# Audit DMARC, SPF and MTA-STS of public organisation domains

**Use case:** 

Email authentication check for the domains of ten public organisations and projects: SPF policy and lookup count, DMARC policy and percentage, MTA-STS, TLS-RPT and BIMI records, an email security score and the problems found, such as a DMARC policy of none or an SPF record over the 10-lookup limit. Paste your own domains to audit them the same way.

## Input

```json
{
  "domains": [
    "gov.uk",
    "europa.eu",
    "bbc.co.uk",
    "wikipedia.org",
    "mozilla.org",
    "python.org",
    "iana.org",
    "nasa.gov",
    "un.org",
    "who.int"
  ],
  "maxItems": 10,
  "onlyNew": false,
  "stateName": "default",
  "notifyWhenEmpty": false,
  "requestIntervalMs": 0
}
```

## Output

```json
{
  "domain": {
    "label": "Domain checked (without www.)",
    "format": "string"
  },
  "spfAll": {
    "label": "How the SPF record ends: -all (reject), ~all (soft fail), ?all (neutral), +all (allow everyone), or null",
    "format": "string"
  },
  "spfLookupCount": {
    "label": "DNS lookups the SPF record costs, counted through the whole include tree (the limit is 10), or null without SPF",
    "format": "integer"
  },
  "dmarcPolicy": {
    "label": "DMARC policy: none, quarantine or reject, or null without a valid DMARC record",
    "format": "string"
  },
  "dmarcPct": {
    "label": "Share of mail the DMARC policy applies to (pct tag, 100 when not given), or null without DMARC",
    "format": "integer"
  },
  "hasMtaSts": {
    "label": "An MTA-STS record exists in DNS (_mta-sts); the policy file is not fetched; null when the lookup failed",
    "format": "boolean"
  },
  "hasTlsRpt": {
    "label": "A TLS-RPT record exists in DNS (_smtp._tls); null when the lookup failed",
    "format": "boolean"
  },
  "hasBimi": {
    "label": "A BIMI record exists (brand logo in the inbox); null when the lookup failed",
    "format": "boolean"
  },
  "emailSecurityScore": {
    "label": "E-mail security score 0-100 from SPF, DMARC, MTA-STS, TLS-RPT and BIMI (formula in the README); null when a needed lookup failed",
    "format": "integer"
  },
  "issues": {
    "label": "Problems found, separated by commas (null when none): no_mx, spf_missing, spf_multiple_records, spf_too_many_lookups, spf_allows_all, spf_neutral, spf_no_all, dmarc_missing, dmarc_none, dmarc_pct_below_100, dmarc_no_reporting, dmarc_invalid, dmarc_multiple_records, single_nameserver",
    "format": "string"
  }
}
```

## How it works

### 1. Sign up on Apify or log in

The Domain Email and DNS Checker API: MX, SPF, DMARC, Providers Actor is ready to run with the inputs already set for "Audit DMARC, SPF and MTA-STS of public organisation domains". [Sign up or log in](https://console.apify.com/create-task-from-example/qO9D8DiBUVlo6Rpf4) and you'll land in Apify Console with a copy of this exact task.

### 2. Start the "Audit DMARC, SPF and MTA-STS of public organisation domains" task

The Domain Email and DNS Checker API: MX, SPF, DMARC, Providers Actor will start running based on the input automatically. You can also change all the input fields, like domains, maximum domains delivered, and more, to match your specific use case.

### 3. Receive the "Audit DMARC, SPF and MTA-STS of public organisation domains" output

Monitor the progress in real time. You will be notified as soon as your dataset is complete and ready for review. Each result includes data such as domain checked (without www.), how the spf record ends: -all (reject), ~all (soft fail), ?all (neutral), +all (allow everyone), or null, DNS lookups the SPF record costs, counted through the whole include tree (the limit is 10), or null without SPF, and more.

### 4. Integrate into your workflow

The final output is delivered in JSON, CSV, or Excel format, ready to be plugged into your workflow. You can also [run the "Audit DMARC, SPF and MTA-STS of public organisation domains" task via API](https://apify.com/rowcraft/domain-email-dns-checker.md).

## About this Actor

This example demonstrates how to use [Domain Email and DNS Checker API: MX, SPF, DMARC, Providers](https://apify.com/rowcraft/domain-email-dns-checker.md) with a specific input configuration. Visit the [Actor detail page](https://apify.com/rowcraft/domain-email-dns-checker.md) to learn more, explore other use cases, and run it yourself.


## How to integrate an Actor?

This Task's input is already configured above. Use it as-is rather than inventing a new one.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For full API examples (JavaScript, Python, CLI, MCP, OpenAPI), see this Task's Actor page: https://apify.com/rowcraft/domain-email-dns-checker.md

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).