Email Deliverability & DNS Security Auditor (SPF, DKIM, DMARC, MTA-STS)

Audit the email deliverability and DNS security posture of any list of domains in one run: MX, SPF, DKIM (selector probing with wildcard-zone detection), DMARC, DNSSEC, MTA-STS (record + live policy fetch), TLS-RPT and BIMI — with a deterministic 0–100 score, A–F grade, and actionable findings for every domain. If mail is landing in spam, this is the audit that finds the DNS causes.

Built for the people who audit domains in bulk:

• MSPs and IT agencies — audit every client domain weekly; catch the DMARC record someone deleted before spoofed invoices go out.
• Deliverability consultants — a client-ready evidence table in minutes, not an afternoon of dig.
• Security / compliance teams — track your whole domain estate (including forgotten marketing domains, which are exactly the ones that get spoofed).
• Domain portfolio owners — parked domains without a restrictive SPF/DMARC are spoofing targets; find them.

Why this auditor (honest differentiators)

• No API keys, no accounts, no scraping. Everything is answered over public DNS via DNS-over-HTTPS (Cloudflare primary, Google automatic fallback).
• Wildcard-zone detection. Many tools "find" DKIM keys on zones that answer every TXT query (wildcards). This actor probes a canary selector first and reports DKIM_WILDCARD_ZONE instead of lying to you — verified live against gov.uk, which wildcards TXT.
• Deterministic. Same DNS state in, same score out. No AI, no sampling, no flakiness. Safe to schedule and diff week-on-week.
• Findings, not just data. Every issue comes with severity, a stable machine-readable code (e.g. SPF_LOOKUP_LIMIT, DMARC_P_NONE) and a concrete recommendation.

What it checks

Check	Detail
MX	Records, priorities, null-MX (RFC 7505) detection
SPF	Presence, multiple-record permerror, all policy strength, 10-DNS-lookup limit
DMARC	Presence, p=/sp= policy, pct, rua reporting, alignment modes
DKIM	15 common selectors probed (configurable), wildcard-zone canary
DNSSEC	Validation status (AD flag from a validating resolver)
MTA-STS	DNS record and live policy file fetch + mode
TLS-RPT	_smtp._tls reporting record
BIMI	default._bimi record

Input (all optional except domains)

{
    "domains": ["yourdomain.com", "client-domain.co.uk"],
    "dkimSelectors": ["default", "google", "selector1", "selector2"],
    "resolver": "cloudflare"
}

Output (one dataset row per domain)

{
    "domain": "microsoft.com",
    "score": 88,
    "grade": "B",
    "checks": { "mx": {}, "spf": {}, "dmarc": {}, "dkim": { "foundSelectors": ["selector2"] }, "dnssec": {}, "mtaSts": {}, "tlsRpt": {}, "bimi": {} },
    "findings": [ { "severity": "info", "code": "DNSSEC_OFF", "message": "Zone is not DNSSEC-validated.", "recommendation": "Consider enabling DNSSEC at your registrar/DNS host." } ]
}

Pricing (pay per event)

Event	Price
Actor start	$0.02 per run
Domain audited	$0.01 per domain

Auditing 50 client domains costs about $0.52 per run — schedule it weekly and diff the scores.

Scheduling & integrations

Run it on an Apify Schedule (e.g. every Monday 07:00), then use Apify integrations to send the dataset to Slack, email, Google Sheets, Make or Zapier. Alert on any domain whose score drops.

Fair use & data sources

All lookups are standard DNS queries over public resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8) — public data, published by the domain owners themselves precisely so that other mail servers read it. The optional MTA-STS policy fetch reads the standard well-known URL defined by RFC 8461. No websites are scraped, no rate limits are strained, no personal data is processed.

Limitations (told straight)

• DKIM selector probing can only find selectors you probe; a custom selector not in your list won't be found. Absence of DKIM findings is reported as "not found at probed selectors", never "domain has no DKIM".
• On wildcard TXT zones, DKIM probing is inconclusive and flagged as such.
• Scores are a posture heuristic, not a deliverability guarantee.