Email Deliverability & DNS Checker (SPF, DKIM, DMARC, MX)

Paste domains, URLs or email addresses and get a structured deliverability audit for each domain. The Actor uses DNS only (Node dns/promises Resolver; no scraping) plus the public MTA-STS HTTPS policy URL when present.

It checks:

• MX records and likely provider: Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Yahoo, Amazon SES, Mimecast, Proofpoint, Barracuda or other.
• SPF: record validity, mechanisms, all qualifier, duplicate records, recursive DNS lookup count, redirect/include loops and the RFC 7208 10-lookup limit.
• DMARC: policy (p, sp, pct), report addresses (rua, ruf), alignment (adkim, aspf) and common issues.
• DKIM: common selectors under selector._domainkey.domain, key type and approximate key size from the public key length.
• MTA-STS, TLS-RPT, BIMI and CAA records.
• A clear 0–100 score, A–F grade, human-readable issues and recommendations.

Invalid inputs and non-existent domains are returned with success: false and are not charged.

Use cases

• Email marketers: verify sender domains before campaigns and spot SPF/DMARC gaps.
• Cold outreach senders: check prospecting domains, aliases and sending infrastructure before warming up.
• MSPs and agencies: audit client mail DNS at scale during migrations to Google Workspace or Microsoft 365.
• Security audits: find domains without DMARC enforcement, reporting or strict SPF.
• Lead qualification: identify mail providers and authentication maturity for a list of companies.

Input

Field	Default	Description
domains	–	Domains to check, one per line. Accepts plain domains, URLs and email addresses. Email addresses become their domain. URL hosts are lowercased and leading www. is stripped only for URLs.
dkimSelectors	common selector list	Selector names to query under selector._domainkey.domain.
dnsServers	system resolver, fallback 1.1.1.1	Optional resolver IP addresses such as 1.1.1.1 and 8.8.8.8.
timeoutSecs	8	Per DNS/HTTPS lookup timeout, 1–30 seconds.
maxConcurrency	10	Domains checked in parallel, 1–50.

{
  "domains": ["google.com", "user@example.com", "https://www.razorpay.com", "not a domain"],
  "timeoutSecs": 8
}

Output example

One dataset item is produced per input. Example from a local run:

{
  "input": "google.com",
  "domain": "google.com",
  "success": true,
  "exists": true,
  "error": null,
  "mx": [{ "exchange": "smtp.google.com", "priority": 10 }],
  "mxProvider": "Google Workspace",
  "spf": {
    "record": "v=spf1 include:_spf.google.com ~all",
    "valid": true,
    "mechanisms": ["include:_spf.google.com", "~all"],
    "all": "~all",
    "dnsLookupCount": 1,
    "tooManyLookups": false,
    "multipleRecords": false,
    "issues": []
  },
  "dmarc": {
    "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
    "policy": "reject",
    "p": "reject",
    "sp": null,
    "pct": null,
    "rua": ["mailto:mailauth-reports@google.com"],
    "ruf": [],
    "adkim": null,
    "aspf": null,
    "issues": []
  },
  "dkim": {
    "selectorsFound": [],
    "checkedSelectors": ["google", "selector1", "selector2", "default", "k1", "k2", "k3", "s1", "s2", "mail", "dkim", "smtp", "mandrill", "mxvault", "everlytickey1", "everlytickey2", "sig1", "zoho", "protonmail", "protonmail2", "protonmail3", "fm1", "fm2", "fm3", "amazonses", "cm", "mailjet", "sendgrid"]
  },
  "mtaSts": {
    "txt": "v=STSv1; id=20210803T010101;",
    "policy": "version: STSv1\r\nmode: enforce\r\nmx: smtp.google.com\r\nmx: aspmx.l.google.com\r\nmx: *.aspmx.l.google.com\r\nmax_age: 86400\r\n",
    "mode": "enforce",
    "max_age": "86400",
    "mx": ["smtp.google.com", "aspmx.l.google.com", "*.aspmx.l.google.com"],
    "error": null
  },
  "tlsRpt": "v=TLSRPTv1;rua=mailto:sts-reports@google.com",
  "bimi": null,
  "caa": ["0  \"pki.goog\""],
  "dnssec": null,
  "score": 86,
  "grade": "B",
  "issues": ["No DKIM selector found in checked common selectors", "BIMI record not found"],
  "recommendations": ["Enable DKIM at your mail provider or add the provider-specific selector.", "Optional: publish default._bimi TXT after DMARC enforcement."],
  "checkedAt": "2026-10-06T16:27:16.246Z"
}

Pricing

Pay per event: successful, existing domains only.

Event	Price	When
Domain checked	$0.002 ($2.00 per 1,000 domains)	Charged for each valid input whose domain exists and is checked.

Invalid inputs, malformed domains and non-existent domains are free. The Actor respects your maximum cost per run and stops cleanly when the event charge limit is reached.

FAQ

Does it scrape websites? No. It uses DNS queries and, when MTA-STS is configured, fetches https://mta-sts.<domain>/.well-known/mta-sts.txt.

Why was DKIM not found? DKIM selectors are not discoverable by DNS enumeration. The Actor checks a broad common selector list; if your provider uses a custom selector, add it to dkimSelectors.

Why keep subdomains? Plain domains are checked exactly as provided. For URLs only, a leading www. is stripped to audit the organization domain behind common website URLs.

What does success mean? success: true means the input normalized to a valid domain, the domain exists by NS/SOA, and the check is chargeable. Per-record failures are captured in the result instead of crashing the run.

Is DNSSEC checked? The output includes dnssec: null; DNSSEC is intentionally skipped in this version for portability.

Changelog

• 0.1: Initial release with MX provider detection, SPF recursive lookup analysis, DMARC parsing, DKIM selector checks, MTA-STS, TLS-RPT, BIMI, CAA, scoring and pay-per-event charging.