📋 Email DMARC Auditor — SPF/DKIM/DMARC Bulk Check

The email deliverability audit tool email consultants actually use.

Auditing one domain in MXToolbox is free. Auditing 100 domains costs $149/month on Bulk tier. Valimail Monitor starts at $500/mo. This actor audits 100 domains for ~$0.85 — one-shot, no subscription.

What it checks per domain

• SPF — parses v=spf1 record, counts mechanisms, flags 10-lookup overflow, returns includes/ip mechanisms/all-mode
• DMARC — parses _dmarc.<domain> TXT record, extracts policy (p=), subdomain policy (sp=), percentage (pct=), reporting addresses (rua/ruf), alignment modes (aspf/adkim)
• DKIM — probes 25 common selectors (default, google, selector1, selector2, mailgun, sendgrid, mandrill, etc.) and estimates key length
• MX — confirms domain accepts mail at all
• Deliverability score (0-100) — weighted composite
• Remediation actions — specific, ordered fixes (not generic advice)

Example

import requests

r = requests.post(
    "https://api.apify.com/v2/acts/nexgendata~email-dmarc-auditor/run-sync-get-dataset-items?token=" + APIFY_TOKEN,
    json={"domains": ["google.com", "github.com", "misconfigured-example.com"]}
)

for d in r.json():
    print(f"{d['domain']} — score {d['deliverability_score']}")
    print(f"  SPF:   {d['spf'].get('valid')} all-mode={d['spf'].get('all_mode')}")
    dmarc = d['dmarc']
    print(f"  DMARC: {dmarc.get('valid')} policy={dmarc.get('policy')} pct={dmarc.get('pct')}")
    print(f"  DKIM:  {d['dkim']['found_count']} selectors found")
    for action in d["remediation_actions"]:
        print(f"    → {action}")

Sample output:

google.com — score 95
  SPF:   True all-mode=~all
  DMARC: True policy=reject pct=100
  DKIM:  3 selectors found
    → Email authentication looks healthy.

misconfigured-example.com — score 25
  SPF:   True all-mode=+all
  DMARC: False policy=None pct=None
  DKIM:  0 selectors found
    → SPF 'all' qualifier is +all — any server can send as this domain. Change to -all or ~all.
    → Publish a DMARC record at _dmarc.misconfigured-example.com.
    → No DKIM selector found. Verify your ESP's DKIM selector and publish the record.

cURL

curl -X POST "https://api.apify.com/v2/acts/nexgendata~email-dmarc-auditor/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["example.com"]}'

Common use cases

• Pre-sales audits (deliverability consultants) — scan prospect's domain list, generate compliance report
• M&A due diligence — audit email posture of acquisition target's domain portfolio
• Brand protection — bulk-audit domain variants you own for lookalike spoofing exposure
• DMARC rollout planning — find all your domains still at p=none before enforcement deadline
• RFP compliance — SOC 2 / ISO 27001 / HIPAA evidence collection for email authentication controls
• Google/Yahoo 2024 sender requirements — bulk-verify every domain meets the new requirements before you send

Pricing

• $0.01 per run (startup)
• $0.005 per domain audited

100 domains = $0.51. Same job on Valimail Monitor starts at $500/month.

FAQ

Q: Why probe DKIM selectors? Can't the actor just return the "real" DKIM? A: DKIM has no discovery mechanism — the selector is chosen by the sender, not the domain. The 25 selectors probed cover ~90% of real-world configurations (Google, Microsoft 365, Mailgun, SendGrid, Mandrill, Amazon SES, etc.). If yours is unusual, add it via the dkimSelectors input.

Q: How is the deliverability score computed? A: Weighted: MX present (10), SPF published (20), strong SPF all-mode (+10), DMARC published (20), DMARC enforcing (+15), DKIM found (15), DMARC reporting (+5). Penalties: weak DKIM key, SPF over 10 lookups, permissive SPF. Max 100.

Q: Can this detect DMARC report data (DMARC failure reports)? A: No — DMARC reports are sent by mail receivers to rua/ruf mailboxes. This actor tells you if those mailboxes are configured; parsing the reports themselves is out of scope.

Q: Can I plug this into a monitoring schedule? A: Yes. Schedule the actor daily via Apify schedules. Compare each run's deliverability_score to detect configuration regressions.

Related tools

• Email RBL Bulk Checker
• DNS Propagation Checker
• Email Verification Tool
• Company Email Finder

Try it

📋 Email DMARC Auditor on Apify

New to Apify? Get free platform credits.