# SPF, DKIM & DMARC Checker: Bulk Email Domain Security Audit (`pandadad0214/email-domain-security-checker`) Actor

Use this to check SPF, DKIM, DMARC, MX provider, BIMI and MTA-STS for a list of domains or emails. Output: one row per domain with an A-F grade, spoofing risk, mail provider, senders and plain-English fixes, plus Excel and CSV.

- **URL**: https://apify.com/pandadad0214/email-domain-security-checker.md
- **Developed by:** [Panda Federation](https://apify.com/pandadad0214) (community)
- **Categories:** Developer tools, Marketing, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SPF, DKIM & DMARC Checker: Bulk Email Domain Security Audit

> **Bulk SPF, DKIM and DMARC checker** on Apify: paste a list of domains, emails or URLs and get an **A-F email security grade**, **spoofing risk**, **mail provider**, the services allowed to send for each domain and **plain-English fixes**, exported to Excel, CSV and JSON. Apify's free plan includes $5 of monthly platform credit, enough for roughly 2,500 domains at $0.002 each (pricing below).

**Find out in seconds which domains can be spoofed, which ones break Gmail and Yahoo sender rules, and exactly what to change in DNS.**

Email deliverability audits usually mean checking one domain at a time in MXToolbox-style web tools. **Email Domain Security Checker** reads public DNS for every domain in your list and returns one clean row per domain:

- ✅ **SPF:** the record, its ending (`-all`, `~all`, `?all`, `+all`), the **DNS lookup count** against the limit of 10 (followed through every include), duplicate records and the **senders** it authorizes (Google Workspace, Microsoft 365, SendGrid, Mailchimp, HubSpot, Amazon SES, Klaviyo… about 40 recognized)
- 🛡️ **DMARC:** policy (`none` / `quarantine` / `reject`), subdomain policy, `pct`, reporting address present, duplicate records
- 🔑 **DKIM:** about 40 common selectors probed (google, selector1/2, k1, s1/s2, mandrill, zoho…), plus your own custom selectors
- 📬 **MX and mail provider:** Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast, Cloudflare, GoDaddy and 40+ more; null MX detection
- 🔒 **MTA-STS, TLS-RPT and BIMI** records
- 🅰️ **Grade A-F, 0-100 score and a `spoofable` flag**, with **fixes in priority order** (high / medium / low)
- 📊 **Excel + CSV export:** a Domains sheet with grade colors and a Fixes sheet with one row per fix
- 💸 **$0.002 per domain.** 1,000 domains cost $2.00. Domains that don't exist are listed free

### Who it's for

- **Cold email and outbound agencies:** check every sending domain (and your clients') before a campaign, and segment prospect lists by mail provider
- **Deliverability and IT consultants, MSPs, Fiverr / Upwork freelancers:** a client-ready audit with the exact fixes in minutes, for one domain or thousands
- **Security teams:** find spoofable brand and parked domains across a portfolio
- **Marketers:** confirm you meet the Gmail / Yahoo bulk-sender rules (SPF or DKIM plus a DMARC record)

### How to use the SPF, DKIM and DMARC checker

1. Click **Try for free**.
2. Paste **domains, emails or URLs**, one per line. `name@company.com` and `https://www.company.com/page` both become `company.com`; duplicates are removed.
3. Optional: add **extra DKIM selectors** if you sign with a custom one.
4. Click **Start**. 100 domains take about 15 seconds. Download **DOMAINS_XLSX** or **DOMAINS_CSV** from **Storage → Key-value store**, or use the dataset via API.

#### Input example

```json
{
  "domains": ["stripe.com", "asu.edu", "bob@shopify.com", "https://www.github.com/about"],
  "dkimSelectors": ["20230601"]
}
```

### Output example

![Example output table from a real email-domain-security-checker run](https://api.apify.com/v2/key-value-stores/0eeXxTD8eJjgE6yTA/records/shot-email-domain-security-checker)

One row per domain. A real row from a test run:

```json
{
  "domain": "asu.edu",
  "grade": "B",
  "score": 80,
  "spoofable": true,
  "mailProvider": "Cloudflare Email Security",
  "spfRecord": "v=spf1 +include:spf.asu.edu include:spf2.asu.edu include:lsoft.com include:_spf.google.com include:spf.protection.outlook.com ~all",
  "spfAll": "~all (softfail)",
  "spfLookups": 5,
  "spfSenders": ["Google Workspace", "Microsoft 365"],
  "dmarcPolicy": "none",
  "dmarcPct": 100,
  "dmarcReporting": true,
  "dkimSelectorsFound": ["google", "selector1", "k2", "k3", "s1", "s2", "default"],
  "mtaSts": null,
  "tlsRpt": false,
  "fixes": ["[high] DMARC policy is \"none\" (monitor only): spoofed mail still gets delivered. Move to p=quarantine, then p=reject, once your real senders pass SPF/DKIM."],
  "status": "checked",
  "agentSummary": "asu.edu: grade B (80/100); spoofable; mail by Cloudflare Email Security; SPF ~all (softfail); DMARC none; DKIM found (google, selector1, k2); top fix: DMARC policy is \"none\" (monitor only)…"
}
```

#### Fields

| Field | What it is |
|---|---|
| `grade`, `score`, `spoofable` | A-F grade, 0-100 points, and whether someone else can send mail that looks like yours (no SPF, no DMARC or DMARC `p=none`) |
| `mailProvider`, `mxHosts`, `nullMx` | Who receives the domain's mail, the MX hosts, and whether the domain declares it never receives mail |
| `spfRecord`, `spfAll`, `spfLookups`, `spfSenders` | SPF record, its ending, DNS lookups used (limit 10) and recognized sending services |
| `dmarcRecord`, `dmarcPolicy`, `dmarcSubdomainPolicy`, `dmarcPct`, `dmarcReporting` | DMARC record and settings |
| `dkimSelectorsFound`, `dkimNote` | DKIM selectors with a published key |
| `mtaSts`, `tlsRpt`, `bimi` | MTA-STS policy mode, TLS reporting, BIMI logo record |
| `fixes` | What to change, highest priority first |
| `status` | `checked`, `domain does not exist` or a DNS error (not charged) |
| `agentSummary` | One plain-English line per domain |

**Scoring:** MX 10, SPF 30, DMARC 37, DKIM 15, MTA-STS 4, TLS-RPT 2, BIMI 2. A = 90+, B = 75+, C = 60+, D = 40+, F below 40.

#### Files in the key-value store

| Key | What it is |
|---|---|
| `DOMAINS_XLSX` | Excel workbook: **Domains** (grade colors), **Fixes** (one row per fix), **Run log** and **Read me** |
| `DOMAINS_CSV` | Domains table as CSV (UTF-8, opens cleanly in Excel) |
| `SUMMARY` | JSON: grade counts, spoofable count, top mail providers, a one-line `takeaway` and `nextStep` |

### For AI agents

Use this Actor to check SPF, DKIM, DMARC, MX provider, MTA-STS and BIMI for domains and get fixes. Call it with Apify's MCP server (`https://mcp.apify.com`, tool `call-actor`, Actor `pandadad0214/email-domain-security-checker`) or the API (`POST https://api.apify.com/v2/acts/pandadad0214~email-domain-security-checker/run-sync-get-dataset-items`).

Minimal input:

```json
{"domains": ["example.com", "name@company.com"]}
```

Each dataset item includes:

- `agentSummary`: one line, e.g. `stripe.com: grade A (92/100); protected from spoofing; mail by Google Workspace; SPF ~all (softfail); DMARC reject; DKIM found (google, s1, s2)`
- `grade`, `score`, `spoofable`: the verdict
- `mailProvider`, `spfSenders`: who receives and who sends
- `fixes`: list of strings, highest priority first

The run's key-value store has a `SUMMARY` record with `grades`, `spoofable`, `mailProviders`, a one-line `takeaway` and `nextStep`. Invalid entries are skipped with a warning; domains that don't exist are returned with `status` and not charged.

### SPF, DKIM and DMARC checker pricing

**Apify paid-plan discounts:** Bronze members pay 10% less, Silver 20% less and Gold 30% less per domain. Free-plan prices are shown below; the discount applies automatically.

**$0.002 per domain checked** (pay-per-event), plus a tiny Actor-start fee of $0.00005. Excel, CSV, fixes and the summary are included. Domains that don't exist or can't be resolved cost nothing. Your **maximum charge per run** is respected.

### FAQ

**Is there a free way to try this DMARC checker?** Yes. Apify's free plan includes $5 of monthly platform credit, enough for roughly 2,500 domains.

**Where does the data come from?** Live public DNS (Google Public DNS over HTTPS, with Cloudflare as backup) at the moment you run it. Nothing is cached or guessed.

**Why does it say no DKIM when I have DKIM?** DKIM keys live under a selector name that DNS can't list. The checker tries about 40 common selectors; if yours is custom (for example Google's dated selectors like `20230601`), add it under **Extra DKIM selectors**.

**Does a grade A guarantee the inbox?** No. Authentication is the foundation; inbox placement also depends on sending reputation, list quality and content.

**Do you send any email or touch my DNS?** No. It only reads public DNS records and the public MTA-STS policy file.

**Can I use it from code or an AI agent?** Yes, via the Apify API, the Python/JS clients, or as a tool through Apify's MCP server.

### More Panda Federation tools

- [AI Search & SEO Audit](https://apify.com/pandadad0214/ai-search-seo-audit)
- [Local Business Leads](https://apify.com/pandadad0214/local-business-leads)
- [Podcast Leads Finder](https://apify.com/pandadad0214/podcast-leads-finder)
- [Federal Contract Finder](https://apify.com/pandadad0214/federal-contract-finder)
- [PDF Table Extractor](https://apify.com/pandadad0214/pdf-table-extractor)

[All Panda Federation Actors on Apify](https://apify.com/pandadad0214)

Questions or a custom check? Open an issue on this Actor's **Issues** tab.

### Changelog

- **2026-11-01:** First public release: SPF (with lookup count and sender detection), DMARC, DKIM selector probing, MX provider, MTA-STS, TLS-RPT, BIMI, A-F grades, prioritized fixes, Excel/CSV exports, agent-friendly `agentSummary` and `takeaway`, pay-per-event pricing with Bronze/Silver/Gold discounts.

# Actor input Schema

## `domains` (type: `array`):

One per line: example.com, name@example.com or https://www.example.com/page all work (the domain is extracted, www. removed, duplicates dropped). Leave empty for a 3-domain demo.

## `maxDomains` (type: `integer`):

You pay per checked domain, so this also caps the cost. Whole number, 1 to 10,000; default 1,000.

## `dkimSelectors` (type: `array`):

Optional. About 40 common selectors (google, selector1, selector2, k1, s1, s2, default…) are always tried. Add your own if you sign with a custom one, e.g. 20230601 or mailo.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "github.com"
  ],
  "maxDomains": 1000,
  "dkimSelectors": [
    "20230601"
  ]
}
```

# Actor output Schema

## `table` (type: `string`):

No description

## `xlsx` (type: `string`):

No description

## `csv` (type: `string`):

No description

## `summary` (type: `string`):

Run-level summary record. Agent-friendly keys: `takeaway` (one-line result), `grades`, `spoofable`, `mailProviders`, `nextStep` and `nextSteps`.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "github.com",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("pandadad0214/email-domain-security-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "github.com",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("pandadad0214/email-domain-security-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "github.com",
    "example.com"
  ]
}' |
apify call pandadad0214/email-domain-security-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,pandadad0214/email-domain-security-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Ix89IvQp2jIArdXbO/builds/J9WcTK6mWq5iFQ3Qs/openapi.json