# Email DNS Security Auditor (SPF, DKIM, DMARC, MTA-STS) (`plotbench/email-dns-security-auditor`) Actor Audit email-security DNS for any list of domains: SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT and BIMI. Deterministic scoring, actionable findings, no API keys. - **URL**: https://apify.com/plotbench/email-dns-security-auditor.md - **Developed by:** [Plotbench Studio](https://apify.com/plotbench) (community) - **Categories:** Developer tools, SEO tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $10.00 / 1,000 domain auditeds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Email DNS Security Auditor (SPF, DKIM, DMARC, MTA-STS) Audit the email-security DNS posture of **any list of domains** in one run: MX, SPF, DKIM (selector probing with wildcard-zone detection), DMARC, DNSSEC, MTA-STS (record + live policy fetch), TLS-RPT and BIMI — with a deterministic **0–100 score, A–F grade, and actionable findings** for every domain. Built for the people who audit domains in bulk: - **MSPs and IT agencies** — audit every client domain weekly; catch the DMARC record someone deleted before spoofed invoices go out. - **Deliverability consultants** — a client-ready evidence table in minutes, not an afternoon of `dig`. - **Security / compliance teams** — track your whole domain estate (including forgotten marketing domains, which are exactly the ones that get spoofed). - **Domain portfolio owners** — parked domains without a restrictive SPF/DMARC are spoofing targets; find them. ### Why this auditor (honest differentiators) - **No API keys, no accounts, no scraping.** Everything is answered over public DNS via DNS-over-HTTPS (Cloudflare primary, Google automatic fallback). - **Wildcard-zone detection.** Many tools "find" DKIM keys on zones that answer every TXT query (wildcards). This actor probes a canary selector first and reports `DKIM_WILDCARD_ZONE` instead of lying to you — verified live against gov.uk, which wildcards TXT. - **Deterministic.** Same DNS state in, same score out. No AI, no sampling, no flakiness. Safe to schedule and diff week-on-week. - **Findings, not just data.** Every issue comes with severity, a stable machine-readable code (e.g. `SPF_LOOKUP_LIMIT`, `DMARC_P_NONE`) and a concrete recommendation. ### What it checks | Check | Detail | |---|---| | MX | Records, priorities, null-MX (RFC 7505) detection | | SPF | Presence, multiple-record permerror, `all` policy strength, 10-DNS-lookup limit | | DMARC | Presence, `p=`/`sp=` policy, `pct`, `rua` reporting, alignment modes | | DKIM | 15 common selectors probed (configurable), wildcard-zone canary | | DNSSEC | Validation status (AD flag from a validating resolver) | | MTA-STS | DNS record **and** live policy file fetch + mode | | TLS-RPT | `_smtp._tls` reporting record | | BIMI | `default._bimi` record | ### Input (all optional except domains) ```json { "domains": ["yourdomain.com", "client-domain.co.uk"], "dkimSelectors": ["default", "google", "selector1", "selector2"], "resolver": "cloudflare" } ```` ### Output (one dataset row per domain) ```json { "domain": "microsoft.com", "score": 88, "grade": "B", "checks": { "mx": {}, "spf": {}, "dmarc": {}, "dkim": { "foundSelectors": ["selector2"] }, "dnssec": {}, "mtaSts": {}, "tlsRpt": {}, "bimi": {} }, "findings": [ { "severity": "info", "code": "DNSSEC_OFF", "message": "Zone is not DNSSEC-validated.", "recommendation": "Consider enabling DNSSEC at your registrar/DNS host." } ] } ``` ### Pricing (pay per event) | Event | Price | |---|---| | Actor start | $0.02 per run | | Domain audited | $0.01 per domain | Auditing 50 client domains costs about **$0.52 per run** — schedule it weekly and diff the scores. ### Scheduling & integrations Run it on an Apify **Schedule** (e.g. every Monday 07:00), then use Apify integrations to send the dataset to Slack, email, Google Sheets, Make or Zapier. Alert on any domain whose score drops. ### Fair use & data sources All lookups are standard DNS queries over public resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8) — public data, published by the domain owners themselves precisely so that other mail servers read it. The optional MTA-STS policy fetch reads the standard well-known URL defined by RFC 8461. No websites are scraped, no rate limits are strained, no personal data is processed. ### Limitations (told straight) - DKIM selector probing can only find selectors you probe; a custom selector not in your list won't be found. Absence of DKIM findings is reported as "not found at probed selectors", never "domain has no DKIM". - On wildcard TXT zones, DKIM probing is inconclusive and flagged as such. - Scores are a posture heuristic, not a deliverability guarantee. # Actor input Schema ## `domains` (type: `array`): List of domains to audit (bare domains, e.g. example.com — no scheme or path). ## `dkimSelectors` (type: `array`): Common DKIM selector names to probe at .\_domainkey.. Add your provider's selector if you know it. ## `resolver` (type: `string`): Primary resolver; the other one is used automatically as fallback. ## Actor input object example ```json { "domains": [ "gov.uk", "example.com" ], "dkimSelectors": [ "default", "google", "selector1", "selector2", "k1", "k2", "mail", "s1", "s2", "dkim", "mx", "zoho", "pm", "mandrill", "fm1" ], "resolver": "cloudflare" } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "gov.uk", "example.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("plotbench/email-dns-security-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "gov.uk", "example.com", ] } # Run the Actor and wait for it to finish run = client.actor("plotbench/email-dns-security-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "gov.uk", "example.com" ] }' | apify call plotbench/email-dns-security-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=plotbench/email-dns-security-auditor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Email DNS Security Auditor (SPF, DKIM, DMARC, MTA-STS)", "description": "Audit email-security DNS for any list of domains: SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT and BIMI. Deterministic scoring, actionable findings, no API keys.", "version": "1.0", "x-build-id": "uvjLJnvgwb6R6ggf9" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/plotbench~email-dns-security-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-plotbench-email-dns-security-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/plotbench~email-dns-security-auditor/runs": { "post": { "operationId": "runs-sync-plotbench-email-dns-security-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/plotbench~email-dns-security-auditor/run-sync": { "post": { "operationId": "run-sync-plotbench-email-dns-security-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Domains to audit", "type": "array", "description": "List of domains to audit (bare domains, e.g. example.com — no scheme or path).", "items": { "type": "string" } }, "dkimSelectors": { "title": "DKIM selectors to probe", "type": "array", "description": "Common DKIM selector names to probe at ._domainkey.. Add your provider's selector if you know it.", "default": [ "default", "google", "selector1", "selector2", "k1", "k2", "mail", "s1", "s2", "dkim", "mx", "zoho", "pm", "mandrill", "fm1" ], "items": { "type": "string" } }, "resolver": { "title": "Primary DNS-over-HTTPS resolver", "enum": [ "cloudflare", "google" ], "type": "string", "description": "Primary resolver; the other one is used automatically as fallback.", "default": "cloudflare" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```