Grade SPF, DMARC, and MX on up to 500 supplied domains (optional DKIM)

DMARC & Email Security Checker audits public SPF, DKIM, DMARC, MX, and related DNS records on domains you provide. Each run returns source-linked configuration evidence, issue classifications, remediation guidance, and a numerical security score with a letter grade. It does not log in to any mailbox or ESP. It is not multi-resolver A/NS/SOA propagation — that job is DNS Propagation Checker — and it is not phone-string formatting (Bulk Phone Format Validator).

From $7.00 per 1,000 results

Open DMARC & Email Security Checker on Apify

Email-auth DNS on supplied domains, not A/NS/SOA propagation or phone strings

Use this page when the job is email deliverability posture: parse SPF policy, DMARC enforcement, MX topology, and optional DKIM selectors, then grade the domain. Use DNS Propagation Checker when the job is whether A, NS, SOA, or other records agree across eight public resolvers after a change. Use Bulk Phone Format Validator when the job is E.164 normalization of phone strings you already hold.

DMARC & Email Security Checker DNS Propagation Checker Bulk Phone Format Validator
Intent Audit SPF, DMARC, MX, and optional DKIM; return a 0–100 / A–F grade Audit worldwide nameserver and record propagation Normalize user-supplied phone strings to E.164 with type detection
Input Hostnames in domains (max 500) Hostnames in domains (max 200) Phone strings in numbers (max 1000)
What it reads Public SPF, DKIM, DMARC, MX, and related DNS for email-auth review Public DNS via Node.js dns.Resolver across eight resolvers The strings you pass; google-libphonenumber runs locally, no network
Record / format focus SPF, DMARC, MX; DKIM when checkDkim is true (default) A, AAAA, MX, TXT, CNAME, NS, SOA (consistency and TTL, not policy grade) E.164 / international / national, country, line type
Primary output Per-domain score, spf, dmarc, dkim, mx Resolved values, TTL, resolver identity, consistency flags Format-validation row: validity, E.164, country, line type
Penetration / people discovery None. Passive public DNS only; no exploitation, fuzzing, or auth bypass None. Public resolver lookups only None. Does not acquire numbers or crawl profiles

The Store description is: validate domain infrastructure in bulk to boost email deliverability; extract DMARC policies, SPF records, and MX configurations to keep outreach out of spam. The README adjacent-actor note sends global resolver checks after a DMARC / SPF / DKIM change to DNS Propagation Checker.

Use cases

Published Key Features: complete email security audit (SPF, DKIM, DMARC, and MX); security scoring 0–100 with an A–F grade; DKIM multi-selector check; actionable recommendations; bulk processing up to 500 domains per run; webhook support to Slack or Discord. The published Use Cases table also lists product managers tracking competitor or market signals; the FAQ still requires authorization for any domain you scan.

Store Quickstart: start with Quickstart (Dataset) on three known domains, then Security Audit (DKIM Enabled), Weekly Portfolio Monitor, or Webhook Alert.

How is DMARC & Email Security Checker different from DNS Propagation Checker and Bulk Phone Format Validator?

This Actor audits public email-authentication DNS on domains you supply: SPF, DMARC, MX, and optional DKIM, then returns a 0–100 score with an A–F grade. Required input is domains (maximum 500). DNS Propagation Checker queries A, AAAA, MX, TXT, CNAME, NS, and SOA across eight public resolvers for hostnames in domains (maximum 200) to flag resolver disagreement and TTL variation; it is multi-resolver propagation, not email-policy parsing or grading. Bulk Phone Format Validator is offline libphonenumber formatting of phone strings in numbers (maximum 1000); it does not query DNS. Use this Actor for DMARC/SPF/MX posture on authorized domains. Use DNS Propagation Checker after a nameserver or record change. Use Bulk Phone Format Validator for E.164 hygiene.

What input is required?

domains is required. The live schema description is “List of domains to check email security for. Maximum 500 per run.” Other live schema fields:

Field Type Default Notes
domains string[] required Domains to check email security for (max 500). Schema prefill is google.com, github.com, example.com.
checkDkim boolean true Check for DKIM records (common selectors: google, default, selector1, selector2).
dkimSelectors string[] — Custom DKIM selectors. Schema description defaults: google, default, selector1, selector2, k1, dkim.
delivery string dataset dataset or webhook
webhookUrl string — POST target when delivery is webhook (Slack, Discord, or any HTTP endpoint)
concurrency integer 5 Maximum parallel requests. Higher may trigger rate limits.
dryRun boolean false Run without saving results or sending webhooks (for testing)
maxChargeUsd number 1 Safety cap for billable dataset rows in this run

The schema sets additionalProperties to false. README examples that include includeDkimSelectors or resolver are not live input fields. The README Input markdown table omits maxChargeUsd; the live schema and Actor input object example include it (default 1).

Published README input example:

{
  "domains": ["google.com", "github.com", "example.com"],
  "checkDkim": true,
  "concurrency": 5
}

Published Actor input-object example (includes schema defaults):

{
  "domains": [
    "google.com",
    "github.com",
    "example.com"
  ],
  "checkDkim": true,
  "delivery": "dataset",
  "concurrency": 5,
  "dryRun": false,
  "maxChargeUsd": 1
}

Start with Quickstart (Dataset) on three known domains. Use Security Audit (DKIM Enabled) for fuller grading. Set checkDkim to false when you only need SPF, DMARC, and MX. Use dryRun: true before larger batches or webhook delivery.

Run a DMARC and email-security check on Apify

What does a result contain?

The published README output table lists meta, results, and per-result domain, mx, spf, dmarc, dkim, score, error, and checkedAt. The published README sample is one domain row with score.total and score.grade, spf.raw / allPolicy / isStrict, dmarc.policy / isEnforced / rua, dkim selector found flags, and mx priority plus exchange. There is no published output JSON schema on the Store page.

Published README sample:

{
  "domain": "google.com",
  "score": { "total": 95, "grade": "A" },
  "spf": {
    "raw": "v=spf1 include:_spf.google.com ~all",
    "allPolicy": "~all",
    "isStrict": false
  },
  "dmarc": {
    "policy": "reject",
    "isEnforced": true,
    "rua": "mailto:mailauth-reports@google.com"
  },
  "dkim": [
    { "selector": "google", "found": true }
  ],
  "mx": [
    { "priority": 10, "exchange": "smtp.google.com" }
  ]
}

That sample is the published README illustration, not a live coverage guarantee. The README also describes source-linked configuration evidence, issue classifications, and remediation guidance. Tips say findings include links to official remediation docs for webhook payloads.

Does it check DKIM records, and which selectors?

DKIM is optional and on by default. checkDkim defaults to true. The schema description for checkDkim is “Check for DKIM records (common selectors: google, default, selector1, selector2).” dkimSelectors is an optional array of custom selectors; the schema description lists defaults google, default, selector1, selector2, k1, dkim. Key Features states a DKIM multi-selector check that tests 6 common selectors (Google, Microsoft, etc.). Set checkDkim to false to skip DKIM. Live schema names do not include includeDkimSelectors.

Is this a penetration test or a SOC2 certification?

No. The published FAQ states this Actor performs passive compliance scanning only, with no exploitation, fuzzing, or auth bypass. It produces evidence artifacts suitable for SOC2 CC7.1 (continuous monitoring) and is not itself a SOC2 certification. The README tells security and IT teams to submit domains they own or are authorized to assess, and to scan only sites they have authorization for.

Published scan cadence from the FAQ: weekly for production domains; daily if you have high config-change velocity. Webhook or Dataset API export is described as mapping well to Drata, Vanta, and OneTrust import templates. CI notes: block releases on critical severity findings using exit codes.

How is DMARC & Email Security Checker priced?

Billing is pay per event. The live Store card is from $7.00 / 1,000 results. Live Store events are Actor Start at $0.001 (charged when the Actor starts; number of events depends on Actor memory, one event per GB, minimum one event) and result at $0.007 (single result in the default dataset). You are not charged for Apify platform usage, only the fixed event price.

The README Cost section still quotes actor-start $0.01 plus dataset-item $0.003 ($3.01 for 1,000 items); live Store billing currently lists Actor Start $0.001 and result $0.007. Check the Store pricing card for the current per-event rates. maxChargeUsd defaults to 1 as a safety cap for billable dataset rows in the run. dryRun true runs without saving results or sending webhooks. delivery defaults to dataset; set delivery to webhook and provide webhookUrl to POST results.

From $7.00 per 1,000 results ($0.001 Actor Start + $0.007 per default-dataset result)

See DMARC & Email Security Checker pricing on Apify

Limits to keep in mind

Open DMARC & Email Security Checker on Apify

Related pages