# Email Provider & Deliverability Checker (SPF, DMARC, DKIM) (`mossgreen_zed/email-provider-deliverability-checker`) Actor

Bulk-detect which email provider a domain uses (Google Workspace, Microsoft 365, Zoho, GoDaddy...), its security gateway (Proofpoint, Mimecast...), SPF sending tools, DMARC/DKIM/BIMI and a 0-100 deliverability score. DNS only, no SMTP, $1.50 per 1,000 domains.

- **URL**: https://apify.com/mossgreen_zed/email-provider-deliverability-checker.md
- **Developed by:** [Joshua Temko](https://apify.com/mossgreen_zed) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Email Provider & Deliverability Checker: Google Workspace vs Microsoft 365, SPF, DMARC, DKIM

**Find out which email provider any company uses and how well its email is set up, for thousands of domains in minutes.** Paste domains, emails or website URLs. For each one you get the mailbox provider (Google Workspace, Microsoft 365, Zoho, GoDaddy, Proton and 50+ more), any security gateway in front of it (Proofpoint, Mimecast, Barracuda, Cisco and more), the tools allowed to send for it (from SPF: HubSpot, Salesforce, SendGrid, Mailchimp, Amazon SES and more), its DMARC, DKIM, BIMI and MTA-STS setup, and a **0–100 deliverability score with a plain-English list of issues**.

It only reads public DNS records. It never connects to a mail server, never sends an email and never touches a mailbox, so it is fast, cheap and can't harm your sender reputation.

### Who uses it

- **Cold email and outbound teams.** Split your lead list by provider. Google-to-Google and Microsoft-to-Microsoft sends land in the inbox more often, and a Proofpoint or Mimecast gateway means you should send more carefully.
- **Sales intelligence and ABM.** Find "Google Workspace shops" versus "Microsoft 365 shops", and see who already uses HubSpot, Salesforce, Zendesk, Klaviyo and more, because they show up in SPF.
- **MSPs, IT and security consultants.** Find prospects with no DMARC, `p=none`, SPF that allows anyone (`+all`) or broken SPF, then send them a report.
- **Email deliverability agencies.** Audit a client's domains in bulk.

### Input

| Field | Description |
|---|---|
| `domains` (required) | Domains, emails or URLs, one per line. Duplicates are removed automatically. |
| `checkDkim` | Checks 32 common DKIM selectors (google, selector1/2, k1, s1, mandrill...). Default `true`. |
| `dkimSelectors` | Your own selector list, used instead of the default one. |
| `maxItems` | Limits how many domains are checked, which is handy for testing. |
| `maxConcurrency`, `dnsTimeoutSecs`, `dohEndpoints` | Advanced tuning. |

```json
{ "domains": ["stripe.com", "jane@shopify.com", "https://www.ibm.com/about"], "checkDkim": true }
```

### Output (one row per domain)

This is a real result from a local test run on 2026-10-30:

```json
{
  "domain": "stripe.com",
  "status": "ok",
  "acceptsEmail": true,
  "emailProvider": "Google Workspace",
  "providerDetectedVia": "mx",
  "securityGateway": null,
  "sendingServices": ["Amazon SES", "Google Workspace", "Qualtrics", "Zendesk"],
  "spf": { "record": "v=spf1 ip4:198.2.180.60/32 ... ~all", "allQualifier": "~", "dnsLookupCount": 7, "tooManyLookups": false },
  "dmarcPolicy": "reject",
  "dmarc": { "policy": "reject", "pct": 100, "rua": ["mailto:dmarc-reports@stripe.com"] },
  "dkim": { "selectorsChecked": 32, "selectorsFound": ["google", "s1", "s2", "mandrill", "cm"], "wildcardRecord": false },
  "bimi": null, "mtaSts": false, "tlsRpt": false,
  "deliverabilityScore": 90, "grade": "A", "issues": []
}
```

Other real results from the same run:

| domain | emailProvider | securityGateway | DMARC | score |
|---|---|---|---|---|
| shopify.com | Google Workspace | – | reject | 92 A |
| github.com | Microsoft 365 | – | quarantine | 90 A |
| ibm.com | Unknown (behind gateway) | Proofpoint | reject | 90 A |
| proton.me | Proton Mail | – | quarantine | 95 A |
| fastmail.com | Fastmail | – | none | 78 B |
| example.com | – (null MX) | – | reject | 20 F |

You can download the results as JSON, CSV, Excel or HTML, or pull them through the API.

### How the score works

The score is made up of: a valid MX record (25 points), an SPF record (15), a strict `-all` or `~all` ending (10), a DMARC record (15), a `quarantine` or `reject` policy (15), a DKIM key found (10), MTA-STS (3) and BIMI (2). Points are taken off for more than one SPF record or more than 10 SPF lookups. A domain that can't receive email is capped at 20. Grades: A ≥ 85, B ≥ 70, C ≥ 55, D ≥ 40, F below 40.

### Pricing (pay per event)

**$1.50 per 1,000 domains** ($0.0015 per `domain-checked` event), plus Apify's tiny start fee. There's no subscription. Invalid inputs are pushed so you can see them, and you can cap your spend with *Max cost per run*. Similar Actors charge $1–5 per 1,000 and only return raw DNS records.

### Speed

300 domains took about 80 seconds in testing, including the 32-selector DKIM check. Turn off `checkDkim` to run about 5× faster.

### FAQ

**Does it verify individual mailboxes?** No. It checks the domain, not whether `jane@` exists. Use it alongside an email verifier, or before one to skip domains that can't receive mail.

**How accurate is provider detection?** MX records are definitive for Google, Microsoft, Zoho and the rest. When a gateway such as Proofpoint hides the real mailbox, the Actor looks for Google or Microsoft in SPF and sets `providerDetectedVia: "spf"`. If neither is there, it reports `Unknown (behind gateway)`.

**Why wasn't DKIM found?** DKIM selectors can't be listed from DNS, so the Actor tries the 32 most common ones. Add your own in `dkimSelectors`.

**Is this legal?** Yes. DNS records are public by design. The Actor uses DNS-over-HTTPS through Cloudflare, with Google as a fallback.

**Can I use it from Make, Zapier, n8n, Clay or an AI agent?** Yes. It works through the Apify API and integrations, and through Apify's MCP server.

# Actor input Schema

## `domains` (type: `array`):

One per line. You can paste bare domains (acme.com), email addresses (jane@acme.com) or website URLs (https://www.acme.com/about). Duplicates are removed automatically.

## `checkDkim` (type: `boolean`):

Probe common DKIM selectors (google, selector1/2, k1, s1, mandrill...). Adds ~30 DNS queries per domain; turn off for maximum speed.

## `dkimSelectors` (type: `array`):

Optional. Replace the built-in selector list with your own (e.g. the selectors your ESP uses).

## `maxItems` (type: `integer`):

Stop after this many unique domains (0 = no limit). Useful for testing.

## `maxConcurrency` (type: `integer`):

Higher is faster. 50 is a safe default.

## `dnsTimeoutSecs` (type: `integer`):

Per-query timeout. Failed queries are retried twice with backoff, switching resolver.

## `dohEndpoints` (type: `array`):

Optional JSON DoH endpoints to rotate between. Default: Cloudflare (cloudflare-dns.com/dns-query) with Google (dns.google/resolve) as fallback.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "stripe.com",
    "hello@shopify.com",
    "https://www.ibm.com"
  ],
  "checkDkim": true,
  "dkimSelectors": [],
  "maxItems": 0,
  "maxConcurrency": 50,
  "dnsTimeoutSecs": 6,
  "dohEndpoints": []
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "stripe.com",
        "hello@shopify.com",
        "https://www.ibm.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("mossgreen_zed/email-provider-deliverability-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "stripe.com",
        "hello@shopify.com",
        "https://www.ibm.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("mossgreen_zed/email-provider-deliverability-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "stripe.com",
    "hello@shopify.com",
    "https://www.ibm.com"
  ]
}' |
apify call mossgreen_zed/email-provider-deliverability-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mossgreen_zed/email-provider-deliverability-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/VW2QWrgbSuq1pKtdg/builds/jlusHDUWTNqILNCpo/openapi.json