DMARC Checker – SPF, DKIM & MX Record Lookup in Bulk

Check the email security of one domain or 50,000 at once. Paste domains, website URLs or a whole list of email addresses, and for each domain you get, in plain words:

• A grade from A to F and a list of the issues, written so you can send them to a client or a developer.
• DMARC: the record, the policy (none, quarantine, reject), subdomain policy, pct, whether reports are sent, and the parent domain's policy when a subdomain has none of its own.
• SPF: the record, how it ends (-all, ~all, ?all, +all) and how many DNS lookups it really costs. Every nested include is followed and counted, the way receivers do. Over 10 means SPF fails with permerror. Includes that have no SPF record and include loops are flagged.
• DKIM: which selectors have a key. The selectors used by Google Workspace, Microsoft 365, Mailchimp/Mandrill, SendGrid, Zoho and others are tried, and you can add your own.
• MX records and the mail provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho ...), and whether the domain can receive mail at all.
• BIMI, MTA-STS and TLS-RPT records.

Built for cold email and lead lists (check the sender domains before you send), deliverability audits, agencies doing client reports, security reviews, and sales teams looking for companies with weak email security.

Example output row

{"domain": "nrk.no", "exists": true, "grade": "C", "verdict": "grade C: 1 issue", "can_receive_mail": true, "mail_provider": "Google Workspace",
 "spf_record": "v=spf1 mx a ip4:160.67.135.178 ... include:_spf.google.com -all", "spf_all": "-all", "spf_dns_lookups": 7,
 "dmarc_policy": "none", "dmarc_reports": true, "dkim_found": true, "dkim_selectors": ["google"], "bimi": false, "mta_sts": false,
 "issues": ["DMARC policy is p=none: spoofed mail is only reported, not blocked"]}

Grades

Grade	Meaning
A	DMARC quarantine or reject on all mail, reports on, SPF valid within 10 lookups
B	DMARC enforced, but SPF is weak, reports are off or pct is below 100
C	DMARC p=none (monitoring only) with a good SPF
D	DMARC p=none with a weak SPF, or no DMARC but a good SPF
F	No DMARC and no usable SPF: anyone can send mail as this domain

DKIM never lowers the grade: a key can sit under a selector nobody can guess.

How to use

1. Click Try for free (or Start) at the top of this page to open the input form.
2. Fill in Domains or email addresses. Up to 50,000 domains, website URLs or email addresses (info@shop.com checks shop.com). The form comes with a working example, so you can also run it as it is.
3. Optional: adjust Extra DKIM selectors (optional). Every field has a sensible default.
4. Click Start and wait for the run to finish.
5. Download the results as Excel, CSV or JSON from the Output tab, or get them through the Apify API, a schedule or an integration (Make, Zapier, Google Sheets ...).

Pricing

Pay per event, no subscription:

• $0.0008 per domain checked ($0.80 per 1,000).
• $0.001 per run start.

A domain that does not exist is still a result. Domains whose DNS does not answer, and text that is not a domain, are free. Works on the free Apify plan.

Input

Field	What it does
domains	Domains, URLs or email addresses, up to 50,000. info@shop.com checks shop.com; duplicates are checked once.
dkimSelectors	Optional extra DKIM selectors, e.g. s1 for s1._domainkey.example.com.

Good to know

• Lookups go through public DNS-over-HTTPS (Cloudflare, with Google as fallback), so you see what mail servers on the internet see.
• A subdomain without its own DMARC record gets its parent's policy, as RFC 7489 says. dmarc_inherited_from shows when that happens.
• The SPF count covers include, a, mx, ptr, exists and redirect, nested includes included. Macros (%{...}) cannot be followed without a real sender and are not counted.

More tools from Rowfeed

• WHOIS Lookup & DNS Checker – domain age, expiry, registrar, nameservers and SSL expiry.
• Website Contact Finder – company contact pages and social profiles from a list of websites.
• Website Technology Checker – which CMS, analytics and tools a website uses.
• Google Maps Scraper – local businesses with websites, to check before outreach.
• DNS Lookup & DNS Checker – A, MX, NS, TXT, CAA records and reverse DNS of any domain or IP list.