Email Security Checker - SPF, DMARC, DKIM, MTA-STS

Audit the email security of hundreds of domains in one run: SPF (with the 10-lookup limit), DMARC policy, DKIM selectors, MTA-STS, TLS-RPT, BIMI and mail provider. Each domain gets an A-F grade with the exact issues to fix.

• Real SPF check. Includes and redirects are followed recursively to count DNS lookups. Above 10, SPF fails with a permerror that most checkers miss (counting stops there: spfLookups shows 11). Multiple SPF records and +all are flagged.
• DMARC that matters. You get the policy (none, quarantine, reject), the subdomain policy, pct and whether reports are sent. Report addresses are masked (***@domain), so the output holds no personal data.
• DKIM discovery. 21 common selectors are probed (Google, Microsoft 365, Mailchimp, SendGrid, Postmark, Zoho, Proton, Fastmail...), and you can add your own.
• Plain-language issues. For example: "DMARC policy is p=none: spoofed e-mails are still delivered."
• Safe by design. Only public DNS records are read: no mailbox is contacted and no e-mail is sent. $2 per 1,000 domains.

What can I use it for?

• Deliverability audits for your domains, or for your clients' domains if you run an agency.
• Security due diligence: find suppliers or acquisitions that can be spoofed (no DMARC, p=none, broken SPF).
• Lead qualification for email and security services: a domain with grade D or F needs help.
• Monitoring: schedule a weekly run and alert when a grade drops.

Input

{
    "domains": ["apify.com", "https://www.github.com", "contact@example.org"],
    "extraDkimSelectors": ["mycompany2024"]
}

E-mail addresses are accepted, but only their domain is used and returned.

Output

One row per domain. Example from a real run:

{
    "domain": "github.com",
    "mx": [{ "priority": 0, "exchange": "github-com.mail.protection.outlook.com" }],
    "mailProvider": "Microsoft 365",
    "spf": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com ... ~all",
    "spfMultipleRecords": false,
    "spfAll": "~all",
    "spfLookups": 10,
    "spfErrors": [],
    "dmarc": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:***@github.com; ruf=mailto:***@github.com; fo=1",
    "dmarcPolicy": "quarantine",
    "dmarcSubdomainPolicy": "reject",
    "dmarcPct": 100,
    "dmarcReports": true,
    "dkimSelectorsFound": ["google", "selector1", "k1", "k2", "s1", "s2"],
    "mtaSts": false,
    "tlsRpt": false,
    "bimi": false,
    "score": 95,
    "grade": "A",
    "issues": [
        "No MTA-STS: TLS is not enforced for incoming mail.",
        "No TLS-RPT: no reports about TLS delivery problems."
    ],
    "error": null,
    "checkedAt": "2026-10-12T12:13:56.505Z"
}

Grading: the score starts at 100 and loses points for each problem:

Problem	Points lost
No SPF	25
SPF with +all	25
SPF over 10 lookups	15
No DMARC	30
DMARC with p=none	15
No DKIM on common selectors	10
No MTA-STS / no TLS-RPT	3 / 2

The grade is A from 90 points, B from 75, C from 60 and D from 40.

Pricing

$0.002 per domain checked ($2 per 1,000 domains), plus Apify's small run-start fee. Invalid inputs and DNS errors are free.

Use it from AI agents (MCP)

Add email-security-checker to the Apify MCP server in your MCP client (Claude, Cursor, VS Code...).

Integrations

Apify API, schedules, webhooks, Make, Zapier, n8n. Export as JSON, CSV, Excel or HTML.

Related tools

Same developer, same pay-per-result pricing, outputs that chain together:

• Bulk WHOIS Lookup: registrar, creation and expiry dates, DNS and mail provider of domain lists.
• SSL Certificate Checker: SSL certificate expiry, issuer and chain of many hosts.
• Security Headers Checker: HSTS, CSP and other security headers, graded A+ to F.

FAQ

No DKIM found, but I'm sure the domain signs its e-mails. DKIM keys live under a selector chosen by the sender, and selectors cannot be listed. Add yours in extraDkimSelectors.

Need registrar, expiry and SSL data too? Use WHOIS & DNS Domain Lookup.

Something wrong or missing? Open an issue on the Issues tab.