Email Deliverability Report: SPF, DKIM, DMARC, MTA-STS

One deliverability report per domain, up to 500 domains per run: who handles the mail, the SPF record with its DNS lookup count against the limit of ten, the DKIM selectors that really exist, the DMARC policy and whether anyone receives the reports, MTA-STS in enforce or testing mode, TLS-RPT, BIMI and DNSSEC. Every report ends with ranked issues and a score. You pay per delivered report.

Why this scraper

• It counts the SPF lookups. A receiving server is allowed to give up after ten DNS lookups, and a record over that limit quietly fails for part of the world. Counting it means following every include down the tree, which is exactly what this does. Measured on 14-09-2026: apify.com sits at 9 of 10, github.com at exactly 10. Most checkers never tell you that.
• DKIM selectors that actually answer. DKIM cannot be listed, only asked for by name, so thirteen selectors that the large providers use are tried and the ones that exist are reported. In the same test github.com returned five and mollie.com one.
• MTA-STS in enforce or testing. The DNS record only says a policy exists. Whether it is enforced is in the policy file, which this actor reads for you, under that host's robots.txt, and you can switch that request off.
• It ends with a conclusion. Every report carries issues worst first, each with a severity, a sentence in plain language and the measured value, plus a score from 0 to 100 and a grade from A to F.
• Public DNS only. No site is crawled, nothing is logged in, no proxy is needed. The records exist so that mail servers world-wide can read them.
• No personal data. An e-mail address in your input is reduced to its domain immediately and never delivered. DMARC reporting addresses are reported as a yes or no, never as the addresses themselves.

Who this is for

Agencies and IT teams auditing a domain portfolio. Deliverability consultants qualifying prospects (a list of 500 domains, sorted by score, is a pipeline). Security teams checking that spoofing protection is actually switched on, and sales teams that want to know which mail platform a company uses.

Who this is not for

Read this before you buy.

• DKIM is a guess, not a listing. There is no way to enumerate selectors, so a domain with DKIM under a private selector comes back as no-dkim-selector-found. Add your own selectors in the input if you know them. That is a property of DKIM, not of this actor.
• It reads records, it does not send mail. No test message, no inbox placement, no blacklist check. If you need to know whether Gmail puts you in spam, this is the wrong tool; this tells you whether the records that decide it are correct.
• The score is an opinion, and a documented one. Every issue costs points: 25 for a critical one, 10 for a warning, 3 for an informational one, starting from 100. A domain with no SPF and no DMARC scores 50 or below. Use the issue list for decisions and the score for sorting.
• A domain without MX gets a report too. It simply does not receive mail, which is reported as an issue of its own rather than as an error.

Input example

{
    "domains": ["apify.com", "github.com", "info@mollie.com"],
    "checkMtaStsPolicy": true,
    "extraDkimSelectors": ["myselector"]
}

A domain, a URL or an e-mail address all work; only the domain is used and kept.

Output example

{
    "domain": "github.com",
    "score": 75,
    "grade": "B",
    "issueCount": 3,
    "issues": [
        {"code": "spf-lookups-near-limit", "severity": "warning",
         "message": "SPF uses 10 of the 10 allowed DNS lookups", "value": 10},
        {"code": "spf-softfail", "severity": "info",
         "message": "SPF ends in ~all (softfail); -all is the stricter choice once you are sure", "value": null},
        {"code": "dmarc-policy-quarantine", "severity": "info",
         "message": "DMARC is set to p=quarantine; p=reject is the end state", "value": null}
    ],
    "mxRecords": ["10 alt3.aspmx.l.google.com."],
    "mailProvider": "Microsoft 365",
    "acceptsMail": true,
    "hasSpf": true,
    "spfRecord": "v=spf1 ip4:192.30.252.0/22 include:_spf.google.com ~all",
    "spfQualifier": "softfail",
    "spfLookupCount": 10,
    "spfIncludes": ["_spf.google.com", "spf.protection.outlook.com"],
    "hasDkim": true,
    "dkimSelectors": ["google", "s1", "s2", "selector1", "selector2"],
    "hasDmarc": true,
    "dmarcPolicy": "quarantine",
    "dmarcSubdomainPolicy": null,
    "dmarcPercent": 100,
    "dmarcAggregateReports": true,
    "dmarcForensicReports": false,
    "hasMtaSts": false,
    "mtaStsMode": null,
    "hasTlsRpt": false,
    "hasBimi": false,
    "hasDnssec": false,
    "status": "ok"
}

Error codes: INVALID_DOMAIN, LOOKUP_FAILED. Neither is charged. INPUT_TRUNCATED appears once when your input is longer than this actor accepts.

Related actors from steadydata

• domain-dns-ssl-report: registration, expiry, DNS and TLS for the same domain
• website-tech-stack: what the site behind the domain runs on

Pricing

Pay per event: one domain-checked event per delivered report. No start fee, no separate platform-usage surcharge, and no charge for input that is not a domain.

Free Apify plan: this actor delivers up to 25 rows per run for accounts on the Apify free plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full size, billed per delivered row, with failed rows never charged.

FAQ

Which issues can a report carry? no-mx, no-spf, spf-allows-everything, spf-too-many-lookups, spf-lookups-near-limit, spf-neutral, spf-no-all-mechanism, spf-softfail, no-dkim-selector-found, no-dmarc, dmarc-policy-none, dmarc-policy-quarantine, dmarc-partial-coverage, dmarc-no-reporting, dmarc-subdomains-unprotected, no-mta-sts, mta-sts-testing-only, no-tls-rpt and no-dnssec.

Why does the SPF lookup count differ from other tools? Because most tools count only the first level. This one follows every include and redirect down five levels, which is how a receiving server counts it too.

Which DKIM selectors are tried? default, google, selector1, selector2, k1, s1, s2, dkim, mail, smtp, zoho, mandrill and mimecast20200114, plus anything you add yourself.

Is personal data collected? No. Input addresses are reduced to their domain and discarded, and DMARC reporting addresses are reported only as present or absent. Everything delivered is a public DNS record about a domain, not about a person.

What happens when a record changes? That is the point: run the list again and the report changes with it. The actor is run against real domains daily and fixed fast, and while it is broken you are not charged.