Email Authentication & Deliverability Security Monitor

Monitor SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT and BIMI across domains, detect authentication drift, regressions and deliverability risks.

Why use this Actor

Email security and deliverability teams need continuous detection of authentication-policy drift and regressions that can weaken anti-spoofing controls or disrupt legitimate delivery.

Key features

• Buyer-native inputs aligned to email authentication.
• Predictable structured output in the default Apify Dataset.
• Pay Per Event pricing tied to measurable result rows or reports.
• Optional MCP connector delivery for downstream automation and AI agents.

Quick start

Start with this working example and replace the target values with your own:

{
  "domains": [
    "example.com",
    "google.com"
  ]
}

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

Input

• domains — Domains: Public domains to audit.
• dkimSelectors — DKIM selectors: Optional selectors to probe.
• previousSnapshots — Previous authentication snapshots: Prior snapshots keyed by domain for drift detection.
• failRunOnRegression — Fail on security regression: Configure Fail on security regression for this Actor run.
• maxDomains — Maximum domains: Configure Maximum domains for this Actor run.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

Output

The Dataset exposes predictable machine-readable output. Representative fields include dataset.

Pricing

This Actor uses Pay Per Event. The current factory base price is $0.001200 per result event. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

Use cases

• Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
• Use the Actor from API or schedules for recurring collection, comparison or monitoring.
• Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
• Compare repeat runs when the product supports snapshots or previous-run inputs.

Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

Limitations

• Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
• Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
• Analytical outputs depend on the quality and coverage of the supplied or collected source data.
• Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

Detailed documentation

Detailed documentation

Detailed documentation

Audit public email-authentication and transport-policy DNS with repeatable posture and regression evidence.

Why use this Actor

Email security is not one DNS record. A domain can publish SPF while leaving DMARC in monitoring mode, route mail correctly while missing transport-policy signals, or silently change authentication records during a provider migration. This Actor combines the public DNS evidence most useful to security, deliverability, domain-portfolio, and migration workflows into one normalized record per domain. It is designed for recurring monitoring as well as one-time audits.

Key features

• Detects SPF records and flags missing or multiple SPF policies.
• Reads DMARC, classifies p= policy, and evaluates partial enforcement through pct=.
• Collects MX hosts and priorities.
• Probes caller-supplied DKIM selectors without guessing private selector names.
• Checks public MTA-STS, TLS-RPT, and BIMI TXT signals.
• Produces a deterministic posture score and explicit issue codes.
• Emits a normalized authentication snapshot and fingerprint.
• Compares prior snapshots and flags authentication regressions across runs.
• Supports fail-after-evidence behavior for automated regression gates.

Input

Provide a domains array. Optional dkimSelectors controls which public DKIM names are probed. previousSnapshots enables change detection, while failRunOnRegression can be used in CI or monitoring pipelines. maxDomains limits batch size.

Output

Each domain returns SPF presence and raw evidence, DMARC policy and percentage, MX inventory, DKIM selector matches, MTA-STS, TLS-RPT, BIMI, posture score, fingerprint, changed fields, regression state, issue codes, and an agentAction indicating the next operational step.

Example

{
  "domains": ["example.com", "google.com"],
  "dkimSelectors": ["default", "selector1"],
  "previousSnapshots": {},
  "failRunOnRegression": false
}

Use cases

• DMARC rollout and enforcement projects.
• Deliverability operations.
• Domain portfolio monitoring.
• Mail-provider migration validation.
• Vendor and acquisition due diligence.
• MSP or agency client audits.

Pricing

Billing is pay per audited domain result. The Actor uses public DNS directly and does not require a paid deliverability API or mailbox access.

Limitations

DKIM requires selectors supplied by the user; absence on tested selectors does not prove a domain has no DKIM. The Actor does not send email, verify mailbox existence, test SMTP reputation, or guarantee deliverability. DNS values can temporarily differ during propagation.

Privacy and permissions

Only public DNS is queried. No mailbox credentials, messages, contact lists, or private authentication material are accessed.