checker	Score a list of domains before launching cold outreach
DMARC Policy and Blacklist Lookup	Check DMARC policy and scan for blacklist presence
Live Domain Health Recheck	Force a fresh check with no cached result
Catch-All Domain Detection	Detect whether a domain accepts all addresses

📋 What data can Domain Deliverability Checker extract?

27 fields per domain. Every field is always present; absent values are null.

Field	What it holds
spf_record, spf_valid, spf_policy	Raw record, validity, and the qualifier on all
dkim_selectors_found, dkim_present	Which common selectors returned a key
dmarc_record, dmarc_policy, dmarc_valid	Raw record and none, quarantine or reject
mx_records, has_mx, mail_provider	Hosts with priority, and the detected provider
catch_all, catch_all_status	catch_all, not_catch_all or unknown
blacklisted, blacklists_listed, blacklists_checked, blacklist_status	Which zones were queried and what they said
spam_trap_risk, spam_trap_flags	Advisory heuristics for young or unauthenticated domains
domain_age_days, domain_age_source	Days since registration, and whether it came from rdap or soa
has_website	Domain has an A or AAAA record
deliverability_score, risk_level	The composite verdict
audit_error, run_date	What stopped it, and when it ran

⚠️ A clean blacklist result means clean on the zones that answered, not an authoritative all-clear. Spamhaus and Barracuda block queries from cloud IPs and public resolvers without a paid data-query key, so some zones return unknown. Read blacklists_checked to see what was actually asked. The same care applies to dkim_present: an empty result means not found on a common selector, never a guarantee that DKIM is absent.

🛠️ How to check a domain's email deliverability

1. Open the Input tab and put a bare domain in domain, without https:// or a trailing slash.
2. For a list, use domains instead. It takes precedence and returns one row per domain.
3. Click Start.
4. Read deliverability_score and risk_level for the verdict.
5. Read spf_policy, dmarc_policy and blacklist_status for what to fix.

🧪 Using it in Clay

Add an Apify enrichment column and map your domain column to domain. The output is flat and one row per domain, so every field maps directly to a Clay column with no JSON unwrapping.

Gate downstream sends on a formula like deliverability_score >= 70 to keep risky domains out of a sequence before they cost you a reputation.

🔌 MCP

$npm install @mambalabsdev/mcp-domain-deliverability-checker

{
  "mcpServers": {
    "domain-deliverability": {
      "command": "npx",
      "args": ["-y", "@mambalabsdev/mcp-domain-deliverability-checker"],
      "env": { "APIFY_TOKEN": "YOUR_TOKEN" }
    }
  }
}

Tool: check_domain_deliverability with { "domain": "stripe.com" }. The Mamba Labs GTM Suite server exposes the wider fleet through one install.

💵 How much does it cost to audit a domain?

You are charged once per domain audited.

Plan	Per domain	Per 1,000 domains
Free	$0.005	$5.00
Bronze	$0.00475	$4.75
Silver	$0.0045	$4.50
Gold	$0.00425	$4.25

There is also an Actor start event at $0.00005, charged once per run per GB of memory.

💳 This actor passes Apify platform usage costs through to you, unlike most of the Mamba Labs fleet, where we absorb them. That is compute and proxy usage billed at Apify's rates on top of the per-domain price above. Free plans include 50 results per month.

⚠️ A cached repeat lookup is served instantly but is still billed. This actor prices per result row, and Apify charges that event for every row written to the dataset, whether the answer came from the network or from the 24 hour cache. Corrected 2026-08-12: an earlier version of this section said cached repeat lookups were free. They are not, and they never were. Measured on 2026-08-12, an identical three domain re-run 75 minutes after the first was charged the same three result events. The cache saves you the wait and the platform usage, not the per-row price.

⌨️ Input

Everything is on the Input tab. Provide either domain or domains.

Field	Type	Default	What it does
domain	string	stripe.com	Bare domain, no scheme and no trailing slash.
domains	array	none	Batch. Takes precedence over domain. One row per domain.
batchSize	integer	5	Domains audited concurrently per wave. Maximum 10.
skipCache	boolean	false	Force a fresh audit and ignore any cached result.
attempt_catch_all	boolean	false	Run the SMTP catch-all probe. See Known limits before turning this on.

📤 Output

One flat row per domain, exportable as JSON, CSV, Excel, HTML or XML.

{
  "domain": "stripe.com",
  "spf_record": "v=spf1 include:_spf.google.com ~all",
  "spf_valid": true,
  "spf_policy": "softfail",
  "dkim_selectors_found": ["google", "s1", "s2"],
  "dkim_present": true,
  "dmarc_record": "v=DMARC1; p=reject;",
  "dmarc_policy": "reject",
  "dmarc_valid": true,
  "mx_records": [{"host": "aspmx.l.google.com", "priority": 10}],
  "has_mx": true,
  "mail_provider": "Google Workspace",
  "catch_all": null,
  "catch_all_status": "unknown",
  "blacklisted": false,
  "blacklists_listed": [],
  "blacklist_status": "clean",
  "spam_trap_risk": "low",
  "domain_age_days": 11238,
  "domain_age_source": "rdap",
  "has_website": true,
  "deliverability_score": 95,
  "risk_level": "low",
  "run_date": "2026-06-19T08:10:59Z"
}

💡 Tips

• Audit your own sending domains before a campaign, not just your prospects'. That is the use this actor gets bought for most.
• spf_policy: "softfail" with dmarc_policy: "none" is the most common real finding on a domain that thinks it is set up correctly.
• A young domain with no authentication is the classic spam-trap shape. spam_trap_flags names which heuristics fired.
• Batch with domains rather than looping. Repeat lookups inside 24 hours are free anyway.

⚠️ Known limits

Catch-all is off by default. The Apify platform blocks outbound SMTP on port 25, so the catch-all probe returns unknown here. Enable attempt_catch_all only when running this actor on infrastructure that permits port 25 egress.

DNS blacklist coverage is best effort. Spamhaus and Barracuda block queries from cloud IPs and public resolvers without a paid data-query key, so some zones return unknown.

DKIM uses common-selector probing. DKIM selectors cannot be enumerated from DNS, so the actor checks a fixed list of provider selectors.

Domain age depends on the registry. RDAP returns the registration date for most TLDs; some registries omit or redact it, in which case the value is null or an approximate SOA-based fallback.

A domain with no MX is not an error. The row is emitted with has_mx: false, and the blacklist and SMTP checks are skipped.

Results are cached for 24 hours. Pass skipCache: true for a live audit.

❓ FAQ

Why is catch_all null?

Because the SMTP probe could not run. Apify blocks outbound port 25, so catch_all_status comes back unknown rather than a guess.

What does a score of 95 actually mean?

Read the score model above. It is published in full precisely so the number is not a black box.

Does it verify individual email addresses?

No. It audits the domain's sending setup, not a mailbox.

One domain failed in my batch. Did it break the run?

No. Failures are caught per domain, an empty record is pushed for that one, and the other rows are unaffected.

Is a clean result an all-clear?

Clean on the zones that answered. Check blacklists_checked.

🧩 Want other GTM data?

Mamba Labs builds custom actors for B2B go-to-market teams. The public versions of that work live here on the Store, so our users get the same tooling we build under contract.

🧑‍💼 GTM Hiring Signal Scraper	🧱 Tech Stack Detector
📡 B2B Buying Signals Aggregator	🔑 Job Board Keyword Scanner
🔗 Domain to LinkedIn URL Resolver	🎯 ICP Fit Scorer
📋 Job Posting Monitor	🏢 Company Firmographic Enricher
🌐 Company Social Presence Mapper	🪪 Company Identity Resolver
💰 Funding and Press Signal Scanner	🔄 Company Change-Event Feed
👤 People Finder and Email Verifier	🚀 Prospect Engine
🤖 AI Tooling Detector	📮 Outbound Stack Detector
📝 Publishing Frequency Tracker	✉️ Work Email Waterfall Finder
⏩ Sequencer Lead Push	🏅 Workplace Program Detector
👥 Team Page People Extractor	🧭 Company Discovery List Builder

Every actor in the suite takes a domain or a company and returns one flat row, so they stack in the same Clay table without reshaping anything.

🛠️ Need something custom built for you or your team? Tell us what you are trying to find and we will build it. Talk to Mamba Labs.

🆘 Support

Something wrong, or a mail provider the actor does not recognize? Open an issue on the Issues tab with the domain and the row, and we will look at it.

ℹ️ Sourcing and legal. Every field comes from public DNS records, public RDAP registry data and public DNSBL zones. Nothing reads a mailbox or sends a message. The catch-all probe, when enabled, opens an SMTP conversation and never delivers anything. You are responsible for how you use the output.

Built by Mamba Labs.