Email Provider & Deliverability Checker: Google Workspace vs Microsoft 365, SPF, DMARC, DKIM

Find out which email provider any company uses and how well its email is set up, for thousands of domains in minutes. Paste domains, emails or website URLs. For each one you get the mailbox provider (Google Workspace, Microsoft 365, Zoho, GoDaddy, Proton and 50+ more), any security gateway in front of it (Proofpoint, Mimecast, Barracuda, Cisco and more), the tools allowed to send for it (from SPF: HubSpot, Salesforce, SendGrid, Mailchimp, Amazon SES and more), its DMARC, DKIM, BIMI and MTA-STS setup, and a 0–100 deliverability score with a plain-English list of issues.

It only reads public DNS records. It never connects to a mail server, never sends an email and never touches a mailbox, so it is fast, cheap and can't harm your sender reputation.

Who uses it

• Cold email and outbound teams. Split your lead list by provider. Google-to-Google and Microsoft-to-Microsoft sends land in the inbox more often, and a Proofpoint or Mimecast gateway means you should send more carefully.
• Sales intelligence and ABM. Find "Google Workspace shops" versus "Microsoft 365 shops", and see who already uses HubSpot, Salesforce, Zendesk, Klaviyo and more, because they show up in SPF.
• MSPs, IT and security consultants. Find prospects with no DMARC, p=none, SPF that allows anyone (+all) or broken SPF, then send them a report.
• Email deliverability agencies. Audit a client's domains in bulk.

Input

Field	Description
domains (required)	Domains, emails or URLs, one per line. Duplicates are removed automatically.
checkDkim	Checks 32 common DKIM selectors (google, selector1/2, k1, s1, mandrill...). Default true.
dkimSelectors	Your own selector list, used instead of the default one.
maxItems	Limits how many domains are checked, which is handy for testing.
maxConcurrency, dnsTimeoutSecs, dohEndpoints	Advanced tuning.

{ "domains": ["stripe.com", "jane@shopify.com", "https://www.ibm.com/about"], "checkDkim": true }

Output (one row per domain)

This is a real result from a local test run on 2026-10-30:

{
  "domain": "stripe.com",
  "status": "ok",
  "acceptsEmail": true,
  "emailProvider": "Google Workspace",
  "providerDetectedVia": "mx",
  "securityGateway": null,
  "sendingServices": ["Amazon SES", "Google Workspace", "Qualtrics", "Zendesk"],
  "spf": { "record": "v=spf1 ip4:198.2.180.60/32 ... ~all", "allQualifier": "~", "dnsLookupCount": 7, "tooManyLookups": false },
  "dmarcPolicy": "reject",
  "dmarc": { "policy": "reject", "pct": 100, "rua": ["mailto:dmarc-reports@stripe.com"] },
  "dkim": { "selectorsChecked": 32, "selectorsFound": ["google", "s1", "s2", "mandrill", "cm"], "wildcardRecord": false },
  "bimi": null, "mtaSts": false, "tlsRpt": false,
  "deliverabilityScore": 90, "grade": "A", "issues": []
}

Other real results from the same run:

domain	emailProvider	securityGateway	DMARC	score
shopify.com	Google Workspace	–	reject	92 A
github.com	Microsoft 365	–	quarantine	90 A
ibm.com	Unknown (behind gateway)	Proofpoint	reject	90 A
proton.me	Proton Mail	–	quarantine	95 A
fastmail.com	Fastmail	–	none	78 B
example.com	– (null MX)	–	reject	20 F

You can download the results as JSON, CSV, Excel or HTML, or pull them through the API.

How the score works

The score is made up of: a valid MX record (25 points), an SPF record (15), a strict -all or ~all ending (10), a DMARC record (15), a quarantine or reject policy (15), a DKIM key found (10), MTA-STS (3) and BIMI (2). Points are taken off for more than one SPF record or more than 10 SPF lookups. A domain that can't receive email is capped at 20. Grades: A ≥ 85, B ≥ 70, C ≥ 55, D ≥ 40, F below 40.

Pricing (pay per event)

$1.50 per 1,000 domains ($0.0015 per domain-checked event), plus Apify's tiny start fee. There's no subscription. Invalid inputs are pushed so you can see them, and you can cap your spend with Max cost per run. Similar Actors charge $1–5 per 1,000 and only return raw DNS records.

Speed

300 domains took about 80 seconds in testing, including the 32-selector DKIM check. Turn off checkDkim to run about 5× faster.

FAQ

Does it verify individual mailboxes? No. It checks the domain, not whether jane@ exists. Use it alongside an email verifier, or before one to skip domains that can't receive mail.

How accurate is provider detection? MX records are definitive for Google, Microsoft, Zoho and the rest. When a gateway such as Proofpoint hides the real mailbox, the Actor looks for Google or Microsoft in SPF and sets providerDetectedVia: "spf". If neither is there, it reports Unknown (behind gateway).

Why wasn't DKIM found? DKIM selectors can't be listed from DNS, so the Actor tries the 32 most common ones. Add your own in dkimSelectors.

Is this legal? Yes. DNS records are public by design. The Actor uses DNS-over-HTTPS through Cloudflare, with Google as a fallback.

Can I use it from Make, Zapier, n8n, Clay or an AI agent? Yes. It works through the Apify API and integrations, and through Apify's MCP server.