Domain Email Security Audit — SPF, DMARC, DKIM, MTA-STS, DNSSEC

Paste a list of domains, get one row per domain with a 0–100 score, an A–F grade and a prioritised fix list, plus the raw findings:

Check	What you get
SPF	Record, all qualifier, includes, recursive DNS-lookup count vs the RFC 7208 limit of 10, ptr use, duplicate records
DMARC	Policy, subdomain policy, pct, alignment; falls back to the organisational domain and tells you when the policy is inherited. Report addresses are shown as mailto:***@domain (mailbox removed)
DKIM	Keys found at ~36 common selectors + your own, key type and RSA key size (flags < 2048-bit), revoked keys
MX	MX hosts, null MX (RFC 7505) detection
MTA-STS	_mta-sts TXT, policy file from https://mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461), mode, and whether every MX is covered
TLS-RPT, BIMI	Presence and settings
CAA	Allowed certificate authorities (inherited from parent zones per RFC 8659)
DNSSEC	Signed (DS at parent) and validated (AD flag from a validating resolver)
HTTPS	Certificate issuer, TLS version and days until expiry

Domains without MX are treated as non-mail domains: they're scored on the "don't let anyone spoof me" basics (SPF -all, DMARC reject) instead of being penalised for missing DKIM/MTA-STS.

Who it's for

• Agencies, MSPs and IT consultants auditing client portfolios before Google/Yahoo/Microsoft bulk-sender rules bite.
• Cold-email / deliverability teams checking sending domains every week (schedule it and diff the results with any dataset-diff Actor).
• Security teams monitoring brand domains for weak DKIM keys, missing DMARC or expiring certificates.

Pricing (pay per event)

Event	Price
Domain audited	$0.003 per domain
Actor start (Apify standard, once per run)	$0.0003

Invalid domains and domains that don't exist (NXDOMAIN) are free. 1,000 domains = $3. Set "Maximum cost per run" and the Actor stops cleanly when it's reached.

Input example

{ "domains": ["example.com", "https://www.cloudflare.com/", "postmaster@yourcompany.co.jp"], "dkimSelectors": ["s2048"] }

Output example

Real output for example.com: listing/output-example.json. Each row has domain, status, score, grade, issues[] (severity, code, message, points) and one object per check (spf, dmarc, dkim, mx, mtaSts, tlsRpt, bimi, caa, dnssec, https).

How it works / responsible use

• All data comes from public DNS, by default through Cloudflare's public resolver 1.1.1.1 over DNS-over-HTTPS (no API key; Cloudflare's resolver privacy commitments apply). About 40–60 small DNS queries per domain.
• The only HTTP request is the MTA-STS policy file at the fixed well-known URL defined by RFC 8461 (published precisely so that senders fetch it automatically), sent without following redirects as the RFC requires. The HTTPS check opens one TLS handshake to port 443 and reads the certificate; no pages are crawled.
• No personal data is collected or stored: no WHOIS, no SOA contact mailbox, and email addresses in DMARC/TLS-RPT/CAA records are reduced to their domain.
• Connections to private/internal IP addresses are refused.
• DKIM selectors can't be enumerated, so "DKIM not found" means "not at the selectors tried" — add your provider's selector.

Limits

• The score is our own weighting, not an industry standard. It is a checklist, not a deliverability guarantee.
• DNS answers come from one resolver at one moment; changes still propagating may not show yet.
• Default memory 256 MB; our test run (1 domain) peaked at 55 MB.

Not affiliated with Google, Microsoft, Yahoo, Cloudflare or any mailbox provider.

No warranty

Provided as is, without warranty of any kind. Results are automated and can be incomplete or wrong; check anything important against the original source before relying on it.