# 🛡️ Domain & Email Deliverability Enricher (SPF/DMARC) (`renzomacar/domain-health-enricher`) Actor

Enrich domains in bulk with email deliverability signals: MX + provider, SPF, DMARC + policy, DKIM, domain age (RDAP), HTTPS, plus a 0-100 email-security score and deliverability risk. Score prospects before cold outreach. No API key.

- **URL**: https://apify.com/renzomacar/domain-health-enricher.md
- **Developed by:** [Renzo Madueno](https://apify.com/renzomacar) (community)
- **Categories:** Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$20.00 / 1,000 domain enricheds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

## 🛡️ Domain & Email Deliverability Enricher (SPF / DMARC)

### 🎥 Video walkthrough

https://youtu.be/y4CAhYcyz6M


**Turn a plain list of domains into a scored, B2B-ready enrichment table — no API key, no WHOIS account, no scraping.** For each domain this actor runs live DNS + HTTP checks and returns whether the domain's email is real, modern and *safe to cold-email*, plus a domain-age and website signal you can use to score prospects by how sophisticated their infrastructure is.

Give it `["stripe.com", "gmail.com", "notion.so"]` and get back one clean record per domain:

```json
{
  "domain": "stripe.com",
  "hasMx": true,
  "mxProvider": "Google Workspace",
  "hasSpf": true,
  "hasDmarc": true,
  "dmarcPolicy": "reject",
  "hasDkim": true,
  "domainAgeYears": 15.6,
  "registrar": "MarkMonitor Inc.",
  "hasWebsite": true,
  "httpsValid": true,
  "emailSecurityScore": 100,
  "deliverabilityRisk": "low",
  "checkedAt": "2026-07-03T12:00:00.000Z"
}
````

***

### Why domain & email health matters (before you send a single cold email)

Cold outreach lives and dies on **domain reputation**, and most senders check the *inbox* while ignoring the *domain behind it*. That's backwards. Before you email a list, you want to know two things about each prospect's domain:

1. **Is it safe to send to?** A domain with **no SPF and no DMARC** is either a poorly-run mailbox or, worse, a **spam trap / parked domain** shape. Blasting those tanks your sender reputation and drives you into spam folders for *everyone* on the list. Filtering high-risk domains out first protects your deliverability.
2. **How sophisticated is this prospect?** A domain running **Google Workspace or Microsoft 365 with SPF + DKIM + DMARC `p=reject`** is a company that takes its email infrastructure seriously — a strong *tech-maturity signal* for qualifying and prioritizing B2B leads. A brand-new domain on shared hosting with no auth is a very different lead.

This actor answers both, at bulk, per record — so you can clean a list, prioritize it, and send with confidence.

***

### What each check means

| Field | Check | Why it matters |
|---|---|---|
| `hasMx` / `mxProvider` | Live DNS **MX** lookup, classified to a provider (Google Workspace, Microsoft 365, Zoho, Proofpoint, Amazon SES…) | Proves the domain actually receives mail, and *who runs it* — a maturity signal. |
| `hasSpf` | **TXT** lookup for a `v=spf1` record | SPF authorizes who can send as the domain. Missing SPF = spoofable, spam-prone, risky to email near. |
| `hasDmarc` / `dmarcPolicy` | **TXT** at `_dmarc.<domain>` for `v=DMARC1`, plus the `p=` policy | DMARC ties SPF + DKIM together. `reject`/`quarantine` = a serious, enforcing sender; `none` = monitoring only. |
| `hasDkim` | Best-effort **TXT/CNAME** probe of common selectors (`google`, `default`, `selector1/2`, `k1`, `s1`…) | DKIM cryptographically signs outbound mail. Present = modern, well-configured mail. *(A miss is inconclusive — see FAQ.)* |
| `domainAgeYears` / `registrar` | **RDAP** lookup (`rdap.org`, the modern JSON successor to WHOIS) for the registration date and registrar | Age is a trust signal — brand-new domains are riskier and often disposable. Registrar adds context. |
| `hasWebsite` / `httpsValid` | Short **HTTP(S) GET** of the domain, following redirects | A live site on valid HTTPS = a real, operating business. No site or broken TLS = a red flag. |
| `emailSecurityScore` | 0–100, from MX + SPF + DKIM + DMARC presence and DMARC policy strength | One number to rank the auth sophistication of a domain. |
| `deliverabilityRisk` | `low` / `medium` / `high`, derived from the auth stack | The go/no-go signal: **`high` = don't cold-email this near your good domains.** |

#### How the score & risk are derived

- **`emailSecurityScore`** rewards the full stack: MX (+20), SPF (+25), DKIM (+20), DMARC present (+20) with a bonus for enforcement (`quarantine` +8, `reject` +15). A domain doing everything right scores **100**.
- **`deliverabilityRisk`**:
  - **high** — no MX at all, *or* no SPF **and** no DMARC (no auth stack → spam-trap shape, unsafe to send near).
  - **medium** — partial auth (SPF *or* DMARC missing), or both present but DMARC is only `p=none` (monitoring, not enforcing).
  - **low** — MX + SPF + DMARC with an enforcing policy (`quarantine`/`reject`).

***

### Example input

```json
{
  "domains": ["stripe.com", "gmail.com", "notion.so", "some-parked-domain.xyz"],
  "maxConcurrency": 5
}
```

URLs and emails are accepted too — `https://stripe.com/pricing` and `john@stripe.com` both reduce to `stripe.com` automatically.

### Example output (dataset)

| domain | risk | score | SPF | DMARC | policy | MX provider | age |
|---|---|---|---|---|---|---|---|
| stripe.com | low | 100 | ✓ | ✓ | reject | Google Workspace | 15.6 |
| gmail.com | low | 100 | ✓ | ✓ | reject | Google Workspace | 30+ |
| notion.so | low | 92 | ✓ | ✓ | quarantine | Google Workspace | 12.x |

Export the full dataset as **JSON, CSV, Excel, or via API** — drop it straight into your CRM, spreadsheet, or sequencing tool.

***

### Use cases

- **Score a lead list** — enrich thousands of prospect domains and sort by `emailSecurityScore` / `deliverabilityRisk` to prioritize the real, serious companies.
- **Avoid emailing risky domains** — filter out `deliverabilityRisk: "high"` before importing into your cold-email tool to protect your sender reputation and stay out of spam.
- **Tech-maturity signal for qualification** — a domain on Microsoft 365 with `p=reject` is a different buyer than a brand-new domain with no auth; use it to segment and personalize.
- **Data-quality gate** — flag parked / dead / newly-registered domains in an inbound or purchased list before they cost you.
- **Competitive / partner recon** — quickly profile the email posture of a set of companies.

***

### FAQ

**Does this need an API key?**
No. Every check is keyless: DNS via Node's resolver, RDAP via the public `rdap.org` bootstrap, and a plain HTTP(S) GET for the website probe.

**Why is `hasDkim` sometimes `false` for a domain I know signs its mail?**
DKIM selectors are chosen freely by each domain and can't be enumerated from DNS — we probe the most common ones (`google`, `default`, `selector1/2`, `k1`, `s1`, `dkim`, `mail`). A hit *proves* DKIM is present; a miss is **inconclusive**, not proof of absence. We reflect this by not over-penalizing a DKIM miss in the risk score.

**Why RDAP instead of WHOIS?**
RDAP is the modern, structured, rate-friendly JSON replacement for WHOIS and is far more reliable from cloud IPs. If a registry doesn't expose a registration date (some ccTLDs don't), `domainAgeYears` comes back `null` — handled gracefully, the rest of the record is still complete.

**Do you probe SMTP / port 25?**
No — like our email-verifier actor, we skip live-SMTP probing. It's blocked and throttled on cloud IPs and produces false signals (greylisting, catch-all accept-all). We do the honest, reliable DNS/HTTP checks instead.

**How is it priced?**
Pay-per-event: you're charged once per enriched domain record (`domain-enriched`). No monthly fee, no per-run minimum — bulk-friendly and predictable. The run respects your `ACTOR_MAX_TOTAL_CHARGE_USD` cap.

**How fast is it?**
All checks per domain run in parallel, and domains run concurrently (`maxConcurrency`, default 5). A few hundred domains finish in a couple of minutes.

***

### Automate it

Run on a schedule (e.g. re-score your CRM's active domains weekly) with **Apify Schedules**, or trigger from your stack via the **Apify API / webhooks / integrations** (Make, Zapier, n8n). Point the output dataset at Google Sheets or your CRM and keep your lead list continuously scored.

***

### Related actors

Pair this with the rest of our B2B enrichment stack:

- **[Bulk Email Verifier](https://apify.com/renzomacar/email-verifier)** — verify individual email *addresses* (syntax, MX, disposable, role-based, free-provider, 0-100 score). Use it *after* this actor tells you which domains are worth sending to.
- **[Company Enrichment](https://apify.com/renzomacar/company-enrichment)** — turn a domain into firmographics, tech stack and contacts.

**Domain Health Enricher** is the domain-level layer: check the *domain's* posture first, then verify the addresses on the good ones.

***

*Found this useful? A 30-second ⭐ review helps other teams find it.*

# Actor input Schema

## `domains` (type: `array`):

One domain per line (e.g. stripe.com). URLs (https://stripe.com/pricing) and emails (john@stripe.com) are accepted too — they're reduced to the bare domain automatically. Each domain is checked for: live DNS MX + provider, SPF (v=spf1), DMARC + policy (none/quarantine/reject), DKIM (common selectors), domain age & registrar (RDAP), and a live website/HTTPS probe. One clean record is returned per domain, with a 0-100 email-security score and a low/medium/high deliverability risk.

## `maxConcurrency` (type: `integer`):

How many domains to enrich in parallel. Higher = faster on big lists; the default is a friendly value for public DNS resolvers and RDAP/HTTP endpoints.

## Actor input object example

```json
{
  "domains": [
    "stripe.com",
    "gmail.com",
    "notion.so"
  ],
  "maxConcurrency": 5
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "stripe.com",
        "gmail.com",
        "notion.so"
    ],
    "maxConcurrency": 5
};

// Run the Actor and wait for it to finish
const run = await client.actor("renzomacar/domain-health-enricher").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "stripe.com",
        "gmail.com",
        "notion.so",
    ],
    "maxConcurrency": 5,
}

# Run the Actor and wait for it to finish
run = client.actor("renzomacar/domain-health-enricher").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "stripe.com",
    "gmail.com",
    "notion.so"
  ],
  "maxConcurrency": 5
}' |
apify call renzomacar/domain-health-enricher --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=renzomacar/domain-health-enricher",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "🛡️ Domain & Email Deliverability Enricher (SPF/DMARC)",
        "description": "Enrich domains in bulk with email deliverability signals: MX + provider, SPF, DMARC + policy, DKIM, domain age (RDAP), HTTPS, plus a 0-100 email-security score and deliverability risk. Score prospects before cold outreach. No API key.",
        "version": "0.1",
        "x-build-id": "bE8zyX3GlhEDAysbT"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/renzomacar~domain-health-enricher/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-renzomacar-domain-health-enricher",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/renzomacar~domain-health-enricher/runs": {
            "post": {
                "operationId": "runs-sync-renzomacar-domain-health-enricher",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/renzomacar~domain-health-enricher/run-sync": {
            "post": {
                "operationId": "run-sync-renzomacar-domain-health-enricher",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "required": [
                    "domains"
                ],
                "properties": {
                    "domains": {
                        "title": "Domains to enrich",
                        "type": "array",
                        "description": "One domain per line (e.g. stripe.com). URLs (https://stripe.com/pricing) and emails (john@stripe.com) are accepted too — they're reduced to the bare domain automatically. Each domain is checked for: live DNS MX + provider, SPF (v=spf1), DMARC + policy (none/quarantine/reject), DKIM (common selectors), domain age & registrar (RDAP), and a live website/HTTPS probe. One clean record is returned per domain, with a 0-100 email-security score and a low/medium/high deliverability risk.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "maxConcurrency": {
                        "title": "Max concurrency",
                        "minimum": 1,
                        "maximum": 25,
                        "type": "integer",
                        "description": "How many domains to enrich in parallel. Higher = faster on big lists; the default is a friendly value for public DNS resolvers and RDAP/HTTP endpoints.",
                        "default": 5
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```