Email Deliverability & DNS Health Checker

A fast, no-browser check of the DNS records that control email deliverability and anti-spoofing protection. Point it at one or more domains and get back SPF, DKIM, DMARC, and MX record status -- plus a letter grade, a 0-100 score, a severity tag, and a plain-English issue list.

What you get, per domain

• A letter grade (A+ to F) and 0-100 score summarizing email/DNS health at a glance
• A one-line executive summary ("4 issue(s) found -- review recommended")
• A severity tag -- critical (no MX, or SPF wide open with +all), warning (missing DKIM/DMARC or other issues), or ok -- for instant triage
• MX records -- confirms the domain can actually receive email, and lists mail servers by priority
• SPF -- whether a Sender Policy Framework record exists, whether there's more than one (invalid), and how strict its all mechanism is
• DMARC -- whether a policy exists at _dmarc.[domain], and whether it's set to monitor-only (p=none), quarantine, or reject
• DKIM -- checks a configurable list of common selectors (Google Workspace, generic default/selector1/selector2, etc.) for a published key. Add your provider's selector for a fully accurate result
• Domains are checked in parallel (configurable, up to 20 at once), and each domain's own MX/SPF/DMARC/DKIM lookups also run concurrently, so a batch of 50 domains finishes in a fraction of the time a one-by-one check would take

Why this instead of checking manually

	Manual spot-checks	Email Deliverability & DNS Checker
Coverage	One domain at a time, in a DNS lookup tool	Every domain you list, automatically
Speed	Minutes per domain across multiple tools	Seconds, via parallel checking
Triage	You interpret raw TXT records yourself	Pre-classified severity + letter grade
Repeatability	Forgotten until mail starts landing in spam	One click, or schedule it
Output	Notes across several browser tabs	Structured dataset, exportable to CSV/JSON/BI tools

Who this is for

• Developers and marketers setting up a new sending domain who want to confirm SPF/DKIM/DMARC are live before sending
• Teams debugging why their email is landing in spam
• Agencies auditing a client's domains for spoofing protection
• Anyone wiring a periodic DNS-drift check into a scheduled monitor (DNS records get misconfigured more often than you'd think)

How to use it

1. Add one or more domains to check (e.g. example.com).
2. If you know your mail provider's DKIM selector, add it to DKIM selectors to check for a more accurate result -- otherwise the common defaults are checked.
3. Tune concurrency (default 5) to trade speed for gentleness on slow DNS resolvers.
4. Run it once for a snapshot, or put it on an Apify Schedule to catch a dropped SPF/DMARC record before it hurts deliverability.

Example output (one item)

{
  "domain": "example.com",
  "score": 45,
  "grade": "F",
  "severity": "warning",
  "summary": "3 issue(s) found -- review recommended.",
  "issueCount": 3,
  "issues": [
    "No SPF record found -- other mail servers can't verify mail claiming to be from this domain.",
    "No DMARC record found -- no policy exists for handling spoofed mail from this domain.",
    "No DKIM record found for the checked selectors (default, google, selector1, selector2, k1, mail, dkim). DKIM may still be active under a different, unchecked selector."
  ],
  "hasMx": true,
  "mxRecords": ["mail.example.com (priority 10)"],
  "hasSpf": false,
  "hasDmarc": false,
  "dkimSelectorsFound": [],
  "checkedAt": "2026-08-22T00:00:00.000Z"
}

Pricing

This Actor uses pay-per-event pricing:

• Domain checked -- charged once per domain processed, covering the MX, SPF, DMARC, and DKIM-selector lookups for that domain.

Parallel checking doesn't cost more -- it just finishes faster.

FAQ

Why can't it find my DKIM record even though DKIM is set up? DKIM records are published under a selector chosen by your mail provider (e.g. google._domainkey.example.com), and there's no DNS way to discover that selector automatically. This Actor checks a list of common selectors -- add your specific one in the input for a reliable result.

Does a low score mean my domain is broken? Not necessarily. Domains that don't send email at all (parked domains, for example) don't need SPF/DKIM/DMARC. The score is most meaningful for domains that actively send mail.

What makes something "critical" vs. a "warning"? critical covers active exposure: no MX records (mail can't be received) or an SPF record ending in +all (anyone can send mail as your domain). warning covers everything else that lowers the score, most commonly a missing DKIM selector or DMARC record -- worth fixing, but not an active spoofing free-for-all.

Will higher concurrency get me rate-limited? DNS resolvers can rate-limit aggressive querying. Start at the default (5) and lower it if you see lookups start failing for a particular batch.

Does this send any data anywhere besides your own Apify account? No. It only performs standard DNS lookups (TXT and MX records) for the domains you provide and returns what it finds -- no login, no third-party analytics calls.