Bulk Email Deliverability Auditor — SPF, DKIM, DMARC

Audit the DNS records that decide whether your email lands, across thousands of domains at once — with a graded score and a plain-English list of what is broken.

Everything here is a DNS lookup: no HTTP, no browser, no API key. That is why a full four-record audit costs a fraction of a cent per domain.

What you get

{
  "domain": "stripe.com",
  "grade": "A",
  "deliverabilityScore": 100,
  "acceptsEmail": true,
  "mxProvider": "Google Workspace",
  "hasSpf": true,
  "spfPolicy": "fail",
  "hasDmarc": true,
  "dmarcPolicy": "reject",
  "hasDkim": true,
  "issues": [],
  "spf": { "includes": ["_spf.google.com"], "dnsLookupCount": 4, "exceedsLookupLimit": false },
  "dmarc": { "policy": "reject", "percentage": 100, "rua": "mailto:dmarc@stripe.com" },
  "dkimSelectorsFound": ["google"]
}

Main use cases

• Lead-list hygiene. Drop domains with no MX before you send — they cannot receive mail at all.
• Cold outreach QA. Check your own sending domains before a campaign.
• Security and M&A due diligence. A domain with no DMARC is trivially spoofable.
• Agency audits. Grade a whole client portfolio in one run and export the problems as CSV.
• Monitoring. Schedule it to catch the day someone edits an SPF record and breaks sending.

What it actually checks

Record	Why it matters
MX	Whether the domain can receive mail at all, plus which provider runs it
SPF	Which servers may send as the domain. Flags +all (anyone may send) and the 10-lookup limit, past which receivers return permerror and SPF silently stops working
DMARC	What receivers should do on failure. Flags p=none (monitoring only), partial pct=, and a missing rua reporting address
DKIM	Signing keys, probed across the selectors Google, Microsoft, Zoho, Proton, Mailchimp and others use

The SPF 10-lookup check is the one most tools miss — a record can look perfect and still fail in production because it needs 11 lookups.

Pricing

Event	Price	When
Domain audited	$0.0015	One domain with all four record types checked

Not charged for: unparseable input, or domains where every DNS lookup failed.

1,000 domains = $1.50.

Input

Field	Type	Default	Notes
domains	array	required	Domain, URL or email address — all accepted. Up to 5,000.
dkimSelectors	array	14 common ones	DNS cannot enumerate selectors, so we probe known ones. Add yours if you know them.
concurrency	integer	8	Parallel lookups.

Limitations

• DKIM detection is best-effort. DNS provides no way to list a domain's selectors, so a domain using a custom selector will show hasDkim: false even though DKIM works. Supply your selector to confirm.
• This audits configuration, not reputation. It does not check blocklists, IP reputation or inbox placement, and cannot promise your mail reaches the inbox.
• Records are read live from public resolvers (1.1.1.1, 8.8.8.8); very recent DNS edits may still be cached upstream.

Related Actors

• Website Brand & Favicon Extractor — enrich the same domain list with brand assets.
• SSL Certificate & Security Header Audit — the TLS half of the same due-diligence job.

Reliability

• Retries on 429 and 5xx with exponential backoff; permanent 4xx errors are not retried.
• Bad input is reported and skipped, never charged.
• One failing target never aborts the rest of the run.
• Concurrency is bounded and configurable — this work is network-bound, so parallel requests, not memory, are what control speed.

Data source and responsible use

Reads only publicly available data. No authentication bypass, no CAPTCHA circumvention, no browser automation.

Not affiliated with any of the services checked.