Email Domain Auth Auditor – SPF, DKIM, DMARC, MX & BIMI Bulk Checker

Check SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI for hundreds of domains in one run. Each domain gets a 0–100 score, an A–F grade, a list of problems and plain-English fixes. Use it as a bulk DMARC checker, SPF lookup-limit checker and email deliverability audit for cold-email lists, agencies, MSPs and security teams.

No login, no browser, no proxy, no API key. It reads public DNS records over DNS-over-HTTPS (Cloudflare, with Google as fallback), so runs are fast and cost very little.

What you get for every domain

• SPF: record, ending qualifier (-all, ~all, +all), included services, and the real DNS lookup count (the 10-lookup limit that silently breaks SPF).
• DMARC: policy (none/quarantine/reject), subdomain policy, pct, report addresses (rua, ruf).
• DKIM: probes about 30 common selectors (Google, Microsoft 365, Mailchimp/Mandrill, SendGrid, Zoho, Proton, HubSpot and more). Add your own selectors if needed.
• MX: records plus detected mail provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho...).
• MTA-STS, TLS-RPT, BIMI presence.
• Score, grade, issues (high/medium/low) and recommended fixes.

Use cases

• Audit a prospect list before cold outreach and drop domains with no authentication.
• Agency or MSP security reports for clients.
• Monitor your own domains on a schedule and alert on regressions (grade drops, SPF over 10 lookups).
• Enrich leads with mail provider and email-security posture.
• Find spoofable domains (no DMARC, p=none, +all).

Input

Field	Description	Default
domains	Domains, URLs or email addresses (domain is extracted)	required
checkDkim	Probe common DKIM selectors	true
extraDkimSelectors	Your own selectors	none
checkMtaSts	Look for MTA-STS	true
maxDomains	Cap per run (also caps cost)	1000
concurrency	Parallel domains	10

{ "domains": ["example.com", "ceo@yourclient.com", "https://www.acme.io"], "extraDkimSelectors": ["mail2026"] }

Output (one item per domain)

{
  "domain": "cloudflare.com",
  "score": 100,
  "grade": "A",
  "hasMx": true,
  "mxProvider": "Other / self-hosted",
  "spf": { "found": true, "allQualifier": "-", "dnsLookups": 7, "includes": ["..."] },
  "dmarc": { "found": true, "policy": "reject", "pct": 100, "rua": ["mailto:..."] },
  "dkim": { "checked": true, "selectorsFound": ["k1", "s1"] },
  "mtaSts": true, "tlsRpt": true, "bimi": false,
  "issues": [], "recommendations": []
}

Download as JSON, CSV or Excel, or call it through the Apify API.

Pricing

Pay per event: you are charged per domain audited (one default dataset-item "result" event each), plus a tiny start fee. Domains that fail to process are listed in the ERRORS record and not charged.

Good to know

• DKIM selectors cannot be listed by design. A miss on the common selectors does not prove DKIM is off; add your provider's selector in extraDkimSelectors. Some large senders (for example Google) use date-based selectors.
• The audit is passive: it only queries public DNS and never contacts the domain's mail servers.
• Scores are guidance based on widely used best practice, not a compliance certificate.

FAQ

Is this legal? Yes. It only reads public DNS records that every mail server queries. Does it send email? No. How many domains can I check? Up to 10,000 per run.