# Email Authentication Auditor (`phoenix2810/email-auth-auditor`) Actor Audit a domain's SPF, DMARC, and DKIM email authentication DNS records for deliverability and security readiness. - **URL**: https://apify.com/phoenix2810/email-auth-auditor.md - **Developed by:** [Sanskar Jaiswal](https://apify.com/phoenix2810) (community) - **Categories:** SEO tools, Developer tools, Open source - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.005 / actor start This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Email Authentication Auditor Fetches and audits a domain's SPF, DMARC, and DKIM email authentication DNS records. It reports enforcement policies, DKIM key availability, configuration issues, a readiness score, and actionable recommendations. ### Use cases - Email deliverability checks before sending campaigns or migrating email providers. - Security audits for SPF, DMARC, and DKIM configuration across client domains. - Compliance checks for email authentication standards. - Onboarding checks when adding a new domain to an email infrastructure. - Scheduled monitoring for email authentication drift or misconfiguration. ### Input | Field | Type | Required | Description | | --- | --- | --- | --- | | `startUrl` | string | Yes | Public domain or URL to audit. The actor extracts the hostname and checks DNS TXT records for SPF, DMARC, and DKIM. HTTP and HTTPS only. Private IP ranges are blocked. | | `dkimSelectors` | array | No | Optional list of DKIM selectors to check. If empty, the actor checks common selectors: google, selector1, selector2, default, s1, s2, k1. | | `timeoutSeconds` | integer | No | Timeout for each DNS TXT lookup. Default: `10`, range: `3` to `30`. | ### Output Each run pushes one dataset item. | Field | Type | Description | | --- | --- | --- | | `inputUrl` | string | Original input URL or domain. | | `domain` | string | Extracted domain name used for DNS lookups. | | `checkedAt` | string | ISO timestamp for the audit. | | `spf` | object | SPF audit results (see below). | | `dmarc` | object | DMARC audit results (see below). | | `dkim` | object | DKIM audit results (see below). | | `score` | integer | Email authentication score from 0 to 100. | | `grade` | string | Letter grade from A to F. | | `issues` | array | Human-readable issues found. | | `recommendations` | array | Recommended fixes. | | `error` | string or null | Error message, if any. | #### SPF object | Field | Type | Description | | --- | --- | --- | | `found` | boolean | Whether an SPF record exists. | | `record` | string or null | The raw SPF TXT record. | | `allPolicy` | string or null | Enforcement policy: hardfail, softfail, neutral, pass, or none. | | `dnsLookups` | integer | Number of DNS-lookup mechanisms (top-level only). | | `lookupLimitExceeded` | boolean | True when DNS lookups exceed the SPF 10-lookup limit. | | `mechanisms` | array | Parsed SPF mechanisms. | | `issues` | array | SPF-specific issues. | #### DMARC object | Field | Type | Description | | --- | --- | --- | | `found` | boolean | Whether a DMARC record exists. | | `record` | string or null | The raw DMARC TXT record. | | `policy` | string or null | Enforcement policy: none, quarantine, or reject. | | `pct` | integer or null | Percentage of mail the policy applies to. | | `rua` | string or null | Aggregate report destination. | | `ruf` | string or null | Forensic report destination. | | `adkim` | string or null | DKIM alignment mode: s (strict) or r (relaxed). | | `aspf` | string or null | SPF alignment mode: s (strict) or r (relaxed). | | `sp` | string or null | Subdomain policy. | | `issues` | array | DMARC-specific issues. | #### DKIM object | Field | Type | Description | | --- | --- | --- | | `selectorsChecked` | array | DKIM selectors that were checked. | | `foundSelectors` | array | Selectors where a DKIM record was found. | | `records` | array | Found DKIM records with selector, record, and parsed fields. | | `issues` | array | DKIM-specific issues. | ### Example input ```json { "startUrl": "https://example.com", "dkimSelectors": [], "timeoutSeconds": 10 } ```` ### Example output ```json { "inputUrl": "https://example.com", "domain": "example.com", "checkedAt": "2026-07-13T00:00:00.000Z", "spf": { "found": true, "record": "v=spf1 include:_spf.google.com -all", "allPolicy": "hardfail", "dnsLookups": 1, "lookupLimitExceeded": false, "mechanisms": ["include:_spf.google.com", "-all"], "issues": [] }, "dmarc": { "found": true, "record": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s", "policy": "reject", "pct": 100, "rua": "mailto:dmarc@example.com", "ruf": null, "adkim": "s", "aspf": "s", "sp": null, "issues": [] }, "dkim": { "selectorsChecked": ["google", "selector1", "selector2", "default", "s1", "s2", "k1"], "foundSelectors": ["google"], "records": [ { "selector": "google", "record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A", "parsed": { "version": "DKIM1", "keyType": "rsa", "publicKey": "present", "hasPublicKey": true, "notes": null } } ], "issues": [] }, "score": 100, "grade": "A", "issues": [], "recommendations": [], "error": null } ``` ### Security - Accepts only public HTTP and HTTPS URLs or domains. - Rejects URL credentials. - Rejects localhost, private IPv4, private IPv6, link-local, and private DNS resolutions. - Performs DNS TXT record lookups only; does not fetch URLs or require login. - Does not collect credentials or private data. ### Pricing Suggested pay-per-event pricing: | Event | Price | | --- | ---: | | Actor start | `$0.005` | | Domain audited | `$0.01` | Typical one-domain run cost: about `$0.015` before Apify platform charges. Apify keeps its standard commission and the actor owner receives the remainder. ### FAQ #### Does this check DKIM for all possible selectors? No. It checks common selectors used by major email providers (google, selector1, selector2, default, s1, s2, k1). You can pass custom selectors via the `dkimSelectors` input to check specific ones. #### Does it count nested SPF DNS lookups? No. It counts top-level lookup mechanisms (include, a, mx, exists, redirect). Nested lookups within include chains are not expanded, so the actual lookup count may be higher than reported. #### Does it fetch the domain's website? No. It only performs DNS TXT record lookups for SPF, DMARC, and DKIM. The URL input is used to extract the domain name safely. #### What is the scoring based on? The score starts at 100 and is reduced for missing or weak SPF enforcement, missing or lenient DMARC policy, missing DKIM records, and missing aggregate report destinations. #### Kill or keep metric Keep this actor if it gets organic Store impressions, runs, revenue, or inbound questions within 60 to 90 days. Improve the listing or pricing if impressions arrive without runs. Archive it if there is no discovery or usage. # Actor input Schema ## `startUrl` (type: `string`): Public domain or URL to audit. The actor extracts the hostname and checks DNS TXT records for SPF, DMARC, and DKIM. HTTP and HTTPS only. Private IP ranges are blocked. ## `dkimSelectors` (type: `array`): Optional list of DKIM selectors to check. If empty, the actor checks common selectors: google, selector1, selector2, default, s1, s2, k1. ## `timeoutSeconds` (type: `integer`): Timeout for each DNS TXT lookup. ## Actor input object example ```json { "startUrl": "https://example.com", "dkimSelectors": [], "timeoutSeconds": 10 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "startUrl": "https://example.com", "dkimSelectors": [] }; // Run the Actor and wait for it to finish const run = await client.actor("phoenix2810/email-auth-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "startUrl": "https://example.com", "dkimSelectors": [], } # Run the Actor and wait for it to finish run = client.actor("phoenix2810/email-auth-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "startUrl": "https://example.com", "dkimSelectors": [] }' | apify call phoenix2810/email-auth-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=phoenix2810/email-auth-auditor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Email Authentication Auditor", "description": "Audit a domain's SPF, DMARC, and DKIM email authentication DNS records for deliverability and security readiness.", "version": "0.1", "x-build-id": "d0JJ3omEsIcemczZ0" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/phoenix2810~email-auth-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-phoenix2810-email-auth-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/phoenix2810~email-auth-auditor/runs": { "post": { "operationId": "runs-sync-phoenix2810-email-auth-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/phoenix2810~email-auth-auditor/run-sync": { "post": { "operationId": "run-sync-phoenix2810-email-auth-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "startUrl" ], "properties": { "startUrl": { "title": "Domain or website URL", "type": "string", "description": "Public domain or URL to audit. The actor extracts the hostname and checks DNS TXT records for SPF, DMARC, and DKIM. HTTP and HTTPS only. Private IP ranges are blocked." }, "dkimSelectors": { "title": "DKIM selectors to check", "type": "array", "description": "Optional list of DKIM selectors to check. If empty, the actor checks common selectors: google, selector1, selector2, default, s1, s2, k1.", "items": { "type": "string" } }, "timeoutSeconds": { "title": "DNS query timeout (seconds)", "minimum": 3, "maximum": 30, "type": "integer", "description": "Timeout for each DNS TXT lookup.", "default": 10 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```