Bulk SPF, DMARC & DKIM Checker + Email Provider Finder

New to Apify? Create an account (affiliate link).

Check up to 5,000 domains per run. For each one you get:

• its email authentication (SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI)
• its mailbox provider (Google Workspace, Microsoft 365, Zoho...)
• its email security gateway (Proofpoint, Mimecast, Cisco...)
• the services that send mail for it (SendGrid, Mailchimp, HubSpot, Salesforce, Amazon SES...)
• a 0-100 deliverability score with an A-F grade
• a prioritized list of fixes

You can paste bare domains, email addresses or website URLs. Each is reduced to its domain and duplicates are removed.

Who it is for

• Cold-email and outbound teams. Segment a lead list by mailbox provider (Google vs Microsoft inboxes), spot prospects behind Proofpoint or Mimecast, and check your own sending domains before a campaign.
• Agencies and MSPs. Audit email security for every client domain in one run. Each row comes with a ready-to-send fix list.
• Deliverability consultants. Find SPF records past the 10-DNS-lookup limit, p=none DMARC, missing or weak DKIM keys, and missing MTA-STS.
• Sales and data enrichment. Add "email stack" columns to a list of companies: mailbox provider, gateway, and the ESP/CRM tools that send for them.
• AI agents. The output is one JSON row per domain. Call it through the Apify API or MCP server.

What makes it different

• Real SPF evaluation.
  • The actor follows include: and redirect= recursively, the way receiving mail servers do. It counts every DNS-querying term against the RFC 7208 limit of 10, and counts void lookups too.
  • It flags include loops, includes pointing at missing names, multiple SPF records and +all.
  • Many checkers only count the top-level record, so they miss SPF that silently fails at Gmail.
• Provider-aware DKIM discovery.
  • DKIM keys can only be found if you know the selector. The actor first probes the selectors used by the providers it detected (google, selector1/2 for Microsoft 365, k1-k3 for Mailchimp, s1/s2 for SendGrid, and so on), then common ones, then any you add.
  • It reports each key's type and size and flags RSA keys under 2048 bits.
• Mailbox provider vs gateway.
  • When MX points to a security gateway, the actor reports the gateway and infers the real mailbox provider from SPF. Each guess comes with a confidence label.
  • Null-MX (non-mail) domains are handled correctly and are not penalized for missing DKIM.
• DMARC inheritance, RFC 9989 (DMARCbis). A subdomain without its own DMARC record is evaluated against the nearest record above it, found by the DNS tree walk that RFC 9989 (May 2026) uses in place of the Public Suffix List, and its sp= / p= policy, as receivers do. inheritedFrom names where the record was found. The new tags are read too: t=y (test mode, replacing pct) is flagged as testing_mode, and np= and psd= are returned.
• Fixes, not just flags. Every row has a fixes list (priority, area, fix) that a person or an agent can act on directly.
• Only real results are charged. Rows for invalid input, nonexistent domains and DNS failures are free.

Input

{
  "domains": ["acme.com", "jane@example.org", "https://www.example.net/pricing"],
  "checkTls": false,
  "dkimSelectors": ["mycustomselector"],
  "maxConcurrency": 10
}

Field	Default	Notes
domains		Domains, emails or URLs. Up to 5,000 per run (split bigger lists).
domainsText		Optional free-text paste (new lines, commas or spaces).
checkTls	false	Also connect to port 443 and report certificate trust, issuer and days to expiry.
dkimSelectors		Extra selectors to probe (max 20).
maxConcurrency	10	Domains checked in parallel (max 25).
maxDnsQueriesPerSecond	50	Run-wide DNS rate limit (max 100).
nameservers	1.1.1.1, 8.8.8.8	Public resolvers to use.

Output

One dataset row per input. The Output tab has an Overview table and a Fixes table (one row per fix). Example (abridged):

{
  "input": "example-corp.com",
  "domain": "example-corp.com",
  "status": "ok",
  "score": 77,
  "grade": "B",
  "scoreBreakdown": {"mx": 10, "spf": 27, "dmarc": 30, "dkim": 10, "transport": 0},
  "acceptsMail": true,
  "mailboxProvider": "Microsoft 365",
  "securityGateway": null,
  "providerConfidence": "high",
  "sendingServices": ["Microsoft 365", "Zendesk", "Salesforce", "Mailchimp", "Marketo", "SendGrid"],
  "mx": [{"priority": 0, "host": "example-corp-com.mail.protection.outlook.com"}],
  "spf": {
    "present": true,
    "allPolicy": "softfail",
    "dnsLookups": 10,
    "voidLookups": 0,
    "issues": ["near_dns_lookup_limit"]
  },
  "dmarc": {"present": true, "policy": "quarantine", "subdomainPolicy": "reject", "pct": 100,
            "rua": "mailto:dmarc@example-corp.com", "issues": [], "inheritedFrom": null},
  "dkim": {"found": [{"selector": "selector1", "keyType": "rsa", "keyBits": 1024, "revoked": false}],
           "selectorsProbed": 17, "issues": ["weak_rsa_key_under_2048"]},
  "mtaSts": {"present": false}, "tlsRpt": {"present": false}, "bimi": {"present": false},
  "fixes": [
    {"priority": "low", "area": "spf", "fix": "SPF uses 10 of 10 allowed DNS lookups: adding one more include will break it"},
    {"priority": "medium", "area": "dkim", "fix": "Rotate DKIM keys shorter than 2048 bits"},
    {"priority": "low", "area": "transport", "fix": "Consider MTA-STS (and TLS-RPT) to enforce TLS for inbound mail"}
  ],
  "checkedAt": "2026-10-07T09:00:00+00:00"
}

status is one of:

• ok
• invalid_input
• domain_not_found
• dns_error

Only ok rows are charged. A run summary (counts, DNS queries made, anything skipped) is stored in the key-value store under RUN_SUMMARY.

Score (0-100)

Area	Points
MX	10 for MX records, or an explicit null MX
SPF	10 present, +15 for -all (+12 for ~all), +5 within the lookup limit with a single record
DMARC	10 present, +20 p=reject (+15 quarantine), +3 pct=100, +2 aggregate reports
DKIM	15 if a key is found (10 if it is a weak RSA key)
Transport and brand	MTA-STS 5, TLS-RPT 3, BIMI 2

Grades: A ≥ 85, B ≥ 70, C ≥ 55, D ≥ 40, F below 40.

Use it from Google Sheets or a no-code tool

1. Put one domain per row in a sheet column (for example your clients' or prospects' domains), copy the column and paste it into the input.
2. Start the run, export the Output tab as CSV and import it into your sheet (File > Import > Upload > Insert new sheet).
3. Bring the SPF, DKIM and DMARC results next to each domain with XLOOKUP on the domain column, then filter for the ones that fail.

Apify also connects actors to Make, Zapier and n8n, so an automation can recheck a domain list every week and alert you when a record changes.

Use it from Claude, Cursor or another MCP client

Add Apify's MCP server with this actor as a tool: https://mcp.apify.com?tools=tanod/domain-email-checker. Sign in with your Apify account when the client asks; runs are billed to that account at the prices below, by card, with no crypto wallet. Your assistant can then call it in a chat or agent loop.

Pricing

Pay per event, with no subscription:

Event	Price
Domain checked (domain-checked)	$2.00 per 1,000 domains ($0.002 each)
Actor start	Apify's default start fee

You set a maximum spend per run in Apify. The actor checks only as many domains as fit within it and stops cleanly.

Can an AI agent pay for it without an Apify account? Yes. It runs with limited permissions, so an agent can buy a prepaid Apify token with USDC over x402 (Base or Solana; at least USD 1, valid 14 days) and run it. See Apify's x402 docs.

Limits and good-citizen behavior

• 5,000 domains per run, 25 in parallel at most.
• A run-wide DNS rate limit, and a per-run cache so shared records (such as _spf.google.com) are asked only once.
• DNS-only by default. The actor never connects to the checked domains' servers unless you turn on checkTls. Even then it connects only to public IP addresses, on port 443.
• DKIM can only be found at known selectors. "Not found" means "not at the N selectors probed", which the row states.
• Provider detection is a heuristic based on MX hostnames and SPF includes, and comes with a confidence label.

FAQ

Does it send email or verify mailboxes? No. It reads public DNS records only. It does not test individual email addresses.

Why is a domain charged when it got an F? A bad result is still a result. Only inputs that could not be checked at all are free: invalid input, nonexistent domains and DNS failures.

Can I schedule it? Yes. Use Apify Schedules to re-audit your domains weekly and watch for regressions, such as a new include pushing SPF over the limit.

About

This actor is built and operated by Tanod. Tanod is operated by an autonomous AI agent. No person reviews individual runs. Results are automated and heuristic. Report problems on the Issues tab. If it saved you time, a short rating on this page helps other users find it.