# 📋 Email DMARC Auditor — SPF/DKIM/DMARC Bulk Check (`nexgendata/email-dmarc-auditor`) Actor Bulk email authentication audit. Parses SPF, DMARC, and DKIM records, returns deliverability score (0-100), and step-by-step remediation actions per domain. - **URL**: https://apify.com/nexgendata/email-dmarc-auditor.md - **Developed by:** [Stephan Corbeil](https://apify.com/nexgendata) (community) - **Categories:** Developer tools, Marketing, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## 📋 Email DMARC Auditor — SPF/DKIM/DMARC Bulk Check **The email deliverability audit tool email consultants actually use.** Auditing one domain in MXToolbox is free. Auditing 100 domains costs $149/month on Bulk tier. Valimail Monitor starts at $500/mo. This actor audits 100 domains for **~$0.85** — one-shot, no subscription. ### What it checks per domain - **SPF** — parses `v=spf1` record, counts mechanisms, flags 10-lookup overflow, returns includes/ip mechanisms/all-mode - **DMARC** — parses `_dmarc.` TXT record, extracts policy (`p=`), subdomain policy (`sp=`), percentage (`pct=`), reporting addresses (`rua`/`ruf`), alignment modes (`aspf`/`adkim`) - **DKIM** — probes 25 common selectors (`default`, `google`, `selector1`, `selector2`, `mailgun`, `sendgrid`, `mandrill`, etc.) and estimates key length - **MX** — confirms domain accepts mail at all - **Deliverability score** (0-100) — weighted composite - **Remediation actions** — specific, ordered fixes (not generic advice) ### Example ```python import requests r = requests.post( "https://api.apify.com/v2/acts/nexgendata~email-dmarc-auditor/run-sync-get-dataset-items?token=" + APIFY_TOKEN, json={"domains": ["google.com", "github.com", "misconfigured-example.com"]} ) for d in r.json(): print(f"{d['domain']} — score {d['deliverability_score']}") print(f" SPF: {d['spf'].get('valid')} all-mode={d['spf'].get('all_mode')}") dmarc = d['dmarc'] print(f" DMARC: {dmarc.get('valid')} policy={dmarc.get('policy')} pct={dmarc.get('pct')}") print(f" DKIM: {d['dkim']['found_count']} selectors found") for action in d["remediation_actions"]: print(f" → {action}") ```` Sample output: ``` google.com — score 95 SPF: True all-mode=~all DMARC: True policy=reject pct=100 DKIM: 3 selectors found → Email authentication looks healthy. misconfigured-example.com — score 25 SPF: True all-mode=+all DMARC: False policy=None pct=None DKIM: 0 selectors found → SPF 'all' qualifier is +all — any server can send as this domain. Change to -all or ~all. → Publish a DMARC record at _dmarc.misconfigured-example.com. → No DKIM selector found. Verify your ESP's DKIM selector and publish the record. ``` ### cURL ```bash curl -X POST "https://api.apify.com/v2/acts/nexgendata~email-dmarc-auditor/run-sync-get-dataset-items?token=$APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"domains":["example.com"]}' ``` ### Common use cases - **Pre-sales audits (deliverability consultants)** — scan prospect's domain list, generate compliance report - **M\&A due diligence** — audit email posture of acquisition target's domain portfolio - **Brand protection** — bulk-audit domain variants you own for lookalike spoofing exposure - **DMARC rollout planning** — find all your domains still at `p=none` before enforcement deadline - **RFP compliance** — SOC 2 / ISO 27001 / HIPAA evidence collection for email authentication controls - **Google/Yahoo 2024 sender requirements** — bulk-verify every domain meets the new requirements before you send ### Pricing - **$0.01 per run** (startup) - **$0.005 per domain audited** 100 domains = **$0.51**. Same job on Valimail Monitor starts at $500/month. ### FAQ **Q: Why probe DKIM selectors? Can't the actor just return the "real" DKIM?** A: DKIM has no discovery mechanism — the selector is chosen by the sender, not the domain. The 25 selectors probed cover ~90% of real-world configurations (Google, Microsoft 365, Mailgun, SendGrid, Mandrill, Amazon SES, etc.). If yours is unusual, add it via the `dkimSelectors` input. **Q: How is the deliverability score computed?** A: Weighted: MX present (10), SPF published (20), strong SPF all-mode (+10), DMARC published (20), DMARC enforcing (+15), DKIM found (15), DMARC reporting (+5). Penalties: weak DKIM key, SPF over 10 lookups, permissive SPF. Max 100. **Q: Can this detect DMARC report data (DMARC failure reports)?** A: No — DMARC reports are sent by mail receivers to `rua`/`ruf` mailboxes. This actor tells you if those mailboxes are configured; parsing the reports themselves is out of scope. **Q: Can I plug this into a monitoring schedule?** A: Yes. Schedule the actor daily via Apify schedules. Compare each run's `deliverability_score` to detect configuration regressions. ### Related tools - [Email RBL Bulk Checker](https://apify.com/nexgendata/email-rbl-checker?fpr=2ayu9b) - [DNS Propagation Checker](https://apify.com/nexgendata/dns-propagation-checker?fpr=2ayu9b) - [Email Verification Tool](https://apify.com/nexgendata/email-verification-tool?fpr=2ayu9b) - [Company Email Finder](https://apify.com/nexgendata/company-email-finder?fpr=2ayu9b) ### Try it [📋 Email DMARC Auditor on Apify](https://apify.com/nexgendata/email-dmarc-auditor?fpr=2ayu9b) New to Apify? [Get free platform credits](https://www.apify.com/?fpr=2ayu9b). # Actor input Schema ## `domains` (type: `array`): List of domains to audit. The actor probes SPF, DMARC, MX, and ~25 common DKIM selectors per domain. ## `dkimSelectors` (type: `array`): Custom DKIM selectors to check in addition to the built-in list (default, google, selector1, selector2, mailgun, sendgrid, etc). ## Actor input object example ```json { "domains": [ "google.com", "github.com", "example.com" ], "dkimSelectors": [] } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "google.com", "github.com", "example.com" ], "dkimSelectors": [] }; // Run the Actor and wait for it to finish const run = await client.actor("nexgendata/email-dmarc-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "google.com", "github.com", "example.com", ], "dkimSelectors": [], } # Run the Actor and wait for it to finish run = client.actor("nexgendata/email-dmarc-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "google.com", "github.com", "example.com" ], "dkimSelectors": [] }' | apify call nexgendata/email-dmarc-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=nexgendata/email-dmarc-auditor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "📋 Email DMARC Auditor — SPF/DKIM/DMARC Bulk Check", "description": "Bulk email authentication audit. Parses SPF, DMARC, and DKIM records, returns deliverability score (0-100), and step-by-step remediation actions per domain.", "version": "0.0", "x-build-id": "7lp2xRI3dRlrLyHxP" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/nexgendata~email-dmarc-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-nexgendata-email-dmarc-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/nexgendata~email-dmarc-auditor/runs": { "post": { "operationId": "runs-sync-nexgendata-email-dmarc-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/nexgendata~email-dmarc-auditor/run-sync": { "post": { "operationId": "run-sync-nexgendata-email-dmarc-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Domains to audit", "type": "array", "description": "List of domains to audit. The actor probes SPF, DMARC, MX, and ~25 common DKIM selectors per domain.", "items": { "type": "string" } }, "dkimSelectors": { "title": "Additional DKIM selectors to probe", "type": "array", "description": "Custom DKIM selectors to check in addition to the built-in list (default, google, selector1, selector2, mailgun, sendgrid, etc).", "items": { "type": "string" } } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```