# Domain DNS & Email Security Checker (`webdatatools/dns-email-security-checker`) Actor Domain DNS & Email Security Checker returns SPF, DKIM, DMARC, MX, MTA-STS, BIMI, CAA, nameservers, registrar and domain age for every domain you give it — one scored row per domain. - **URL**: https://apify.com/webdatatools/dns-email-security-checker.md - **Developed by:** [Murat Uzun](https://apify.com/webdatatools) (community) - **Categories:** Developer tools, Lead generation, SEO tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $3.00 / 1,000 results This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. - **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use). - **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`. - **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`. - **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`. - **Any other language** — the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ### What is Domain DNS & Email Security Checker? Domain DNS & Email Security Checker is an Apify Actor that reads the full e-mail authentication and DNS setup of any domain — **SPF, DKIM, DMARC, MX, MTA-STS, BIMI, CAA, nameservers, registrar and domain age** — and returns **one clean, scored row per domain**. Every lookup goes through Google's public DNS-over-HTTPS resolver (`dns.google`) and the RDAP registry service (`rdap.org`): no HTML parsing, no anti-bot wall, no proxy, no API key. Each domain also gets an `emailSecurityScore` (0-100), a grade (A-F) and an `issues` array in plain English — "No DMARC record", "SPF uses +all (allows anyone)" — that drops straight into a client report. ### What data does Domain DNS & Email Security Checker extract? Domain DNS & Email Security Checker extracts 33 fields per domain across e-mail authentication, DNS and registration: | Field | Type | Description | | -------------------------------------------------------------------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | `domain`, `resolves`, `ipv4`, `ipv6` | string, boolean, array | Hostname checked (scheme and `www.` stripped) and what it resolves to | | `nameservers`, `dnsProvider` | array, string | NS set and DNS vendor (Cloudflare, Route 53, GoDaddy, NS1, Azure DNS…) | | `mx`, `emailProvider` | array, string | `{priority, exchange}` pairs and mailbox vendor (Google Workspace, Microsoft 365, Proton Mail, Zoho, Self-hosted…) | | `spfRecord`, `spfPolicy`, `spfIncludes`, `spfLookupCount` | string, array, number | Raw `v=spf1` TXT, final mechanism (`-all`, `~all`, `?all`, `+all`), include hosts and the RFC 7208 lookup count (over 10 fails) | | `emailServices` | array | Sending tools authorised by SPF: SendGrid, Mailchimp, HubSpot, Salesforce, Zendesk, Klaviyo, Brevo, Amazon SES… | | `dmarcRecord`, `dmarcPolicy`, `dmarcSubdomainPolicy`, `dmarcRua`, `dmarcPct` | string, array, number | `_dmarc` TXT with `p=`, `sp=`, report addresses and enforced percentage | | `dkimSelectorsFound` | array | Probed selectors that publish a usable key | | `hasMtaSts`, `hasBimi`, `caaRecords` | boolean, array | MTA-STS, BIMI and the CAA entries restricting certificate issuance | | `registrar`, `registeredAt`, `expiresAt`, `updatedAt`, `domainAgeDays`, `domainStatus` | string, number, array | RDAP registration data, age in days and EPP status codes | | `emailSecurityScore`, `emailSecurityGrade`, `issues` | number, string, array | Score, grade and findings | | `rdapError`, `error`, `scrapedAt` | string | Per-source failure notes and check timestamp | ### How to use Domain DNS & Email Security Checker 1. Paste your domains into **Domains**. Bare domains, full URLs and e-mail addresses all work: `https://www.apify.com/store` and `info@apify.com` both become `apify.com`. 2. Leave **Check DKIM selectors** on. DKIM lives at unguessable record names, so it can only be found by probing; the default 16 selectors cover Google, Microsoft 365, Mailchimp, SendGrid, Zoho, Proton and Mandrill. 3. Raise **Max concurrency** to 10-20 for lists of thousands, click **Start**, then export as JSON, CSV, Excel or HTML. ### Example input ```json { "domains": ["github.com", "protonmail.com", "example.com"], "checkDkim": true, "maxConcurrency": 5 } ``` ### Example output ```json { "domain": "github.com", "dnsProvider": "Amazon Route 53", "mx": [{ "priority": 0, "exchange": "github-com.mail.protection.outlook.com" }], "emailProvider": "Microsoft 365", "spfPolicy": "~all", "spfLookupCount": 8, "emailServices": ["Microsoft 365", "SendGrid", "Mailchimp", "Salesforce", "Zendesk"], "dmarcPolicy": "quarantine", "dmarcSubdomainPolicy": "reject", "dmarcRua": ["dmarc@github.com"], "dkimSelectorsFound": ["google", "selector1", "k1", "s1"], "hasMtaSts": false, "registrar": "MarkMonitor Inc.", "registeredAt": "2007-10-09T18:20:50.000Z", "domainAgeDays": 6912, "emailSecurityScore": 75, "emailSecurityGrade": "B", "issues": ["No MTA-STS policy record"], "scrapedAt": "2026-09-12T15:45:00.000Z" } ``` ### Input parameters | Parameter | Type | Default | Description | | ---------------- | ------- | ------------------- | ------------------------------------------------------ | | `domains` | array | `["apify.com"]` | Domains to check, one row each | | `checkDkim` | boolean | `true` | Probe DKIM selectors (16 extra DNS queries per domain) | | `dkimSelectors` | array | 16 common selectors | Names tried at `._domainkey.` | | `maxConcurrency` | integer | 5 | Domains checked in parallel (1-20) | ### Pricing Domain DNS & Email Security Checker uses pay-per-event pricing: **$0.005 per domain result, i.e. $5 per 1,000 domains**, plus a negligible actor-start fee, platform usage included. Each domain is about 26 small DNS queries and one RDAP call, so compute stays in the cents even for large lists. Set **Maximum cost per run** and the Actor trims the list to what the budget covers instead of overspending. ### Domain DNS & Email Security Checker vs. MXToolbox and manual dig lookups Domain DNS & Email Security Checker replaces one-domain-at-a-time tooling. MXToolbox, dmarcian and `dig` check a single domain per lookup with no structured export — scoring 800 prospects that way is a week of clicking. This Actor takes the whole list, returns a flat dataset with a score and grade per domain, and runs on a schedule so you see the day a prospect's DMARC policy changes. ### Using Domain DNS & Email Security Checker with AI agents and MCP Domain DNS & Email Security Checker is pay-per-event with limited permissions — the two requirements for an Actor to be callable through the Apify MCP server at `mcp.apify.com`. An agent passes `domains` and gets one structured row per domain back, ready for a deliverability audit or a lead-scoring step. The same run works from n8n, Make, Zapier and LangChain through Apify's integrations. ### FAQ **How is the score calculated?** SPF present +20, `-all` +10 (`~all` +5), 10 or fewer SPF lookups +5, DMARC present +20, `p=reject` +20 (`quarantine` +10), DKIM found +15, MTA-STS +5, BIMI +5. Grades: A ≥ 85, B ≥ 70, C ≥ 50, D ≥ 30, else F. **Why is DKIM empty on a domain that signs its mail?** Selector names are arbitrary, so a custom selector is missed unless you add it to **DKIM selectors to probe**. A record with an empty `p=` value is a revoked key and is correctly reported as not found. **What are the limitations?** Some TLDs run no RDAP service, so `registrar` and the dates come back null with a note in `rdapError`. Results reflect the resolver's cached view of DNS, so a change made minutes ago may not show yet. A failing domain still produces a row, with the reason in `error`. **Is this legal to run?** Yes. DNS and RDAP records are public infrastructure data published by domain owners, and no personal data is collected. **Can I export to CSV or Excel?** Yes, from the Output tab or the API, with ready-made **Overview**, **E-mail authentication** and **DNS & registration** views. ### Related Actors Part of the **webdatatools** web-intelligence suite — every Actor is pay-per-event, runs without proxies or a headless browser, and returns one clean row per entity: **Website & domain intelligence** - [Website Contact & Social Extractor](https://apify.com/webdatatools/contact-extractor) — e-mails, phones and social profiles per domain - [Website Tech Stack Detector](https://apify.com/webdatatools/tech-stack-detector) — CMS, e-commerce, analytics, pixels and payments per domain - [Domain Security Audit](https://apify.com/webdatatools/domain-security-audit) — TLS expiry, security headers, redirect chain, robots and llms.txt - [Subdomain Finder (Certificate Transparency)](https://apify.com/webdatatools/subdomain-finder) — every subdomain seen in CT logs, with a live DNS check - [Bulk Core Web Vitals & PageSpeed Audit](https://apify.com/webdatatools/core-web-vitals-audit) — Lighthouse scores, LCP, CLS, INP and top fixes per URL - [On-Page SEO Audit](https://apify.com/webdatatools/seo-page-audit) — title, meta, headings, links, images and schema issues per page - [Sitemap URL Extractor & Change Monitor](https://apify.com/webdatatools/sitemap-extractor) — every sitemap URL, or new and removed pages between runs - [Wayback Machine Snapshot & Page Change Tracker](https://apify.com/webdatatools/wayback-page-diff) — how a page changed over time, or every archived snapshot **Content for AI, LLMs and RAG** - [AI Web Search & Read](https://apify.com/webdatatools/ai-web-search) — a query turned into clean Markdown from the top search results - [Website to Markdown Crawler for LLM & RAG](https://apify.com/webdatatools/website-to-markdown) — any site as clean Markdown per page, no browser - [Article & News Extractor](https://apify.com/webdatatools/article-extractor) — clean article text, author, date and Markdown per URL - [Structured Data & JSON-LD Extractor](https://apify.com/webdatatools/structured-data-extractor) — Schema.org and Open Graph data from any page - [Google News Scraper](https://apify.com/webdatatools/google-news-scraper) — news results by keyword, topic or site - [Press Release Monitor](https://apify.com/webdatatools/press-release-monitor) — PR Newswire, Business Wire and GlobeNewswire releases **Search, video and social** - [Google Search Results Scraper](https://apify.com/webdatatools/google-search-scraper) — organic SERP results per keyword and country - [YouTube Comments Scraper](https://apify.com/webdatatools/youtube-comments-scraper) — comments and replies with likes, no API key - [YouTube Channel Latest Videos](https://apify.com/webdatatools/youtube-channel-videos) — the latest 15 videos of any channel from RSS - [YouTube Channel Videos Scraper](https://apify.com/webdatatools/youtube-channel-scraper) — a channel's full video, shorts and stream list - [YouTube Search Results Scraper](https://apify.com/webdatatools/youtube-search-scraper) — videos, channels and playlists per query - [YouTube Video Details Scraper](https://apify.com/webdatatools/youtube-video-details) — views, likes, description, tags and chapters per video - [Apple Podcasts Lookup & Episodes Scraper](https://apify.com/webdatatools/podcast-lookup) — podcast metadata and episodes from iTunes and RSS - [Bluesky Scraper](https://apify.com/webdatatools/bluesky-scraper) — posts, profiles, followers and threads from the AT Protocol API **Leads, jobs and company data** - [Company 360](https://apify.com/webdatatools/company-360) — one row per domain: contacts, tech, security, hiring and company facts - [Hiring Signals Scraper](https://apify.com/webdatatools/hiring-signals) — open jobs and hiring velocity from 10 public ATS boards - [Y Combinator Companies & Founders Scraper](https://apify.com/webdatatools/yc-companies-scraper) — YC startups by batch, industry and hiring status - [Wikidata Entity & Company Enrichment](https://apify.com/webdatatools/wikidata-entity-enrichment) — HQ, founders, employees, revenue and social IDs per company - [Bulk Email Validator](https://apify.com/webdatatools/email-validator) — syntax, MX, disposable, role and free-provider checks - [OpenStreetMap POI Extractor](https://apify.com/webdatatools/overpass-poi-extractor) — shops and amenities by radius, bbox or area **Developer, app and research data** - [npm, PyPI & Crates.io Package Health Checker](https://apify.com/webdatatools/package-health-checker) — releases, downloads, deprecation and a health score - [GitHub Repository Health & Activity Report](https://apify.com/webdatatools/github-repo-health) — stars, commits, contributors and risk flags per repo - [VS Code Marketplace Extension Scraper](https://apify.com/webdatatools/vscode-marketplace-extensions) — installs, ratings and versions per extension - [Chrome Web Store Extension Scraper](https://apify.com/webdatatools/chrome-web-store-extensions) — users, rating, version and developer per extension - [Google Play Store Scraper](https://apify.com/webdatatools/google-play-scraper) — apps, ratings, installs, developer contact and reviews - [App Store (iOS) App Metadata & Top Charts](https://apify.com/webdatatools/app-store-lookup) — ratings, price, version and charts per app - [CrossRef DOI & Citation Metadata Lookup](https://apify.com/webdatatools/crossref-doi-lookup) — papers, authors, journals and citation counts - [FDA Recalls & Adverse Events Monitor](https://apify.com/webdatatools/openfda-recall-monitor) — food, drug and device recalls from openFDA - [iCal / ICS Calendar Feed to Events Extractor](https://apify.com/webdatatools/ical-calendar-extractor) — any public calendar feed as event rows - [Shopify Store Products Scraper](https://apify.com/webdatatools/shopify-products-scraper) — catalog, prices, variants and stock per store ### Support and feedback Found a provider it should recognise, a DKIM selector worth adding, or a parsing bug? Open an issue on the **Issues** tab. # Actor input Schema ## `domains` (type: `array`): Enter the domains to check, one row is returned per domain, e.g. apify.com. Full URLs and www. prefixes are accepted and stripped automatically (https://www.apify.com/store becomes apify.com), so you can paste a list straight out of your CRM. ## `checkDkim` (type: `boolean`): Keep this on to probe common DKIM selectors such as google and selector1. DKIM has no discoverable record name, so it can only be found by guessing selectors; turning this off makes each domain 16 DNS queries cheaper but drops 15 points from the score. ## `dkimSelectors` (type: `array`): Enter the DKIM selectors to try, e.g. google, selector1, k1. Each one is looked up as .\_domainkey.. Leave the defaults unless you know the provider your targets use; a shorter list means fewer DNS queries per domain. ## `maxConcurrency` (type: `integer`): Enter how many domains to check in parallel, e.g. 5. Each domain needs roughly 26 DNS queries plus one RDAP call; raise this to 10-20 for lists of thousands of domains, lower it to 1-2 if the resolver starts rate-limiting you. ## Actor input object example ```json { "domains": [ "apify.com", "github.com" ], "checkDkim": true, "dkimSelectors": [ "google", "selector1", "selector2", "default", "k1", "s1", "zoho", "mail" ], "maxConcurrency": 5 } ``` # Actor output Schema ## `domains` (type: `string`): All checked domains — download as JSON, CSV, Excel or HTML. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "apify.com", "github.com" ], "checkDkim": true, "dkimSelectors": [ "google", "selector1", "selector2", "default", "k1", "s1", "zoho", "mail" ], "maxConcurrency": 5 }; // Run the Actor and wait for it to finish const run = await client.actor("webdatatools/dns-email-security-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "apify.com", "github.com", ], "checkDkim": True, "dkimSelectors": [ "google", "selector1", "selector2", "default", "k1", "s1", "zoho", "mail", ], "maxConcurrency": 5, } # Run the Actor and wait for it to finish run = client.actor("webdatatools/dns-email-security-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "apify.com", "github.com" ], "checkDkim": true, "dkimSelectors": [ "google", "selector1", "selector2", "default", "k1", "s1", "zoho", "mail" ], "maxConcurrency": 5 }' | apify call webdatatools/dns-email-security-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,webdatatools/dns-email-security-checker" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/bUdlJZmG1HcFViqgu/builds/6fNgABO8UzXCwtEWY/openapi.json