🛡️ Email Deliverability Checker — SPF, DMARC, DKIM & MX in Bulk

Runs live DNS + HTTP checks on any list of domains and returns each one's full email-security posture — MX + provider, SPF, DMARC + policy, DKIM, domain age (RDAP), HTTPS — rolled into a 0–100 emailSecurityScore and a deliverabilityRisk verdict (low/medium/high). For cold-email senders scoring prospect lists and anyone auditing domain posture at scale. Pricing: $0.02 per domain enriched. No API key, no WHOIS account.

🎥 Video walkthrough

The scoring rubric, up front

emailSecurityScore (0–100): MX +20 · SPF +25 · DKIM +20 · DMARC present +20 · DMARC enforcement bonus (quarantine +8, reject +15). A domain doing everything right scores 100.

deliverabilityRisk:

Verdict	Condition	What it means for you
high	No MX, or no SPF and no DMARC	Spam-trap / parked-domain shape. Don't cold-email this near your good domains.
medium	Partial auth, or DMARC stuck at p=none	Real but sloppy mail setup. Send with care.
low	MX + SPF + DMARC enforcing (quarantine/reject)	Serious, well-run mail infrastructure. Safe target, sophisticated buyer.

The twist most tools miss: deliverability checkers are usually pointed at your own domain. This one is built to score prospect domains in bulk — because blasting unauthenticated, spam-trap-shaped domains is what tanks your sender reputation for everyone else on the list.

Bulk SPF, DMARC and MX checker: every field explained

Field	Check behind it
hasMx / mxProvider	Live DNS MX lookup, classified (Google Workspace, Microsoft 365, Zoho, Proofpoint, Amazon SES…)
hasSpf	TXT lookup for v=spf1
hasDmarc / dmarcPolicy	TXT at _dmarc.<domain>, with the p= policy extracted
hasDkim	Best-effort probe of common selectors (google, default, selector1/2, k1, s1…) — a hit proves DKIM; a miss is inconclusive and not over-penalized
domainAgeYears / registrar	RDAP (modern JSON successor to WHOIS) — brand-new domains are risk signals
hasWebsite / httpsValid	Short HTTP(S) GET following redirects — live site on valid TLS = operating business

In and out

{
  "domains": ["stripe.com", "gmail.com", "notion.so", "some-parked-domain.xyz"],
  "maxConcurrency": 5
}

URLs and emails are fine too — https://stripe.com/pricing and john@stripe.com both normalize to stripe.com.

{
  "domain": "stripe.com",
  "hasMx": true,
  "mxProvider": "Google Workspace",
  "hasSpf": true,
  "hasDmarc": true,
  "dmarcPolicy": "reject",
  "hasDkim": true,
  "domainAgeYears": 15.6,
  "registrar": "MarkMonitor Inc.",
  "hasWebsite": true,
  "httpsValid": true,
  "emailSecurityScore": 100,
  "deliverabilityRisk": "low"
}

Dataset exports to JSON, CSV, Excel or API — straight into your CRM or sequencing tool.

Four ways teams use the score

1. Pre-send list hygiene — drop deliverabilityRisk: "high" rows before importing into your cold-email tool; protect the sender reputation you spent months warming.
2. Lead prioritization by tech maturity — Microsoft 365 + p=reject is a different buyer than a fresh domain on shared hosting with zero auth. Sort by emailSecurityScore and route accordingly.
3. Purchased/inbound list triage — parked, dead and newly-registered domains surface immediately via hasWebsite, httpsValid, domainAgeYears.
4. Partner/competitor recon — profile the email posture of any set of companies in one run.

FAQ

How do I check SPF and DMARC records for a list of domains at once? Paste the list into domains and run — each domain gets live TXT lookups for v=spf1 and _dmarc, plus MX, DKIM, RDAP and HTTPS checks, in one dataset row. No per-domain manual dig commands.

Is this for checking my own domain or my prospects' domains? Both work, but the design center is prospects in bulk: the risk verdict tells you which domains are unsafe to send to, a check most deliverability tools skip entirely.

Why does hasDkim show false for a domain I know signs mail? DKIM selectors are arbitrary and can't be enumerated from DNS. Common selectors are probed; a hit is proof, a miss is inconclusive — which is why a DKIM miss barely dents the score.

Why RDAP instead of WHOIS? RDAP is the structured, rate-friendly JSON replacement and far more reliable from cloud IPs. Registries that don't expose a registration date (some ccTLDs) yield domainAgeYears: null; the rest of the record still completes.

Does it probe SMTP port 25? No — cloud IPs are blocked/greylisted there and catch-alls poison results. The honest, reliable layer is DNS + HTTP, which is what runs here.

What does 1,000 domains cost and how long does it take? $20 ($0.02 each, billed per enriched record; ACTOR_MAX_TOTAL_CHARGE_USD respected). Checks run in parallel per-domain and across domains — a few hundred domains finish in minutes.

What do I run after this on the good domains? The Bulk Email Verifier on the individual addresses (syntax, MX, disposable, role) — domain posture first, mailbox quality second. Company Enrichment adds firmographics and tech stack.

Can it run on a schedule? Yes — Apify Schedules for a weekly re-score of your CRM's active domains, with output piped to Sheets, Make, Zapier, n8n or a webhook.