Bulk DMARC, SPF & DKIM Checker – Email Authentication Audit

Audit any number of domains for email authentication in one run. For each domain you get DMARC (policy, subdomain policy, pct, rua/ruf), SPF (record, all qualifier, recursive DNS-lookup count vs. the 10-lookup limit, duplicate records), DKIM (probes ~35 common selectors plus your own, with key type and size, revoked keys, CNAME delegation), MX and detected mail provider (Google Workspace, Microsoft 365, Proofpoint...), plus MTA-STS, TLS-RPT and BIMI. Every domain also gets a 0–100 score, an A–F grade and a plain-English issues list.

It runs on DNS lookups only. No external API or key is needed, and DNS-over-HTTPS (Cloudflare, with Google as fallback) is the default for reliability.

Who uses it

• Cold-email agencies and deliverability consultants: check client and sending domains before a campaign.
• MSPs and IT agencies: audit a whole client portfolio and find upsell opportunities (no DMARC = a sales lead).
• Security teams: spot spoofable domains (no DMARC or p=none) across subsidiaries.
• Lead generation: run a list of prospect domains with onlyWithIssues to find companies that need DMARC help.

Input example

{
  "domains": [
    "example.com",
    "https://www.stripe.com",
    "info@shopify.com"
  ],
  "extraDkimSelectors": [
    "mycompany"
  ],
  "onlyWithIssues": false,
  "concurrency": 10
}

Output example

One real row (contact fields masked):

{
  "domain": "apify.com",
  "score": 100,
  "grade": "A",
  "mx": [
    "aspmx.l.google.com",
    "alt1.aspmx.l.google.com",
    "alt2.aspmx.l.google.com"
  ],
  "mailProvider": "Google Workspace",
  "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
  "spfAllQualifier": "fail",
  "spfLookupCount": 10,
  "dmarcRecord": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
  "dmarcPolicy": "reject",
  "dmarcSubdomainPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": "mailto:dmarc-reports@apify.com",
  "dmarcRuf": null,
  "dkimSelectorsFound": [
    {
      "selector": "google",
      "keyType": "rsa",
      "revoked": false,
      "keyBits": 2048
    }
  ],
  "dkimRevokedSelectors": 0,
  "mtaSts": true,
  "tlsRpt": true
}

The dataset has a table view, and you can export to CSV, Excel or JSON, or use the API, Zapier, Make or Google Sheets.

Notes

• DKIM can't be listed from DNS. The actor probes common selectors, so 'No DKIM key found' means none was found on those selectors. Add your ESP's selector if you know it.
• Accepts domains, URLs or email addresses.
• 1,000 domains take about 2–4 minutes at concurrency 10–20.

What's new (October 2026)

• Who sends mail for the domain: spfSenders maps SPF includes to services (Google Workspace, Microsoft 365, SendGrid, HubSpot, Salesforce and more).
• DNSSEC: dnssec is true when the domain validates with DNSSEC.
• fixFirst: the most important fix in plain English.

Pricing

Pay per result: $0.001 per domain ($1.00 per 1,000 domains).

How to use

1. Click Try for free (or Start) — the form is pre-filled with a small working example.
2. Adjust the filters and Max results, then run. Most runs finish in under a minute.
3. Open the Output tab to view the table, or export CSV, Excel or JSON, or pull it via the API, Zapier, Make, Google Sheets or webhooks.

FAQ

Where does the data come from? From public DNS (DNS-over-HTTPS via Cloudflare/Google). No login or API key is needed.

How fresh is it? Live: every run queries DNS at run time.

Is it legal to use? The data is public government data (or public DNS records). You are responsible for how you use it, e.g. CAN-SPAM/GDPR rules when contacting businesses.

What happens if the source is slow or down? Requests are retried with backoff. If the source fails mid-run, results already collected are kept and the run finishes with a clear status message instead of crashing. The run also stops cleanly before its timeout.

Where is the run summary? In the key-value store record OUTPUT_SUMMARY (counts, filters applied, why the run stopped).

I need a field or filter that's missing. Open an issue on the Issues tab.

Related actors

• FDA Recalls: food, drug & device enforcement reports
• USAspending Federal Awards: new contracts & grants
• Grants.gov Federal Grant Opportunities
• SEC Form D private offerings (startup funding)
• UK New Companies (Companies House)
• FMCSA new trucking carriers
• Israel Open Data (data.gov.il)

Built by Yuval Studios.

Data source & disclaimer

• Source: live public DNS records (DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT, BIMI) queried over DNS-over-HTTPS (Cloudflare and Google public resolvers).
• How fresh: real time: each run reads the current DNS, which domain owners can change at any time (subject to DNS caching/TTL). Each row has scrapedAt (when this run fetched it) and checkedAt.
• Licence & attribution: DNS records are public technical data with no licence restrictions. The score is our own heuristic, not a certification or a security audit.
• Disclaimer: Data is provided as is from public records, without warranty of any kind. Records can contain errors, omissions or delays from the source or from processing, so check anything important against the official source. This actor and its output are not legal, financial, compliance or medical advice. You are responsible for using the data lawfully: only scan domains you own, manage, or have a legitimate reason to assess, and follow CAN-SPAM/GDPR if you use results in outreach. This actor is independent and not affiliated with or endorsed by Cloudflare, Google or any email-security vendor.
• Last verified: 2026-10-19.