Public DNS Email Policy Evidence API

Observe public MX, SPF TXT and exact-domain DMARC TXT records with query URLs, resolver DNS status, stable policy hashes and documented limitations. Use it to monitor a domain's published email configuration or enrich source-backed business-domain records. This is not an email verifier or deliverability guarantee.

Quick start

{"domains": ["python.org", "example.com"]}

Download the dataset as JSON, CSV or Excel. Each row covers three completed DNS queries for one normalized domain. Read OUTPUT.errors before using completeness. Up to ten domains; duplicate normalized inputs are queried once. Bare domains only, IDNA-normalized, at most 246 ASCII characters. No URL, mailbox, IP, wildcard or private/reserved suffix inputs.

Evidence and policy observations

Uses the official, unauthenticated Google Public DNS JSON resolver endpoint. Sends MX and TXT queries for the domain, and TXT for _dmarc.domain. Disables EDNS client-subnet forwarding with 0.0.0.0/0 and keeps resolver DNSSEC validation enabled. Resolver-seen AD is evidence of the response flag, not independent DNSSEC verification. Query responses must match the requested question, name and type. Answer ownership is bound to the query or a bounded returned CNAME chain; no alias is separately fetched. Resolver errors, truncation and inconsistent answers are source errors, not missing policies. NOERROR without policy records and NXDOMAIN are billable completed observations.

MX priority/target and TTL are preserved. A singleton priority-0 exchange '.' is flagged nullMxObserved. Current unquoted TXT values are preserved; presentation-format quoted segments are concatenated with DNS string escaping, while rawData remains available as evidence. Unrelated TXT verification records are not exported. Multiple SPF or DMARC records and duplicate/unrecognized DMARC p tags are warned. declaredExactDomainDmarcPolicy is only the observed p value from one recognized, nonduplicate-tag exact-name DMARC record; it is not an enforcement or authentication result. A missing exact-domain DMARC record does not establish absence of inherited policy.

No SMTP connections, emails, mailbox checks, sender-IP SPF evaluation, include/redirect expansion, SPF lookup-budget calculation, DKIM selector discovery, organizational-domain/DMARC inheritance, report authorization, reputation, blacklist or message alignment checks. Public DNS cache contents are point-in-time observations; no sender authenticity, delivery, domain-registration availability or security certification is inferred. CNAME/data are resolver-supplied evidence. DNS targets and policy strings are not contacted or executed.

Change monitoring

Pass SNAPSHOT.previousHashes as previousHashes in the next input. NO_BASELINE/FIRST_SEEN/UNCHANGED/CHANGED compare normalized records, statuses and warnings. TTL, record ordering, quoting segmentation, AD flag and observedAt do not change the hash. FIRST_SEEN means absent from the supplied baseline, not a newly registered domain. Snapshot includes only emitted rows; missing rows cannot establish deletion. No hidden persistent state or schedules.

Planned pricing

Intended publication price: $0.003 per completed domain observation ($3 per 1,000), plus $0.005 Actor-start for the default 256 MB. Higher memory can multiply startup events. Event-only pricing includes platform usage; no paid upstream, proxy or browser. All three DNS query responses must succeed consistently before a result event. Missing policies can still be billable. Failed domains incur no result event; startup may still apply. Budget truncation reports PARTIAL_BUDGET and complete=false. Check effective Store pricing before running: a private draft has no published paid pricing.

Requests and data

Only the fixed Google Public DNS service and its HTTP redirects are network targets; queried domain/MX/SPF/DMARC addresses are not contacted. HTTP public-IP validation and IP pinning, TLS hostname checks, five-redirect limit, 2 MiB decoded responses and approximately 95 seconds fetch budget. Three queries per domain are paced with 0.1-second gaps. Published resolver API requests are distinct from website HTML crawling and do not fetch a robots page. No credential, cookie, proxy or blocking workaround. Google sees the queried domains and the Actor request's source IP; EDNS forwarding is disabled. Inputs/results stay in your Apify run storage under retention settings; no separate analytics endpoint. Do not submit private names or secrets.

Integration and support

After publication: POST https://api.apify.com/v2/actors/soilair~public-dns-email-policy-evidence-api/runs with your Apify authorization header and input JSON. Poll the run ID and retrieve the dataset and OUTPUT/SNAPSHOT in its key-value store. Developed with AI assistance; fixtures, public-source checks and a private cloud smoke qualify documented behavior, not universal DNS reachability. Report a run ID and expected behavior without credentials.

References: https://developers.google.com/speed/public-dns/docs/doh/json · https://www.rfc-editor.org/rfc/rfc7208.html · https://www.rfc-editor.org/rfc/rfc7489.html