# Email & DNS Security Audit (SPF, DMARC, DKIM, MTA-STS) (`pagecraft/email-dns-security-audit`) Actor

Check any domain's email security in bulk: SPF, DMARC policy, DKIM, MTA-STS, TLS-RPT, BIMI and CAA. Spoofing risk, a score out of 100 and step-by-step fixes.

- **URL**: https://apify.com/pagecraft/email-dns-security-audit.md
- **Developed by:** [Pagecraft Tools](https://apify.com/pagecraft) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.50 / 1,000 domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Email & DNS Security Audit: SPF, DMARC, DKIM, MTA-STS Checker

Check **how well any domain is protected against email spoofing and phishing**, in bulk. Get a **score out of 100**, a **spoofing risk** rating and **step-by-step fixes**.

### What it checks

- 📮 **MX** records (can the domain receive email?)
- ✅ **SPF**: present, only one record, under the 10-lookup limit, ending in ~all or -all
- 🛡️ **DMARC**: present, policy (none, quarantine or reject), reporting addresses, subdomain policy
- 🔑 **DKIM**: keys on 20 common selectors (Google, Microsoft 365, Mailchimp, Zoho, Proton and more)
- 🔒 **MTA-STS** (policy file read and mode reported) and **TLS-RPT**
- 🏷️ **BIMI** and **CAA**

### Who it's for

IT and security teams checking their own domains, MSPs auditing clients, deliverability consultants, and sales teams building lead lists of companies with weak email security.

### Input

| Field | What to enter |
| --- | --- |
| Domains or URLs | `acme.com`, `https://www.acme.com` or `someone@acme.com`; one per line, duplicates removed |

```json
{ "domains": ["acme.com", "example.org", "ceo@startup.io"] }
```

### Output

One row per domain:

```json
{
  "domain": "acme.com", "score": 62, "grade": "C", "spoofingRisk": "high",
  "mx": ["aspmx.l.google.com"],
  "spf": { "record": "v=spf1 include:_spf.google.com ~all", "records": 1, "dnsLookups": 1, "allQualifier": "~" },
  "dmarc": { "record": "v=DMARC1; p=none; rua=mailto:dmarc@acme.com", "policy": "none", "aggregateReports": "mailto:dmarc@acme.com" },
  "dkim": { "selectorsFound": [{ "selector": "google", "revoked": false, "keyType": "rsa" }], "selectorsChecked": 20 },
  "mtaSts": null, "tlsRpt": null, "bimi": null, "caa": [], "nameservers": ["ns1.example-dns.com"],
  "recommendations": ["DMARC policy is \"none\", so spoofed email is still delivered. Move to quarantine, then reject.", "..."]
}
```

**Scoring:** DMARC (present 20, enforced 15, reports 5), SPF (present 15, single record 5, under 10 lookups 5, strict ending 5), MX 10, DKIM 10, MTA-STS 4, TLS-RPT 2, BIMI 2, CAA 2. Grade A is 90 or more, B 75, C 55, D 35, below that E. **Spoofing risk** is high with no DMARC or `p=none`, medium with quarantine and low with reject.

### Pricing

Pay per domain audited. Domains that do not exist or cannot be resolved cost the lower failed fee.

| Event | When it is charged | Price per 1,000 (Free / Bronze / Silver / Gold plan) |
| --- | --- | --- |
| Domain audited | Each domain audited. | $5 / $4.50 / $4 / $3.50 |
| Domain failed | A domain that does not exist or could not be resolved. | $1.50 on every plan |

Set **Maximum cost per run** to cap your spend: the run stops cleanly at your limit.

### Notes

DKIM can only be found on known selectors; a custom selector may show as missing even when DKIM is set up. Input can be domains, URLs or email addresses.

# Actor input Schema

## `domains` (type: `array`):

Company domains (acme.com), URLs, or even email addresses (the domain is used). One per line; duplicates are removed.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "stripe.com",
    "bbc.co.uk"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "stripe.com",
        "bbc.co.uk"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("pagecraft/email-dns-security-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "stripe.com",
        "bbc.co.uk",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("pagecraft/email-dns-security-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "stripe.com",
    "bbc.co.uk"
  ]
}' |
apify call pagecraft/email-dns-security-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,pagecraft/email-dns-security-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/YwOo0vGzb5YMkPgq1/builds/T61ehGAEDd4yc0N9A/openapi.json