📋 Email DMARC Auditor — SPF / DKIM / DMARC Bulk Check

Bulk email-authentication audit over public DNS. For each domain the actor reads the SPF record, the DMARC record at _dmarc.<domain>, the MX records, and probes a list of common DKIM selectors, then returns a deliverability score (0–100) and a prioritised remediation list.

DNS lookups only. This actor does not connect to any mail server, does not send mail, and does not verify mailboxes. Nothing here is an SMTP check or an email-address verification.

Pricing (live, as published on the Apify Store)

Event	Price
actor-start	$0.01 per run — startup cost for loading the DKIM selector list and DNS resolvers
domain-audited	$0.05 per domain fully audited

That is 20 domains per $1, plus one cent per run. You are charged for a domain only when its audit is actually delivered to your dataset:

• A domain whose DNS never answered (after retrying three resolvers over UDP, TCP and DNS-over-HTTPS) is skipped and not charged, and the status message names it.
• A run with no valid domain in domains returns 0 rows and charges nothing at all, not even actor-start.
• If DNS answered for no domain in the run, the run fails and no domain-audited event is charged.
• If the run's maximum charge limit is reached, the run stops before delivering an audit it could not charge for. Rows delivered always equal events charged.

Input

Field	Type	Required	Notes
domains	array of strings	yes	Domains to audit. https:// prefixes, trailing dots and user@ prefixes are stripped; duplicates are removed; entries that are not valid domain names are skipped and counted in the status message.
dkimSelectors	array of strings	no	Extra DKIM selectors to probe alongside the 24 built-in ones (default, google, selector1, selector2, mailgun, sendgrid, …).

Output

One row per audited domain:

Field	Description
domain	the normalised domain audited
deliverability_score	0–100 composite score
mx	{ present, records } — MX presence and hostnames (a null MX "." counts as not present)
spf	parsed SPF: record, valid, includes, ip_mechanisms, all_mode, mechanism_count, exceeds_10_lookups
dmarc	parsed DMARC: record, valid, policy, subdomain_policy, pct, rua, ruf, aspf, adkim, fo, enforcing
dkim	{ found_count, selectors, selectors_probed, selectors_unresolved } — each found selector carries its record and an approximate key size in bits
remediation_actions	ordered list of plain-English fixes
spfRecord	flat alias for spf.record
dmarcPolicy	flat alias for dmarc.policy (null when no valid DMARC record)
issues	flat alias for remediation_actions

selectors_unresolved is the honest part: if a DKIM probe got no DNS answer, it is counted there and called out in remediation_actions rather than being reported as "no such selector".

What the score means

The score is a weighted heuristic, not a guarantee of inbox placement:

• MX present: +10
• Valid SPF: +20, plus +10 for -all or +5 for ~all, minus 15 if the record exceeds the 10-DNS-lookup limit
• Valid DMARC: +20, plus +15 for p=reject or +8 for p=quarantine, plus 5 for pct=100, plus 5 for an rua address
• Any DKIM selector found: +15, minus 10 if the weakest key is under 1024 bits

Quick start

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("nexgendata/email-dmarc-auditor").call(run_input={
    "domains": ["github.com", "example.com"],
    "dkimSelectors": ["selector3"],
})
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row["deliverability_score"], row["dmarcPolicy"])

Use cases

• Pre-sales deliverability audits across a prospect list
• Post-migration verification after moving ESP or mail platform
• Security posture review — spotting p=none domains and missing SPF
• Continuous monitoring on a schedule, alerting when a policy weakens

Run behaviour

• Genuine empty result: a domain that publishes no SPF/DMARC/DKIM is a valid audit — it is delivered, charged, and its remediation list tells you what to publish.
• Source failure: DNS timeouts are retried across three public resolvers over UDP, then TCP, then DNS-over-HTTPS. A domain that still gets no answer is never presented as "publishes nothing".
• Time limit: the run derives a deadline from its own timeout and stops cleanly, reporting how many domains were delivered and charged.

Related NexGenData actors

SSL Checker · Domain Security Posture · CVE Monitor · CISA KEV · Dependency Advisories · Chrome Extension Analyzer

---

A NexGenData utility actor.