Email Authentication Auditor: SPF, DKIM, DMARC & MTA-STS + Fixes

Paste a list of domains and get, for each one, a grade, a list of problems in plain English, a Gmail / Yahoo / Microsoft bulk-sender readiness verdict, and the exact DNS records to publish to fix them.

Most DNS checkers stop at "here is your SPF record". This Actor tells you what is wrong with it and what to change.

What it checks

Check	What you get
SPF	Syntax errors, multiple records, the 10-DNS-lookup limit counted recursively through every include, void lookups, broken includes, +all / ?all / missing all, deprecated ptr, and whether your mailbox provider is authorised
DMARC	Missing or duplicate records, policy strength (none / quarantine / reject), pct, subdomain policy, reporting addresses, external report authorisation, and inheritance from the parent domain
DKIM	Probes 30+ common selectors plus the ones for your detected provider and any you add. Reports key type, key length (flags 1024-bit and weaker keys), test mode, revoked keys, and Microsoft 365 CNAMEs with no key behind them
MTA-STS	TXT record, downloads the policy file over HTTPS, checks the mode and that every MX host is covered (a mismatch in enforce mode silently blocks inbound mail)
TLS-RPT	Presence and reporting address
BIMI	Record, logo URL format, certificate, and whether your DMARC policy is strict enough for logos to show
MX and provider	Detects Google Workspace, Microsoft 365, Zoho, Fastmail, Proton, iCloud, GoDaddy, Namecheap, Yandex, OVHcloud, Rackspace, Amazon WorkMail and common security gateways
Unused domains	Domains that send and receive no mail get lock-down advice (v=spf1 -all, p=reject, null MX) instead of irrelevant DKIM warnings
DNSSEC	Whether the zone validates

Everything is read from public DNS over HTTPS (Cloudflare with Google as fallback). The Actor never sends email and never logs in anywhere.

Who uses it

• MSPs and IT consultants checking every client domain in one run, and getting the records to paste into each DNS panel.
• Agencies and cold-email teams confirming sending domains meet Google, Yahoo and Microsoft rules before a campaign.
• Deliverability and DMARC consultants finding prospects whose domains have no DMARC or a broken SPF record.
• Security and M&A teams reviewing email-spoofing exposure across a portfolio of domains.
• AI agents via the Apify API or MCP server: the output is structured JSON with stable issue IDs.

Input

{
  "domains": ["acme.com", "https://www.example.org", "jane@startup.io"],
  "reportEmail": "dmarc@acme.com",
  "dkimSelectors": ["mycustomselector"],
  "checkMtaStsPolicy": true,
  "maxConcurrency": 5
}

Only domains is required. URLs and email addresses are converted to domains, and duplicates are removed. reportEmail is placed in the DMARC and TLS-RPT records the Actor suggests.

Output

One item per domain. The Overview view shows the summary columns; the Fixes view shows the records to publish. A shortened real example:

{
  "domain": "github.com",
  "grade": "B",
  "score": 85,
  "summary": "B (85/100). Top issue: SPF uses 10 of 10 DNS lookups.",
  "domainType": "receives-mail",
  "mailProvider": "Microsoft 365",
  "spfStatus": "valid",
  "dmarcPolicy": "quarantine",
  "dkimSelectorsFound": ["cm", "google", "k1", "k2", "k3", "s1", "s2", "selector1", "zendesk1", "zendesk2"],
  "mtaStsMode": "none",
  "bulkSenderReadiness": "ready",
  "issueCounts": { "critical": 0, "high": 0, "medium": 0, "low": 5, "info": 1 },
  "issues": [
    { "id": "spf-near-lookup-limit", "severity": "low", "title": "SPF uses 10 of 10 DNS lookups", "detail": "One more include, or a provider adding a nested include, will break SPF." },
    { "id": "dkim-1024", "severity": "low", "title": "DKIM key \"cm\" is 1024 bits", "detail": "Still accepted, but 2048-bit keys are the current recommendation. Rotate when convenient." }
  ],
  "recommendedRecords": [
    { "type": "TXT", "host": "_mta-sts.github.com", "value": "v=STSv1; id=20261031110757", "purpose": "Announce an MTA-STS policy. Change the id whenever the policy file changes." }
  ]
}

Each item also contains the full spf, dmarc, dkim, mtaSts, tlsRpt and bimi objects, with the raw records and every value parsed. A run summary is saved to the key-value store as SUMMARY.

Grades

Every domain starts at 100. Each issue subtracts points by severity: critical 30, high 15, medium 8, low 3. A is 90 and above, B 80, C 65, D 50, and F below 50.

Bulk-sender readiness

• ready: valid SPF, a DMARC record and at least one DKIM key were found.
• dkim-unverified: SPF and DMARC are fine, but no DKIM key was found on the selectors checked. DKIM may still exist under a custom selector.
• not-ready: SPF or DMARC is missing or broken.
• not-applicable: the domain sends no mail.

DNS can show whether the records exist. Alignment and one-click unsubscribe also count toward the Gmail, Yahoo and Microsoft rules, and those can only be checked on real messages.

Pricing

You pay per domain successfully audited. Invalid inputs and domains that do not exist are free. The price is shown on the Actor's pricing tab. Set a maximum cost per run and the Actor stops cleanly when it is reached.

Limits and honest caveats

• DKIM selectors cannot be listed from DNS. The Actor checks the common ones. If yours is custom, read the s= value from a DKIM-Signature header and add it under Extra DKIM selectors.
• Suggested SPF records include your detected mailbox provider only. Add an include for every other service that sends as you before publishing.
• Tighten DMARC to quarantine or reject only after reports show your legitimate mail passes.
• This is a technical check, not a compliance certification.

FAQ

Does it send test emails? No. It only reads public DNS records and, for MTA-STS, one public HTTPS file.

How fast is it? Typically under a second per domain. Hundreds of domains take a few minutes.

Can I schedule it? Yes. Use an Apify schedule to re-audit your domains weekly and get notified when a grade drops.