Domain DNS & Email Security Checker

What is Domain DNS & Email Security Checker?

Domain DNS & Email Security Checker is an Apify Actor that reads the full e-mail authentication and DNS setup of any domain — SPF, DKIM, DMARC, MX, MTA-STS, BIMI, CAA, nameservers, registrar and domain age — and returns one clean, scored row per domain. Every lookup goes through Google's public DNS-over-HTTPS resolver (dns.google) and the RDAP registry service (rdap.org): no HTML parsing, no anti-bot wall, no proxy, no API key. Each domain also gets an emailSecurityScore (0-100), a grade (A-F) and an issues array in plain English — "No DMARC record", "SPF uses +all (allows anyone)" — that drops straight into a client report.

What data does Domain DNS & Email Security Checker extract?

Domain DNS & Email Security Checker extracts 33 fields per domain across e-mail authentication, DNS and registration:

Field	Type	Description
domain, resolves, ipv4, ipv6	string, boolean, array	Hostname checked (scheme and www. stripped) and what it resolves to
nameservers, dnsProvider	array, string	NS set and DNS vendor (Cloudflare, Route 53, GoDaddy, NS1, Azure DNS…)
mx, emailProvider	array, string	{priority, exchange} pairs and mailbox vendor (Google Workspace, Microsoft 365, Proton Mail, Zoho, Self-hosted…)
spfRecord, spfPolicy, spfIncludes, spfLookupCount	string, array, number	Raw v=spf1 TXT, final mechanism (-all, ~all, ?all, +all), include hosts and the RFC 7208 lookup count (over 10 fails)
emailServices	array	Sending tools authorised by SPF: SendGrid, Mailchimp, HubSpot, Salesforce, Zendesk, Klaviyo, Brevo, Amazon SES…
dmarcRecord, dmarcPolicy, dmarcSubdomainPolicy, dmarcRua, dmarcPct	string, array, number	_dmarc TXT with p=, sp=, report addresses and enforced percentage
dkimSelectorsFound	array	Probed selectors that publish a usable key
hasMtaSts, hasBimi, caaRecords	boolean, array	MTA-STS, BIMI and the CAA entries restricting certificate issuance
registrar, registeredAt, expiresAt, updatedAt, domainAgeDays, domainStatus	string, number, array	RDAP registration data, age in days and EPP status codes
emailSecurityScore, emailSecurityGrade, issues	number, string, array	Score, grade and findings
rdapError, error, scrapedAt	string	Per-source failure notes and check timestamp

How to use Domain DNS & Email Security Checker

1. Paste your domains into Domains. Bare domains, full URLs and e-mail addresses all work: https://www.apify.com/store and info@apify.com both become apify.com.
2. Leave Check DKIM selectors on. DKIM lives at unguessable record names, so it can only be found by probing; the default 16 selectors cover Google, Microsoft 365, Mailchimp, SendGrid, Zoho, Proton and Mandrill.
3. Raise Max concurrency to 10-20 for lists of thousands, click Start, then export as JSON, CSV, Excel or HTML.

Example input

{
    "domains": ["github.com", "protonmail.com", "example.com"],
    "checkDkim": true,
    "maxConcurrency": 5
}

Example output

{
    "domain": "github.com",
    "dnsProvider": "Amazon Route 53",
    "mx": [{ "priority": 0, "exchange": "github-com.mail.protection.outlook.com" }],
    "emailProvider": "Microsoft 365",
    "spfPolicy": "~all",
    "spfLookupCount": 8,
    "emailServices": ["Microsoft 365", "SendGrid", "Mailchimp", "Salesforce", "Zendesk"],
    "dmarcPolicy": "quarantine",
    "dmarcSubdomainPolicy": "reject",
    "dmarcRua": ["dmarc@github.com"],
    "dkimSelectorsFound": ["google", "selector1", "k1", "s1"],
    "hasMtaSts": false,
    "registrar": "MarkMonitor Inc.",
    "registeredAt": "2007-10-09T18:20:50.000Z",
    "domainAgeDays": 6912,
    "emailSecurityScore": 75,
    "emailSecurityGrade": "B",
    "issues": ["No MTA-STS policy record"],
    "scrapedAt": "2026-09-12T15:45:00.000Z"
}

Input parameters

Parameter	Type	Default	Description
domains	array	["apify.com"]	Domains to check, one row each
checkDkim	boolean	true	Probe DKIM selectors (16 extra DNS queries per domain)
dkimSelectors	array	16 common selectors	Names tried at <selector>._domainkey.<domain>
maxConcurrency	integer	5	Domains checked in parallel (1-20)

Pricing

Domain DNS & Email Security Checker uses pay-per-event pricing: $0.005 per domain result, i.e. $5 per 1,000 domains, plus a negligible actor-start fee, platform usage included. Each domain is about 26 small DNS queries and one RDAP call, so compute stays in the cents even for large lists. Set Maximum cost per run and the Actor trims the list to what the budget covers instead of overspending.

Domain DNS & Email Security Checker vs. MXToolbox and manual dig lookups

Domain DNS & Email Security Checker replaces one-domain-at-a-time tooling. MXToolbox, dmarcian and dig check a single domain per lookup with no structured export — scoring 800 prospects that way is a week of clicking. This Actor takes the whole list, returns a flat dataset with a score and grade per domain, and runs on a schedule so you see the day a prospect's DMARC policy changes.

Using Domain DNS & Email Security Checker with AI agents and MCP

Domain DNS & Email Security Checker is pay-per-event with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at mcp.apify.com. An agent passes domains and gets one structured row per domain back, ready for a deliverability audit or a lead-scoring step. The same run works from n8n, Make, Zapier and LangChain through Apify's integrations.

FAQ

How is the score calculated? SPF present +20, -all +10 (~all +5), 10 or fewer SPF lookups +5, DMARC present +20, p=reject +20 (quarantine +10), DKIM found +15, MTA-STS +5, BIMI +5. Grades: A ≥ 85, B ≥ 70, C ≥ 50, D ≥ 30, else F.

Why is DKIM empty on a domain that signs its mail? Selector names are arbitrary, so a custom selector is missed unless you add it to DKIM selectors to probe. A record with an empty p= value is a revoked key and is correctly reported as not found.

What are the limitations? Some TLDs run no RDAP service, so registrar and the dates come back null with a note in rdapError. Results reflect the resolver's cached view of DNS, so a change made minutes ago may not show yet. A failing domain still produces a row, with the reason in error.

Is this legal to run? Yes. DNS and RDAP records are public infrastructure data published by domain owners, and no personal data is collected.

Can I export to CSV or Excel? Yes, from the Output tab or the API, with ready-made Overview, E-mail authentication and DNS & registration views.

Related Actors

Part of the webdatatools web-intelligence suite — every Actor is pay-per-event, runs without proxies or a headless browser, and returns one clean row per entity:

Website & domain intelligence

• Website Contact & Social Extractor — e-mails, phones and social profiles per domain
• Website Tech Stack Detector — CMS, e-commerce, analytics, pixels and payments per domain
• Domain Security Audit — TLS expiry, security headers, redirect chain, robots and llms.txt
• Subdomain Finder (Certificate Transparency) — every subdomain seen in CT logs, with a live DNS check
• Bulk Core Web Vitals & PageSpeed Audit — Lighthouse scores, LCP, CLS, INP and top fixes per URL
• On-Page SEO Audit — title, meta, headings, links, images and schema issues per page
• Sitemap URL Extractor & Change Monitor — every sitemap URL, or new and removed pages between runs
• Wayback Machine Snapshot & Page Change Tracker — how a page changed over time, or every archived snapshot

Content for AI, LLMs and RAG

• AI Web Search & Read — a query turned into clean Markdown from the top search results
• Website to Markdown Crawler for LLM & RAG — any site as clean Markdown per page, no browser
• Article & News Extractor — clean article text, author, date and Markdown per URL
• Structured Data & JSON-LD Extractor — Schema.org and Open Graph data from any page
• Google News Scraper — news results by keyword, topic or site
• Press Release Monitor — PR Newswire, Business Wire and GlobeNewswire releases

Search, video and social

• Google Search Results Scraper — organic SERP results per keyword and country
• YouTube Comments Scraper — comments and replies with likes, no API key
• YouTube Channel Latest Videos — the latest 15 videos of any channel from RSS
• YouTube Channel Videos Scraper — a channel's full video, shorts and stream list
• YouTube Search Results Scraper — videos, channels and playlists per query
• YouTube Video Details Scraper — views, likes, description, tags and chapters per video
• Apple Podcasts Lookup & Episodes Scraper — podcast metadata and episodes from iTunes and RSS
• Bluesky Scraper — posts, profiles, followers and threads from the AT Protocol API

Leads, jobs and company data

• Company 360 — one row per domain: contacts, tech, security, hiring and company facts
• Hiring Signals Scraper — open jobs and hiring velocity from 10 public ATS boards
• Y Combinator Companies & Founders Scraper — YC startups by batch, industry and hiring status
• Wikidata Entity & Company Enrichment — HQ, founders, employees, revenue and social IDs per company
• Bulk Email Validator — syntax, MX, disposable, role and free-provider checks
• OpenStreetMap POI Extractor — shops and amenities by radius, bbox or area

Developer, app and research data

• npm, PyPI & Crates.io Package Health Checker — releases, downloads, deprecation and a health score
• GitHub Repository Health & Activity Report — stars, commits, contributors and risk flags per repo
• VS Code Marketplace Extension Scraper — installs, ratings and versions per extension
• Chrome Web Store Extension Scraper — users, rating, version and developer per extension
• Google Play Store Scraper — apps, ratings, installs, developer contact and reviews
• App Store (iOS) App Metadata & Top Charts — ratings, price, version and charts per app
• CrossRef DOI & Citation Metadata Lookup — papers, authors, journals and citation counts
• FDA Recalls & Adverse Events Monitor — food, drug and device recalls from openFDA
• iCal / ICS Calendar Feed to Events Extractor — any public calendar feed as event rows
• Shopify Store Products Scraper — catalog, prices, variants and stock per store

Support and feedback

Found a provider it should recognise, a DKIM selector worth adding, or a parsing bug? Open an issue on the Issues tab.