SiteVerdict — Domain & Email Health Checker

Check SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DNSSEC, CAA, SSL certificate expiry, HSTS and HTTP security headers for one domain or thousands. Every domain gets a 0–100 score and A+ to F grade, a deliverability risk rating, plain-English explanations and the exact DNS record to paste to fix each problem. You also get a shareable HTML report for every domain.

No browser, no login, no API keys. It only reads public DNS, HTTPS and TLS data, so a domain usually takes about 1 second.

Who it's for

• Agencies and MSPs: audit every client domain in one run and send each client their own HTML report.
• Email marketers and cold-outreach teams: confirm you meet the Gmail, Yahoo and Microsoft bulk-sender rules (SPF + DKIM + DMARC) before you send.
• Sales teams: qualify leads by email security posture (provider, DMARC policy, broken SPF) at scale.
• IT and security teams: watch certificate expiry, HSTS, DNSSEC and header hygiene across a domain portfolio. Schedule it daily and alert on changes.

What it checks

Area	Checks
MX	Records and priorities, hosts that don't resolve, MX pointing at an IP, null MX (RFC 7505), email provider detection (Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Mimecast, Proofpoint, MessageLabs, IONOS, GoDaddy and 25+ more)
SPF	Syntax, exactly one record, full recursive include/redirect expansion with the RFC 7208 10-lookup limit, void lookups (limit 2), +all / ?all / ~all / -all, loops, deprecated ptr, oversized ranges, record length. Sending services detected from includes (SendGrid, Mailchimp, HubSpot, Salesforce, Amazon SES and more)
DMARC	Presence, p= / sp= / np=, pct, rua / ruf syntax (catches the missing mailto:), adkim / aspf alignment, duplicates, records at the wrong host, external report authorisation records, subdomains inheriting the organisational policy
DKIM	Probes about 45 common selectors (google, selector1/selector2, k1–k3, s1/s2, default, mandrill, smtpapi, zoho, mxvault, cf2024-1, pm, hs1/hs2, protonmail, fm1–fm3 and more), plus any you add. Reports key type and length (flags 1024-bit and weaker), revoked keys, t=y testing mode and wildcard answers
BIMI	Record, HTTPS logo URL, SVG Tiny PS profile, VMC/CMC certificate, and whether DMARC is strict enough for the logo to appear
MTA-STS & TLS-RPT	DNS record, policy file fetched over HTTPS (mode, max_age, MX coverage, redirects, content type), TLS-RPT rua
SSL/TLS (apex and www)	Chain validity (including incomplete chains), days until expiry, hostname match, issuer, key size, negotiated protocol, TLS 1.0/1.1 still enabled
HTTPS & HSTS	HTTP→HTTPS redirect chain (301 vs 302, hop count), HSTS max-age, includeSubDomains, preload eligibility (and optionally live status from hstspreload.org)
Security headers	Content-Security-Policy (including unsafe-inline / unsafe-eval analysis), X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, version leaks in Server / X-Powered-By
DNS	DNSSEC (DS at parent plus AD-flag validation; detects broken "bogus" DNSSEC), CAA (and whether your current CA is allowed to renew), nameserver count
Optional, off by default	DNS blocklists for MX IPs, and a polite SMTP STARTTLS capability probe (EHLO then QUIT only)

Each check returns pass / warn / fail / info / skipped, a severity (critical, high, medium, low, info), a one-line summary, the issues found, and for each issue a plain-English fix and, where it applies, a ready-to-paste record such as:

TXT  _dmarc
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1

Scoring

• Each check has a weight. DMARC 20, SPF 15, SSL (apex) 12, DKIM 10, security headers 8, blocklists 6, MX / HTTPS redirect / HSTS 5, MTA-STS / DNSSEC / SSL (www) 4, STARTTLS 3, TLS-RPT / BIMI / CAA / nameservers 2.
• A pass earns the full weight and a warning earns part of it. Checks that don't apply are left out of the score: a domain that doesn't receive mail isn't penalised for missing MTA-STS, and disabled checks don't count.
• Any critical finding (expired certificate, +all, duplicate DMARC, broken DNSSEC) caps the score at 60. Any high finding caps it at 85.
• Grades: A+ ≥95, A ≥88, B ≥78, C ≥65, D ≥50, F <50. You also get separate emailScore and webScore values.
• Deliverability risk (low / medium / high / critical) is based only on email authentication, MX health and blocklists.
• bulkSenderReady.gmailYahoo is true when SPF, DKIM and DMARC meet the DNS prerequisites of the Gmail/Yahoo (Feb 2024) and Outlook.com (May 2025) bulk-sender requirements.

Input

{
  "domains": ["example.com", "https://www.yourclient.co.uk/", "info@another.org"],
  "maxConcurrency": 10,
  "extraDkimSelectors": ["mycustomselector"],
  "checkBlocklists": false,
  "smtpStarttlsCheck": false
}

• domains: bare domains, URLs or email addresses. They are normalised (IDN → punycode, www. stripped) and de-duplicated.
• domainsListUrl: for bulk runs, a URL to a TXT/CSV file with one domain per line.
• skipChecks: leave out any check, for example only email checks or only web checks.
• dnsResolver: Cloudflare (default), Google, Quad9, system, or DNS-over-HTTPS only. Failed lookups automatically fall back to DoH.
• maxConcurrency (default 10, max 50) and delayBetweenDomainsMs control speed and politeness for large lists.

Output

One dataset item per domain. The dataset has four views: Overview, Email deliverability, Website & TLS, and Fix list (one row per prioritised fix). Export as JSON, CSV, Excel or HTML, or use the API. The key-value store also holds:

• REPORT: combined HTML report with a sortable summary table and full detail for the lowest-scoring domains
• report-<domain>: a standalone HTML report for each domain, ready to send to a client (reportUrl in each item)
• SUMMARY: run totals, grade and risk distribution

Sample (bbc.co.uk, trimmed)

{
  "domain": "bbc.co.uk",
  "score": 88,
  "grade": "A",
  "emailScore": 85,
  "webScore": 98,
  "deliverabilityRisk": { "level": "medium", "reasons": ["No DKIM key found on common selectors (verify your real selector)."] },
  "emailProvider": "Broadcom Email Security.cloud (MessageLabs)",
  "spfStatus": "pass",
  "spfLookups": 4,
  "dmarcPolicy": "reject",
  "dkimSelectorsFound": [],
  "mtaStsMode": null,
  "dnssec": false,
  "sslDaysLeft": 104,
  "sslIssuer": "GlobalSign nv-sa",
  "hsts": true,
  "topFixes": [
    { "check": "MTA-STS", "severity": "low",
      "fix": "No MTA-STS. Mail sent to you can be downgraded to unencrypted SMTP ... Host a policy file at https://mta-sts.bbc.co.uk/.well-known/mta-sts.txt ...",
      "record": { "type": "TXT", "host": "_mta-sts", "value": "v=STSv1; id=2026101101" } }
  ],
  "checks": { "spf": { "status": "pass", "summary": "SPF found: 4/10 lookups, ends with soft fail (~all).", "...": "..." } }
}

Sample run on 11 Oct 2026: gov.uk A (90), bbc.co.uk A (88), github.com B (85), google.com B (81), example.com C (75). Five domains took about 2 s in total.

Pricing

Pay per event: you are charged once per domain that is checked successfully (domain-checked). Invalid inputs, domains that don't exist (NXDOMAIN) and domains that time out are not charged. See the Pricing tab for the current price. Set a maximum cost per run and the Actor stops cleanly when it is reached.

FAQ

Can it find every DKIM key? No tool can. DNS has no way to list DKIM selectors, so this Actor probes about 45 common ones. If a domain signs with a custom selector, look at the s= value in the DKIM-Signature header of an email it sent and add it under Extra DKIM selectors. The report says clearly when DKIM is "not found on common selectors" rather than claiming it's missing.

Does it send email or log in to mail servers? No. It never sends email and never tries to authenticate or test for open relays. The optional STARTTLS probe (off by default) only connects, sends EHLO, reads the capability list and sends QUIT.

Why are blocklist checks off by default? Blocklist operators set their own usage terms. Spamhaus, URIBL, SURBL and Barracuda restrict commercial or high-volume use, require a registered key, and often refuse queries from cloud or public resolvers. The default lists (SpamCop, PSBL, DroneBL) allow free low-volume lookups. You can add other zones only if your use complies with their terms. Answers that mean "query refused" (for example 127.255.255.x) are reported as unknown, not as listed.

Is it gentle enough for thousands of domains? Yes. Results are cached across domains (for example _spf.google.com is resolved once per run), in-flight DNS queries are capped, and each domain makes only about 6 HTTP/TLS connections. Concurrency and per-worker delay are configurable. If the run migrates or restarts, it resumes without re-charging domains it already checked.

Why does my site lose points for TLS 1.0/1.1 or missing headers when Google also lacks them? The score reflects best practice, not popularity. Every finding has a severity, so you can decide what matters to you, or skip whole checks with skipChecks.

Can I schedule it? Yes. Use Apify Schedules (for example daily) and webhooks or integrations to alert when sslDaysLeft drops below 14 or a grade changes.

Limitations

• DKIM is verified only for the selectors probed (see above).
• Blocklist checks look at MX IPs. Your outbound sending IPs, especially through an ESP, may be different.
• SPF and DMARC alignment in real mail can only be confirmed from message headers or DMARC reports. This Actor checks the published policy.
• DNSSEC status comes from a validating DoH resolver (Cloudflare, then Google).
• Sites with an invalid certificate are still analysed for TLS, but their HTTP headers can't be fetched. That case is reported as skipped.
• Port 25 is often blocked on cloud networks, so the STARTTLS probe may return "inconclusive".
• Results are a snapshot at check time. DNS changes take time to propagate.

Data sources, compliance and retention

• What it reads: public DNS records (MX, SPF/TXT, DMARC, DKIM selectors, BIMI, MTA-STS/TLS-RPT, CAA, NS, DNSSEC) and the public HTTPS/TLS responses of the domains you enter. DNS queries go to the resolver you choose (default: Cloudflare 1.1.1.1; Google, Quad9 or your container's own resolver are options), with Cloudflare/Google DNS-over-HTTPS as a fallback.
• Optional, off by default: the hstspreload.org status API, DNS blocklists (Spamcop, PSBL and DroneBL by default, or zones you list) and an SMTP STARTTLS probe (EHLO then QUIT, no mail is sent). When switched on, those services receive the domain or mail-server names being checked.
• No personal data is collected on purpose; results describe domain configuration. DMARC report addresses are shown only as published in the domain's own DNS.
• Where results are stored: the default dataset and key-value store of the run (rows, REPORT, per-domain HTML reports, SUMMARY, and a STATE progress record), inside your own Apify account. These default storages are unnamed. How long Apify keeps them is set by Apify and your plan, not by SiteVerdict (Apify data retention); you can delete them sooner in Apify Console.
• What SiteVerdict keeps: nothing. The Actor runs in your Apify account and sends no data to SiteVerdict.
• Not a certificate: this is an automated configuration check, not a security audit, penetration test or legal advice.

Changelog

See ./CHANGELOG.md.

---

Built by SiteVerdict. Feedback and feature requests are welcome in the Issues tab.