Email Security Audit – SPF, DKIM, DMARC, MTA-STS (bulk)

Check the e-mail security of hundreds of domains in one run. For every domain you get a 0–100 score, an A–F grade, a Google/Yahoo bulk-sender readiness flag and concrete fix recommendations – not just raw DNS records. Optionally, get a client-ready report for every domain in English or Czech, with your own brand.

Paste domains, website URLs or e-mail addresses; the Actor normalizes and de-duplicates them for you.

What it checks

Check	What you get
MX & provider	MX hosts, null-MX detection, mail provider (Google Workspace, Microsoft 365, Proton, Zoho, Seznam, …)
SPF	Record, syntax errors, multiple records, +all / ?all problems, recursive count of DNS lookups (RFC 7208 limit of 10), void lookups, include loops, deprecated ptr
DMARC	Policy, subdomain policy, pct, report addresses, fallback to the organizational domain
DKIM	Keys found on ~30 common selectors (Google, Microsoft 365, Proton, Zoho, Mailjet, SendGrid, …) + your own selectors, estimated key size (flags 1024-bit keys), revoked keys
MTA-STS	DNS record and the HTTPS policy file (mode, max_age, mx); tells an unreachable policy file apart from an invalid one
TLS-RPT	Reporting record
BIMI	Logo and certificate URLs
DNSSEC	Validation status (AD flag)
CAA	Certificate authority restrictions

Why it matters

• Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders since February 2024; unauthenticated mail is rejected or sent to spam.
• Supply-chain security questionnaires (e.g. under NIS2) increasingly ask suppliers to prove SPF/DKIM/DMARC.
• Spoofing protection: without an enforcing DMARC policy anyone can send e-mail as your domain.

Typical uses

• MSPs, IT and security consultants: audit all client domains in minutes and hand over a prioritized fix list or a branded report.
• Agencies and deliverability specialists: check sending domains before a campaign.
• Sales and lead qualification: find companies whose domains are not bulk-sender ready.
• Monitoring: schedule a weekly run with monitor mode and get only the domains whose configuration changed.

Client-ready report (white label)

Turn on Create a client-ready report and every domain gets a print-ready report you can send to a client or a manager as it is:

• Grade and one-sentence verdict in plain language
• Three key questions with a traffic light: Can someone send e-mail in your name? Do you meet Gmail, Yahoo and Outlook sender requirements? Is incoming mail protected by encryption?
• Overview of all checks with a short explanation of what each one is for
• Prioritised fixes – for each one, what it means for the business and how to fix it
• Technical details for the administrator (the actual DNS records)

Choose Neutral (no logo, small credit line) or Your brand: your company name or logo and your contact in a Want this fixed? box, with no mention of this Actor. The report link is in the reportUrl field; open it in a browser and print or save it as PDF.

Input example

{
  "domains": ["example.com", "https://www.shop.example.org/", "info@company.cz"],
  "language": "en",
  "monitorMode": true,
  "onlyChanges": false
}

With a branded client report in Czech:

{
  "domains": ["client-one.cz", "client-two.cz"],
  "language": "cs",
  "clientReport": true,
  "reportBranding": "custom",
  "reportCompanyName": "Acme IT",
  "reportLogoUrl": "https://acme.example/logo.png",
  "reportContact": "help@acme.example · acme.example"
}

Output example (shortened)

{
  "domain": "example.com",
  "score": 62,
  "grade": "C",
  "bulkSenderReady": false,
  "mx": { "provider": "Microsoft 365", "receivesMail": true },
  "spf": { "record": "v=spf1 include:spf.protection.outlook.com ~all", "valid": true, "lookupCount": 2 },
  "dmarc": { "policy": "none", "rua": [] },
  "dkim": { "selectorsFound": [{ "selector": "selector1", "keyBits": 2048 }] },
  "findings": [
    { "id": "DMARC_NONE", "severity": "medium", "title": "DMARC policy is \"none\" (monitoring only)", "recommendation": "After reviewing reports, move to \"p=quarantine\" and then \"p=reject\"…" }
  ],
  "changes": ["dmarc"],
  "reportUrl": "https://api.apify.com/v2/key-value-stores/…/records/report-example.com"
}

A run summary (counts per grade, failures, DNS queries) is saved to the key-value store as OUTPUT.

Scoring

SPF 20 · DMARC 25 · DKIM 15 · MX 5 · MTA-STS 10 · TLS-RPT 5 · DNSSEC 10 · CAA 5 · BIMI 5 points. Checks that do not apply (e.g. DKIM for a domain that does not handle mail) are excluded and the score is normalized to 100. Grades: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F < 40.

Pricing

Free during the launch period – you only pay Apify platform usage, which is a fraction of a cent per 100 domains (no proxies or browsers are used). A small pay-per-domain price is planned for 2027; any change is announced in Apify Console in advance. Invalid inputs and failed lookups will always be free.

Limitations

• DKIM selectors cannot be listed via DNS. If your provider uses a custom selector, add it to Extra DKIM selectors; otherwise "no DKIM found" means "not found on common selectors".
• bulkSenderReady is true (SPF, DKIM and DMARC verified), false (a requirement fails) or null (SPF and DMARC pass, but no DKIM key was found on common selectors – add your selector to confirm).
• Domains that publish a wildcard DKIM record (common for domains that never send mail) are reported once as dkim.wildcard, not per selector.
• Results reflect public DNS at the time of the run (via Cloudflare or Google DNS-over-HTTPS, with automatic fallback between the two).
• A failed lookup is never reported as a missing record. If MX, SPF or DMARC cannot be looked up even after a retry, the domain is returned with an error and is not charged. Other checks that fail are listed in uncheckedChecks and left out of the score.
• The Actor only reads public DNS records and the public MTA-STS policy file. It does not send e-mail or scan servers.

FAQ

Can I check subdomains? Yes. DMARC falls back to the organizational domain like real mail receivers do.

Is this legal? The Actor reads public DNS records that every mail server reads when delivering e-mail. It does not collect personal data.

Czech output? Set language to cs for Czech finding texts and a Czech client report.

Support

Built and maintained by VEmKa (Czech Republic, EU). Questions or ideas? Open an issue on the Issues tab – support in English and Czech.