SPF, DKIM & DMARC Checker: Bulk Email Domain Security Audit

Bulk SPF, DKIM and DMARC checker on Apify: paste a list of domains, emails or URLs and get an A-F email security grade, spoofing risk, mail provider, the services allowed to send for each domain and plain-English fixes, exported to Excel, CSV and JSON. Apify's free plan includes $5 of monthly platform credit, enough for roughly 2,500 domains at $0.002 each (pricing below).

Find out in seconds which domains can be spoofed, which ones break Gmail and Yahoo sender rules, and exactly what to change in DNS.

Email deliverability audits usually mean checking one domain at a time in MXToolbox-style web tools. Email Domain Security Checker reads public DNS for every domain in your list and returns one clean row per domain:

• ✅ SPF: the record, its ending (-all, ~all, ?all, +all), the DNS lookup count against the limit of 10 (followed through every include), duplicate records and the senders it authorizes (Google Workspace, Microsoft 365, SendGrid, Mailchimp, HubSpot, Amazon SES, Klaviyo… about 40 recognized)
• 🛡️ DMARC: policy (none / quarantine / reject), subdomain policy, pct, reporting address present, duplicate records
• 🔑 DKIM: about 40 common selectors probed (google, selector1/2, k1, s1/s2, mandrill, zoho…), plus your own custom selectors
• 📬 MX and mail provider: Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast, Cloudflare, GoDaddy and 40+ more; null MX detection
• 🔒 MTA-STS, TLS-RPT and BIMI records
• 🅰️ Grade A-F, 0-100 score and a spoofable flag, with fixes in priority order (high / medium / low)
• 📊 Excel + CSV export: a Domains sheet with grade colors and a Fixes sheet with one row per fix
• 💸 $0.002 per domain. 1,000 domains cost $2.00. Domains that don't exist are listed free

Who it's for

• Cold email and outbound agencies: check every sending domain (and your clients') before a campaign, and segment prospect lists by mail provider
• Deliverability and IT consultants, MSPs, Fiverr / Upwork freelancers: a client-ready audit with the exact fixes in minutes, for one domain or thousands
• Security teams: find spoofable brand and parked domains across a portfolio
• Marketers: confirm you meet the Gmail / Yahoo bulk-sender rules (SPF or DKIM plus a DMARC record)

How to use the SPF, DKIM and DMARC checker

1. Click Try for free.
2. Paste domains, emails or URLs, one per line. name@company.com and https://www.company.com/page both become company.com; duplicates are removed.
3. Optional: add extra DKIM selectors if you sign with a custom one.
4. Click Start. 100 domains take about 15 seconds. Download DOMAINS_XLSX or DOMAINS_CSV from Storage → Key-value store, or use the dataset via API.

Input example

{
  "domains": ["stripe.com", "asu.edu", "bob@shopify.com", "https://www.github.com/about"],
  "dkimSelectors": ["20230601"]
}

Output example

One row per domain. A real row from a test run:

{
  "domain": "asu.edu",
  "grade": "B",
  "score": 80,
  "spoofable": true,
  "mailProvider": "Cloudflare Email Security",
  "spfRecord": "v=spf1 +include:spf.asu.edu include:spf2.asu.edu include:lsoft.com include:_spf.google.com include:spf.protection.outlook.com ~all",
  "spfAll": "~all (softfail)",
  "spfLookups": 5,
  "spfSenders": ["Google Workspace", "Microsoft 365"],
  "dmarcPolicy": "none",
  "dmarcPct": 100,
  "dmarcReporting": true,
  "dkimSelectorsFound": ["google", "selector1", "k2", "k3", "s1", "s2", "default"],
  "mtaSts": null,
  "tlsRpt": false,
  "fixes": ["[high] DMARC policy is \"none\" (monitor only): spoofed mail still gets delivered. Move to p=quarantine, then p=reject, once your real senders pass SPF/DKIM."],
  "status": "checked",
  "agentSummary": "asu.edu: grade B (80/100); spoofable; mail by Cloudflare Email Security; SPF ~all (softfail); DMARC none; DKIM found (google, selector1, k2); top fix: DMARC policy is \"none\" (monitor only)…"
}

Fields

Field	What it is
grade, score, spoofable	A-F grade, 0-100 points, and whether someone else can send mail that looks like yours (no SPF, no DMARC or DMARC p=none)
mailProvider, mxHosts, nullMx	Who receives the domain's mail, the MX hosts, and whether the domain declares it never receives mail
spfRecord, spfAll, spfLookups, spfSenders	SPF record, its ending, DNS lookups used (limit 10) and recognized sending services
dmarcRecord, dmarcPolicy, dmarcSubdomainPolicy, dmarcPct, dmarcReporting	DMARC record and settings
dkimSelectorsFound, dkimNote	DKIM selectors with a published key
mtaSts, tlsRpt, bimi	MTA-STS policy mode, TLS reporting, BIMI logo record
fixes	What to change, highest priority first
status	checked, domain does not exist or a DNS error (not charged)
agentSummary	One plain-English line per domain

Scoring: MX 10, SPF 30, DMARC 37, DKIM 15, MTA-STS 4, TLS-RPT 2, BIMI 2. A = 90+, B = 75+, C = 60+, D = 40+, F below 40.

Files in the key-value store

Key	What it is
DOMAINS_XLSX	Excel workbook: Domains (grade colors), Fixes (one row per fix), Run log and Read me
DOMAINS_CSV	Domains table as CSV (UTF-8, opens cleanly in Excel)
SUMMARY	JSON: grade counts, spoofable count, top mail providers, a one-line takeaway and nextStep

For AI agents

Use this Actor to check SPF, DKIM, DMARC, MX provider, MTA-STS and BIMI for domains and get fixes. Call it with Apify's MCP server (https://mcp.apify.com, tool call-actor, Actor pandadad0214/email-domain-security-checker) or the API (POST https://api.apify.com/v2/acts/pandadad0214~email-domain-security-checker/run-sync-get-dataset-items).

Minimal input:

{"domains": ["example.com", "name@company.com"]}

Each dataset item includes:

• agentSummary: one line, e.g. stripe.com: grade A (92/100); protected from spoofing; mail by Google Workspace; SPF ~all (softfail); DMARC reject; DKIM found (google, s1, s2)
• grade, score, spoofable: the verdict
• mailProvider, spfSenders: who receives and who sends
• fixes: list of strings, highest priority first

The run's key-value store has a SUMMARY record with grades, spoofable, mailProviders, a one-line takeaway and nextStep. Invalid entries are skipped with a warning; domains that don't exist are returned with status and not charged.

SPF, DKIM and DMARC checker pricing

Apify paid-plan discounts: Bronze members pay 10% less, Silver 20% less and Gold 30% less per domain. Free-plan prices are shown below; the discount applies automatically.

$0.002 per domain checked (pay-per-event), plus a tiny Actor-start fee of $0.00005. Excel, CSV, fixes and the summary are included. Domains that don't exist or can't be resolved cost nothing. Your maximum charge per run is respected.

FAQ

Is there a free way to try this DMARC checker? Yes. Apify's free plan includes $5 of monthly platform credit, enough for roughly 2,500 domains.

Where does the data come from? Live public DNS (Google Public DNS over HTTPS, with Cloudflare as backup) at the moment you run it. Nothing is cached or guessed.

Why does it say no DKIM when I have DKIM? DKIM keys live under a selector name that DNS can't list. The checker tries about 40 common selectors; if yours is custom (for example Google's dated selectors like 20230601), add it under Extra DKIM selectors.

Does a grade A guarantee the inbox? No. Authentication is the foundation; inbox placement also depends on sending reputation, list quality and content.

Do you send any email or touch my DNS? No. It only reads public DNS records and the public MTA-STS policy file.

Can I use it from code or an AI agent? Yes, via the Apify API, the Python/JS clients, or as a tool through Apify's MCP server.

More Panda Federation tools

• AI Search & SEO Audit
• Local Business Leads
• Podcast Leads Finder
• Federal Contract Finder
• PDF Table Extractor

All Panda Federation Actors on Apify

Questions or a custom check? Open an issue on this Actor's Issues tab.

Changelog

• 2026-11-01: First public release: SPF (with lookup count and sender detection), DMARC, DKIM selector probing, MX provider, MTA-STS, TLS-RPT, BIMI, A-F grades, prioritized fixes, Excel/CSV exports, agent-friendly agentSummary and takeaway, pay-per-event pricing with Bronze/Silver/Gold discounts.