Email DNS Security Auditor (SPF, DKIM, DMARC, MTA-STS)

Audit the email-security DNS posture of any list of domains in one run: MX, SPF, DKIM (selector probing with wildcard-zone detection), DMARC, DNSSEC, MTA-STS (record + live policy fetch), TLS-RPT and BIMI — with a deterministic 0–100 score, A–F grade, and actionable findings for every domain.

Built for the people who audit domains in bulk:

• MSPs and IT agencies — audit every client domain weekly; catch the DMARC record someone deleted before spoofed invoices go out.
• Deliverability consultants — a client-ready evidence table in minutes, not an afternoon of dig.
• Security / compliance teams — track your whole domain estate (including forgotten marketing domains, which are exactly the ones that get spoofed).
• Domain portfolio owners — parked domains without a restrictive SPF/DMARC are spoofing targets; find them.

Why this auditor (honest differentiators)

• No API keys, no accounts, no scraping. Everything is answered over public DNS via DNS-over-HTTPS (Cloudflare primary, Google automatic fallback).
• Wildcard-zone detection. Many tools "find" DKIM keys on zones that answer every TXT query (wildcards). This actor probes a canary selector first and reports DKIM_WILDCARD_ZONE instead of lying to you — verified live against gov.uk, which wildcards TXT.
• Deterministic. Same DNS state in, same score out. No AI, no sampling, no flakiness. Safe to schedule and diff week-on-week.
• Findings, not just data. Every issue comes with severity, a stable machine-readable code (e.g. SPF_LOOKUP_LIMIT, DMARC_P_NONE) and a concrete recommendation.

What it checks

Check	Detail
MX	Records, priorities, null-MX (RFC 7505) detection
SPF	Presence, multiple-record permerror, all policy strength, 10-DNS-lookup limit
DMARC	Presence, p=/sp= policy, pct, rua reporting, alignment modes
DKIM	15 common selectors probed (configurable), wildcard-zone canary
DNSSEC	Validation status (AD flag from a validating resolver)
MTA-STS	DNS record and live policy file fetch + mode
TLS-RPT	_smtp._tls reporting record
BIMI	default._bimi record

Input (all optional except domains)

{
    "domains": ["yourdomain.com", "client-domain.co.uk"],
    "dkimSelectors": ["default", "google", "selector1", "selector2"],
    "resolver": "cloudflare"
}

Output (one dataset row per domain)

{
    "domain": "microsoft.com",
    "score": 88,
    "grade": "B",
    "checks": { "mx": {}, "spf": {}, "dmarc": {}, "dkim": { "foundSelectors": ["selector2"] }, "dnssec": {}, "mtaSts": {}, "tlsRpt": {}, "bimi": {} },
    "findings": [ { "severity": "info", "code": "DNSSEC_OFF", "message": "Zone is not DNSSEC-validated.", "recommendation": "Consider enabling DNSSEC at your registrar/DNS host." } ]
}

Pricing (pay per event)

Event	Price
Actor start	$0.02 per run
Domain audited	$0.01 per domain

Auditing 50 client domains costs about $0.52 per run — schedule it weekly and diff the scores.

Scheduling & integrations

Run it on an Apify Schedule (e.g. every Monday 07:00), then use Apify integrations to send the dataset to Slack, email, Google Sheets, Make or Zapier. Alert on any domain whose score drops.

Fair use & data sources

All lookups are standard DNS queries over public resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8) — public data, published by the domain owners themselves precisely so that other mail servers read it. The optional MTA-STS policy fetch reads the standard well-known URL defined by RFC 8461. No websites are scraped, no rate limits are strained, no personal data is processed.

Limitations (told straight)

• DKIM selector probing can only find selectors you probe; a custom selector not in your list won't be found. Absence of DKIM findings is reported as "not found at probed selectors", never "domain has no DKIM".
• On wildcard TXT zones, DKIM probing is inconclusive and flagged as such.
• Scores are a posture heuristic, not a deliverability guarantee.