Email Security & Deliverability Analyzer — Enterprise Email Security Audit

Comprehensive email domain security audit: SPF, DKIM, DMARC, BIMI, MTA-STS DNS record validation, 50+ blacklist lookups, MX record analysis with IP resolution, deliverability scoring (0-100), and detailed remediation advice. Audit your email infrastructure, identify deliverability blockers, and protect your domain reputation.

---

What does it do?

This actor runs a deep security audit of any domain's email infrastructure. It checks every email authentication DNS record (SPF, DKIM, DMARC, BIMI, MTA-STS), scans mail server IPs against 50+ DNS blacklists, analyzes MX records for redundancy and configuration problems, assigns a deliverability score from 0 to 100, and gives you prioritized, actionable remediation steps for anything that fails.

Run it against your own domains to catch misconfigurations before they tank deliverability. Run it against a vendor's domain to assess their email security posture. Run it in batch across all your domains to get a single report in one shot. Every check runs in isolation — one domain timing out won't take down the rest.

---

Features

1. SPF record analysis — Validates Sender Policy Framework records. Catches missing records, multiple-record violations (RFC says exactly one), softfail vs hardfail policy, include chains, and DNS lookup limits.

2. DKIM key discovery — Probes 15 common DKIM selectors (google, selector1, selector2, default, dkim, s1, s2, mail, email, mandrill, sendgrid, amazonses, mailgun, protonmail, zoho) and reports found keys with approximate key strength estimation. Flags keys below 1024 bits.

3. DMARC policy audit — Validates Domain-based Message Authentication records: policy level (none/quarantine/reject), subdomain policy, reporting URI configuration (rua/ruf), alignment modes (adkim/aspf), and enforcement percentage.

4. BIMI record check — Detects Brand Indicators for Message Identification records at default._bimi.{domain}. Validates logo URL and authority parameters.

5. MTA-STS verification — Validates Mail Transfer Agent Strict Transport Security DNS records at _mta-sts.{domain} for enforcing TLS in transit.

6. 50+ DNS blacklist scans — Queries mail server IPs against 51 DNSBL zones including Spamhaus (SBL/XBL/PBL), Barracuda, SpamCop, SORBS, UCEPROTECT (L1/L2/L3), Abusix (combined/black/exploit), Backscatterer, and 40+ more. Reports listings by severity: critical, high, medium, low.

7. MX record analysis — Resolves MX hostnames to IP addresses, checks for redundancy (multiple MX servers on different subnets), validates priority ordering, and flags single points of failure.

8. Deliverability scoring (0-100) — Every check contributes a weighted score impact. Starts at 100 and adjusts up or down based on what passes and what fails. The final number tells you at a glance how solid your email security is.

9. Prioritized remediation advice — Every failing check produces specific, actionable steps with critical/high/medium/low priority. No vague suggestions — it tells you what record to create, where to put it, and what it should say.

10. Concurrent batch processing — Audit up to 50 domains in one run. Each domain is isolated — a DNS timeout on one never blocks the rest.

11. Selective check execution — Run only the checks you need. Pick from spf, dkim, dmarc, bimi, mta-sts, blacklists, and mx-analysis. Skipping checks reduces both runtime and cost.

---

Why use this?

Problem	Solution
Email deliverability is declining	Audit your SPF/DKIM/DMARC configuration to find and fix gaps
You're unsure if your email infrastructure is secure	Get a comprehensive score and prioritized remediation plan
Your domain might be blacklisted	Scan against 50+ DNSBLs to detect and address listings
You're evaluating a vendor's email security	Run a passive audit of their domain's email authentication
You manage multiple domains	Batch-audit all domains in a single run
You need regulatory compliance evidence	Produce a dated security audit trail for each domain
Your emails land in spam	Identify the specific DNS misconfiguration causing deliverability issues

---

Who is it for?

Persona	What they use it for
Email Administrator	Auditing email authentication records, identifying configuration gaps
Security Engineer	Validating email security posture, blacklist monitoring
IT Consultant	Auditing client domains before migrations or onboarding
Deliverability Specialist	Troubleshooting why emails land in spam, finding root causes
Compliance Officer	Producing evidence of email security due diligence
MSP / Email Hosting Provider	Batch-auditing customer domains for proactive maintenance
DevOps Engineer	Integrating email security checks into CI/CD pipelines

---

Input Parameters

Field	Type	Default	Description
domain	string	—	A single domain to audit (e.g., example.com)
domains	array	—	Array of domains for batch auditing
checks	array	All checks	Which checks to run: spf, dkim, dmarc, bimi, mta-sts, blacklists, mx-analysis. Omit for all.

Example Input: Single Domain

{
  "domain": "example.com"
}

Example Input: Batch Mode

{
  "domains": ["github.com", "microsoft.com", "example.com"],
  "checks": ["spf", "dkim", "dmarc", "mx-analysis"]
}

Example Input: All Checks (Default)

{
  "domain": "example.com"
}

---

Output Format

Each dataset item represents one domain audit with the following structure:

Field	Type	Description
domain	string	The audited domain
overall_score	integer	Deliverability score (0-100)
passed	integer	Number of checks that passed
failed	integer	Number of checks that failed
warnings	integer	Number of checks that passed with warnings
checks	object	Detailed results per check type
recommendations	array	Prioritized remediation advice

checks Object Structure

Each check type returns a standardized structure:

Field	Type	Description
check_type	string	Check identifier (spf, dkim, dmarc, bimi, mta-sts, blacklists, mx-analysis)
status	string	pass, fail, or warn
details	object	Check-specific results (parsed records, IPs, listings, etc.)
score_impact	integer	Points added or subtracted from overall score

SPF Check (checks.spf)

Detail Field	Type	Description
raw	string	Raw SPF record text
version	string	SPF version (spf1)
mechanisms	array	All SPF mechanisms (include, ip4, ip6, a, mx, etc.)
policy	string	Enforcement policy: hardfail, softfail, neutral, pass_all
all_mechanism	string	The all mechanism qualifier (-, ~, ?, +)
includes	array	Third-party includes listed in SPF
ip4	array	IPv4 addresses/networks in SPF
ip6	array	IPv6 addresses/networks in SPF

DKIM Check (checks.dkim)

Detail Field	Type	Description
selectors_checked	array	All selectors that were probed
keys_found	array	Selector objects with record, key algorithm, and strength estimation
selector_count	integer	Number of selectors with published keys

DMARC Check (checks.dmarc)

Detail Field	Type	Description
raw	string	Raw DMARC record
policy	string	none, quarantine, or reject
subdomain_policy	string	Subdomain policy override (sp=)
pct	integer	Percentage of email DMARC applies to
rua	string	Aggregate report URI
ruf	string	Forensic report URI
adkim	string	DKIM alignment mode (r/s)
aspf	string	SPF alignment mode (r/s)

Blacklists Check (checks.blacklists)

Detail Field	Type	Description
ips_checked	integer	Number of IPs scanned
blacklists_queried	integer	Number of DNSBL zones queried
total_queries	integer	Total IP × zone lookups performed
listed_count	integer	Total blacklist listings found
critical_listings	integer	Listings on critical-severity blacklists
high_listings	integer	Listings on high-severity blacklists
results	array	Full listing results per IP per blacklist

MX Analysis (checks.mx-analysis)

Detail Field	Type	Description
has_mx	boolean	Whether MX records exist
mx_count	integer	Number of MX records
mx_records	array	MX entries with priority, hostname, and resolved IP addresses

recommendations Array

Each recommendation has:

Field	Type	Description
priority	string	critical, high, medium, or low
action	string	One-line description of the required action
detail	string	Detailed explanation and implementation guidance

Example Output JSON

{
  "domain": "example.com",
  "overall_score": 55,
  "passed": 2,
  "failed": 3,
  "warnings": 2,
  "checks": {
    "spf": {
      "check_type": "spf",
      "status": "warn",
      "details": {
        "raw": "v=spf1 -all",
        "version": "spf1",
        "mechanisms": ["-all"],
        "policy": "hardfail",
        "all_mechanism": "-",
        "includes": [],
        "ip4": [],
        "ip6": []
      },
      "score_impact": 15
    },
    "dkim": {
      "check_type": "dkim",
      "status": "fail",
      "details": {
        "selectors_checked": ["google", "selector1", "selector2", "default", "dkim", "s1", "s2", "mail", "email", "mandrill", "sendgrid", "amazonses", "mailgun", "protonmail", "zoho"],
        "keys_found": [],
        "error": "No DKIM keys found for common selectors"
      },
      "score_impact": -15
    },
    "dmarc": {
      "check_type": "dmarc",
      "status": "warn",
      "details": {
        "raw": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
        "policy": "reject",
        "pct": 100,
        "rua": "mailto:dmarc@example.com"
      },
      "score_impact": 20
    },
    "bimi": {
      "check_type": "bimi",
      "status": "fail",
      "details": {
        "error": "No BIMI record found at default._bimi.example.com"
      },
      "score_impact": 0
    },
    "mta-sts": {
      "check_type": "mta-sts",
      "status": "fail",
      "details": {
        "error": "No MTA-STS DNS record found at _mta-sts.example.com"
      },
      "score_impact": -5
    },
    "blacklists": {
      "check_type": "blacklists",
      "status": "pass",
      "details": {
        "ips_checked": 1,
        "blacklists_queried": 51,
        "total_queries": 51,
        "listed_count": 0,
        "critical_listings": 0,
        "high_listings": 0
      },
      "score_impact": 10
    },
    "mx-analysis": {
      "check_type": "mx-analysis",
      "status": "pass",
      "details": {
        "has_mx": true,
        "mx_count": 1,
        "mx_records": [
          {"priority": 0, "hostname": "", "ip_addresses": ["93.184.216.34"]}
        ]
      },
      "score_impact": 15
    }
  },
  "recommendations": [
    {
      "priority": "critical",
      "action": "Enable DKIM signing for your domain",
      "detail": "Configure DKIM in your email provider's settings. Generate a DKIM key pair and publish the public key as a DNS TXT record."
    },
    {
      "priority": "high",
      "action": "Publish at least a default DKIM selector",
      "detail": "Common selectors: google (Google Workspace), selector1/selector2 (Microsoft 365), default"
    },
    {
      "priority": "medium",
      "action": "Implement MTA-STS for TLS enforcement",
      "detail": "Create a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt and a TXT record at _mta-sts.example.com."
    },
    {
      "priority": "low",
      "action": "SPF is properly configured",
      "detail": "Your SPF record is valid and correctly published. No action needed."
    },
    {
      "priority": "low",
      "action": "DMARC is properly configured",
      "detail": "DMARC policy is published and enforcement is active. No action needed."
    },
    {
      "priority": "low",
      "action": "Consider implementing BIMI for brand visibility",
      "detail": "Add a TXT record at default._bimi.example.com: v=BIMI1; l=https://example.com/logo.svg; a="
    },
    {
      "priority": "high",
      "action": "Add redundant MX servers for high availability",
      "detail": "A single MX server is a single point of failure. Add at least one backup MX with a higher priority value."
    }
  ]
}

---

Score Interpretation

Score Range	Rating	What It Means
90-100	Excellent	All core security checks passing. Strong email security posture.
70-89	Good	Most checks passing with minor warnings. Low deliverability risk.
50-69	Fair	Several checks failing or missing. Moderate deliverability risk.
30-49	Poor	Critical checks failing. High risk of deliverability issues.
0-29	Critical	Major failures detected (blacklisted, missing SPF/DMARC, no MX). Immediate action required.

How the score is calculated

The actor starts at 100 and adjusts up or down based on each check result:

Check	Passing	Failing
SPF (hardfail)	+15	-20 to -25
DKIM	+15	-15
DMARC (reject)	+20	-25
BIMI	+3	0 (optional)
MTA-STS	+5	-5
Blacklists (clean)	+10	-5 to -30
MX Analysis	+15	-15 to -25

• SPF with softfail scores +5 (warning, not a pass). SPF with no all mechanism scores -5.
• DMARC with quarantine scores +15 instead of +20. DMARC with none scores 0.
• Blacklist impact depends on severity: critical listing = -30, high = -20, medium/low = -5.
• MX with a single server scores +5 instead of +15. No MX records = -25. A-record fallback (no MX but has A record) = -15.
• Final score is clamped to 0-100.

---

FAQ

Q: Does this actor require any credentials or API keys?

A: No. All checks use public DNS queries via dig. No third-party APIs, no authentication required.

Q: How long does an audit take?

A: A single domain with all checks (including 51 blacklist queries) typically finishes in 15-45 seconds, depending on DNS resolution speed and the number of MX IPs found. Batch mode processes domains concurrently so total time is much less than the sum of individual audits.

Q: Why might DKIM show as "not found" even though my domain uses DKIM?

A: The actor probes 15 common selectors: google, selector1, selector2, default, dkim, s1, s2, mail, email, mandrill, sendgrid, amazonses, mailgun, protonmail, zoho. If your DKIM selector is something unusual (e.g., pm-bounces, scph0816), it won't be found. The selector list covers the most common ones used by major email providers.

Q: Can blacklist checks get my IP blacklisted?

A: No. DNSBL lookups are read-only DNS queries — they use the same mechanism email servers use to check incoming mail. They don't modify state on any blacklist and can't trigger a listing.

Q: What does a score of 100 mean?

A: All core checks are passing: SPF with hardfail, DKIM keys found, DMARC with reject policy, MTA-STS active, MX records with redundancy, and no blacklist listings. This is the ideal state. Most production domains score 60-85.

Q: Is BIMI required for good deliverability?

A: No. BIMI is optional and primarily for brand visibility (logo display in supported clients). A missing BIMI record has zero score impact — it's a bonus, not a requirement.

Q: How does batch mode differ from single domain?

A: Batch mode processes multiple domains concurrently and charges an additional batch-audit event. Each domain is independently audited with full error isolation — a DNS timeout for one domain never affects others.

Q: Can I run only specific checks?

A: Yes. Use the checks parameter to select only the checks you need: ["spf", "dmarc", "blacklists"]. Skipping checks reduces both runtime and cost.

Q: What happens if dig is unavailable?

A: The Docker image includes dnsutils which provides dig. If dig fails at runtime for any reason, the check returns an error status with the exception details rather than crashing the entire run.

Q: How accurate is the DKIM key strength estimation?

A: It's approximate. The actor estimates bit strength from the base64-encoded public key length. For precise key validation, use a dedicated DKIM testing tool. Keys below roughly 1024 bits trigger a strength warning.

Q: Does this check for STARTTLS or DANE?

A: MTA-STS enforcement is checked via the DNS record (v=STSv1). DANE/TLSA records and SMTP STARTTLS availability are not currently checked.

Q: What if a DNSBL zone is unresponsive?

A: Each DNSBL query has a 5-second timeout. Unresponsive zones are logged but don't block the audit. The actor continues to the next zone and only reports results from zones that responded.

---

API Usage

cURL

curl -X POST "https://api.apify.com/v2/acts/perryay~email-security-analyzer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Python (ApifyClient)

from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("perryay~email-security-analyzer").call(
    run_input={"domain": "example.com"}
)
dataset = client.dataset(run["defaultDatasetId"]).list_items()
for item in dataset.items:
    print(f'{item["domain"]}: score={item["overall_score"]}, '
          f'pass={item["passed"]} fail={item["failed"]}')
    for rec in item["recommendations"][:3]:
        print(f'  [{rec["priority"]}] {rec["action"]}')

---

Use Cases

1. Pre-migration email audit — Before migrating email hosting, audit the destination domain to make sure SPF, DKIM, and DMARC are configured correctly. Catch missing records before they cause delivery failures.

2. Quarterly security review — Run automated audits of all company domains every quarter. Track scores over time to demonstrate your email security posture is improving, not degrading.

3. Vendor risk assessment — Before integrating with a third-party email provider, audit their domain. A vendor with weak DMARC or missing MTA-STS is a risk you should know about.

4. Deliverability troubleshooting — When emails from your domain land in spam, run a full audit. The remediation advice tells you exactly what DNS record is missing or misconfigured and how to fix it.

5. Blacklist monitoring — Set up recurring audits to catch mail server IPs the moment they appear on a DNS blacklist. Early detection means faster delisting and less damage to deliverability.

6. Client onboarding for MSPs — When bringing a new client onto your managed email platform, audit their domain first. Identify pre-existing issues and set clear expectations for what needs fixing.

7. Compliance reporting — Generate dated security audit reports as evidence of email security due diligence for SOC 2, ISO 27001, or internal security reviews.

8. Brand protection — Check BIMI configuration to make sure your brand logo displays correctly in Gmail and Apple Mail, and verify your DMARC reject policy is actually preventing domain spoofing.

9. CI/CD pipeline integration — Run email security audits as part of infrastructure-as-code validation. Catch DNS misconfigurations before they reach production.