DNS & Email Security Audit: SPF, DMARC, DKIM, DNSSEC Grade

Grade any domain A-F on DNS and email security: SPF (all mechanism, lookup count), DMARC policy and reporting, DKIM on common selectors, CAA, DNSSEC, MTA-STS, TLS-RPT, BIMI, mail provider and nameservers, with a clear issue list. Bulk, via DNS-over-HTTPS.

Data source: public DNS records, queried through DNS-over-HTTPS resolvers (Cloudflare 1.1.1.1 with Google Public DNS as fallback); no traffic is sent to the audited domains. It needs no login, proxy or browser. Results are returned as clean, flat JSON that is ready for spreadsheets, databases, BI tools and AI agents.

What can you use it for?

• MSP/MSSP and IT-agency prospecting: find domains with weak email security
• Vendor and supplier security checks
• Monitor your own domains for SPF/DMARC drift
• Deliverability audits before cold-email campaigns
• Use it as a tool from AI agents through the Apify MCP server, or schedule it and send new results to Slack, Google Sheets or a webhook

Input

Field	Name	Description
domains	Domains	Domains, URLs or email addresses
checkDkim	Check DKIM selectors	Probe common DKIM selectors (20 extra DNS queries per domain)
dkimSelectors	Custom DKIM selectors	Override the list of selectors to probe
concurrency	Concurrency	Domains in parallel

Example input

{
  "domains": [
    "google.com",
    "apify.com",
    "cloudflare.com",
    "example.com"
  ]
}

Output

Each result is one dataset item with these fields: domain, input, resolves, grade, score, issueCount, issues, hasMx, nullMx, mx, mailProvider, spf, spfAll, spfLookupCount, spfRecordCount, dmarc, dmarcPolicy, dmarcSubdomainPolicy, dmarcRua, dmarcPct, dkimSelectorsFound, caa, dnssec, dnssecValidated, mtaSts, tlsRpt, bimi, nameservers, txtRecordCount, verifications, checkedAt.

Example output (real result, long fields shortened)

{
  "domain": "google.com",
  "input": "google.com",
  "resolves": true,
  "grade": "B",
  "score": 88,
  "issueCount": 2,
  "issues": [
    "No DKIM key found on common selectors",
    "DNSSEC not enabled (no DS record)"
  ],
  "hasMx": true,
  "nullMx": false,
  "mx": [
    "smtp.google.com"
  ],
  "mailProvider": "Google Workspace",
  "spf": "v=spf1 include:_spf.google.com ~all",
  "spfAll": "~all",
  "spfLookupCount": 1,
  "spfRecordCount": 1,
  "dmarc": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
  "dmarcPolicy": "reject",
  "dmarcSubdomainPolicy": null,
  "dmarcRua": "mailto:mailauth-reports@google.com",
  "dmarcPct": null,
  "dkimSelectorsFound": [],
  "caa": [
    "0 issue \"pki.goog\""
  ],
  "dnssec": false,
  "dnssecValidated": false,
  "mtaSts": "v=STSv1; id=20210803T010101;",
  "tlsRpt": "v=TLSRPTv1;rua=mailto:sts-reports@google.com",
  "bimi": null,
  "nameservers": [
    "ns3.google.com",
    "ns4.google.com",
    "ns2.google.com",
    "ns1.google.com"
  ],
  "txtRecordCount": 17,
  "verifications": [
    "google-site-verification",
    "google-site-verification",
    "google-site-verification",
    "arcules-domain-verification",
    "..."
  ],
  "checkedAt": "2026-11-02T17:38:19.800Z"
}

Download the results as JSON, CSV, Excel or XML, or read them through the Apify API.

Pricing

This Actor uses pay-per-event pricing. You pay $0.002 per domain returned, plus standard Apify platform usage, which is small because the Actor uses lightweight HTTP requests (no browser). You are never charged for results that are not returned. To cap spending, set a maximum cost per run in the run options.

Tips

• Start with a small max-results value to check your filters, then scale up.
• Schedule the Actor (for example daily) to monitor changes over time.
• The data comes straight from the source, so its freshness and completeness depend on that publisher.

Disclaimer

This Actor is not affiliated with or endorsed by any website, platform or data publisher named here. Use it in line with the target sites' terms and applicable privacy laws (e.g. GDPR/CAN-SPAM for contact data). Verify critical decisions against the official source.