Email DNS Auditor: SPF, DKIM, DMARC, BIMI & MTA-STS

Audit email authentication for any number of domains in one run. For each domain you get a 0–100 score, an A–F grade, and a list of concrete issues with fixes. It covers SPF, DMARC, DKIM, BIMI, MTA-STS, TLS-RPT, MX and the mailbox provider.

It runs on DNS only, so there's no browser, no proxies and no login. Paste domains, URLs or even email addresses (the part after @ is used).

Why use it

• Cold email and lead gen: check prospect or sending domains before a campaign, or qualify leads by their mail provider (Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast…)
• Gmail / Yahoo bulk-sender rules: find domains with no DMARC, p=none, missing DKIM or a broken SPF
• MSPs and agencies: run a security audit across every client domain and export it to a sheet
• Spoofing risk: spoofable: true flags any domain where DMARC is missing or set to p=none
• Monitoring: schedule it daily with onlyBelowScore so you hear only about domains that slip

What it checks

Area	Details
SPF	Record, all qualifier, recursive DNS-lookup count vs the RFC 7208 limit of 10, void lookups, multiple records (permerror), +all, deprecated ptr, and recognised senders (SendGrid, Mailchimp, HubSpot, Amazon SES…)
DMARC	Policy p / sp, pct, rua / ruf report addresses, DKIM/SPF alignment, duplicate records
DKIM	Probes 44 common selectors (google, selector1/2, k1–k3, s1/s2, mandrill, zoho, protonmail, fm1–3, sendgrid…) plus your own; approximate key size, revoked keys, wildcard detection
MX	Records, null MX, mail provider detection
BIMI	Record, logo URL, VMC certificate
MTA-STS / TLS-RPT	TXT records and the live policy file mode (enforce / testing)
Extras	DNSSEC-validated flag; SaaS verification tokens found in TXT (google, facebook, atlassian, openai, stripe…), which make a handy tech-stack signal

Input

{
  "domains": ["github.com", "apify.com", "jane@stripe.com"],
  "dkimSelectors": ["mycustomselector"],
  "onlyBelowScore": 101
}

• onlyBelowScore: set it to 80 to output (and pay for) only domains graded C or worse
• onlyCustomSelectors: probe only your selectors, which is faster
• dnsTransport: auto (the default) uses plain DNS and falls back to DNS-over-HTTPS automatically

Example result

{
  "domain": "apify.com",
  "grade": "A",
  "score": 97,
  "spoofable": false,
  "mailProvider": "Google Workspace",
  "spfRecord": "v=spf1 include:_spf.google.com ... -all",
  "spfAllQualifier": "-all (fail)",
  "spfDnsLookups": 10,
  "dmarcPolicy": "reject",
  "dmarcRua": ["mailto:..."],
  "hasDkim": true,
  "dkimSelectorsFound": ["google"],
  "hasBimi": true,
  "mtaStsMode": "enforce",
  "issues": [{"severity": "warning", "area": "spf", "message": "SPF uses 10/10 DNS lookups; one more include will break it."}]
}

A SUMMARY record in the key-value store holds the grade distribution and counts of domains without SPF, DMARC or DKIM, plus spoofable domains.

Scoring

The score starts at 100 and loses points for each problem. The biggest deductions are no SPF or no DMARC (−25 each), +all (−25), SPF over 10 lookups (−20), multiple SPF records (−20), p=none (−10), no DKIM found (−10) and no DMARC reports (−5). Grades are A ≥ 90, B ≥ 80, C ≥ 65, D ≥ 50, and F below that.

DKIM can't be listed from DNS, so it's found by probing selectors. A domain that uses an unusual selector can show hasDkim: false even though it signs mail. If you know the selector, add it in dkimSelectors.

Pricing

$1.50 per 1,000 domains (pay-per-event, domain-audited). There's no start fee and you don't pay for platform usage. Domains whose DNS lookups fail are output with an error and aren't charged.

FAQ

Does it send email or connect to mail servers? No. It only does public DNS lookups, plus one HTTPS request for the MTA-STS policy file.

How fast is it? About 1,000 domains in a few minutes at the default concurrency.