Email & Domain Auth Checker: MX, SPF, DKIM & DMARC

Check whether an email address or domain is set up to send and receive mail properly — MX, SPF, DKIM and DMARC — using DNS alone. It reports the domain's authentication posture, which is a different and more reliable question than whether one particular mailbox exists.

1. Why use Email & Domain Auth Checker

Two problems get confused with each other. The first is "will mail to this address bounce". The second is "is this domain configured so its own mail reaches inboxes rather than spam folders". They have different answers and different fixes.

Mailbox-existence checks try to answer the first by opening an SMTP conversation with the receiving server. Most large providers deliberately give unreliable answers to that, and being seen probing mailboxes is itself reputationally costly.

The second question is answerable from public DNS, definitively, with no probing at all. A domain with no SPF record, or a DMARC policy set to none, has a measurable deliverability problem you can act on. This Actor answers that question — for your own domains, or for a list you are cleaning before import.

2. Key features

• DNS only. No SMTP conversation, no mailbox probing, nothing that could affect your sending reputation.
• Five typed statuses that separate "no mail records" from "DNS itself failed" — a timeout is never reported as a missing record.
• RFC 7505 null-MX handling. A domain that explicitly declares it accepts no mail is identified as such, not as a lookup failure.
• SPF with policy qualifier. Reports not just presence but the qualifier on the all mechanism — the difference between a strict and a permissive record.
• DMARC with policy. Reports none, quarantine or reject, which is what actually determines enforcement.
• DKIM selector checking, with your own selector supported.
• Disposable and role-address flags for throwaway domains and addresses like info@ or admin@.
• Plain-language summary per result, alongside the structured fields.
• Bulk checking of a whole list in one run.

3. Who it's for

For marketing and email operations. Before a campaign, check your own sending domains and confirm SPF is strict and DMARC is enforcing rather than none — the two settings most often left permissive after an initial setup.

For sales and revenue operations. Clean a purchased or imported lead list: flag disposable domains and role addresses before they enter the CRM and depress your deliverability metrics.

For IT and security. Audit every domain your organisation owns, including the parked ones. A domain with no DMARC record is a spoofing opportunity whether or not it sends mail.

For developers and AI agents. Call it at signup: branch on status and disposable to decide whether to accept, challenge or reject a registration, without ever touching SMTP.

4. How to use it

1. Open the Actor and click Try for free.
2. Put emails or bare domains in the Inputs field, one per line. Both forms work.
3. Optionally set a DKIM selector if you know the one your provider uses.
4. Click Start.
5. Open the Output tab. Filter on status or disposable to isolate problems.

5. Input parameters

Field	Type	Required	Default	Description
inputs	array of strings	Yes	["user@google.com","mailinator.com"]	Emails or bare domains to check. Both forms accepted; an email is reduced to its domain for the DNS checks.
dkimSelector	string	No	—	A DKIM selector to check. DKIM has no DNS-discoverable selector directory, so without this only a handful of common selectors are tried.

6. Output

{
  "input": "user@example.com",
  "domain": "example.com",
  "status": "OK",
  "syntaxValid": true,
  "hasMX": true,
  "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com"],
  "disposable": false,
  "roleAddress": false,
  "spf": { "present": true, "record": "v=spf1 include:_spf.google.com ~all", "policy": "~all" },
  "dmarc": { "present": true, "record": "v=DMARC1; p=quarantine", "policy": "quarantine" },
  "dkim": { "selectorsChecked": ["google", "default", "selector1"], "found": ["google"] },
  "summary": "Accepts mail. SPF present (soft fail). DMARC quarantine. DKIM found."
}

Every input produces exactly one result.

7. Output fields

Field	Meaning
input	The email or domain exactly as supplied.
domain	The domain the checks ran against. For an email, the part after the @.
status	Overall outcome. See below.
syntaxValid	Whether the input parsed as a valid email or domain.
hasMX	Whether the domain publishes usable MX records.
mxHosts	The MX hostnames found.
disposable	Whether the domain is a known throwaway/temporary mail provider.
roleAddress	Whether the local part is a role address (info@, admin@, support@ and similar) rather than a person.
spf.present / spf.record	Whether an SPF record exists, and its raw text.
spf.policy	The qualifier on the all mechanism: -all (hard fail), ~all (soft fail), ?all (neutral), +all (passes everything — effectively no protection).
dmarc.present / dmarc.record	Whether a DMARC record exists, and its raw text.
dmarc.policy	none, quarantine or reject. none means monitoring only — it does not stop anything.
dkim.selectorsChecked	Which selectors were queried.
dkim.found	Which of those returned a key.
summary	A one-line plain-language reading of the result.

Status values

Status	Meaning
OK	The domain accepts mail and every check completed.
INVALID_INPUT	Could not be parsed as an email or domain.
UNRESOLVABLE	The domain does not exist at all (NXDOMAIN).
NO_MX	The domain resolves but publishes no usable MX — including an RFC 7505 "null MX" record, which explicitly declares that it accepts no mail.
LOOKUP_ERROR	DNS itself failed — a timeout or SERVFAIL. Never conflated with "no records exist"; this is the case to retry.

8. How it works

Each input is parsed, and an email is reduced to its domain. MX, SPF (a TXT lookup), DMARC (a TXT lookup at _dmarc.<domain>) and DKIM selector records are then queried from DNS.

SPF and DMARC records are parsed rather than merely detected, so the qualifier and the policy are reported rather than a bare present/absent flag. DKIM is checked against a small set of common selectors plus any selector you supply — DNS offers no way to enumerate selectors, which is why supplying yours materially improves that field.

Inputs are processed with a concurrency of 5. A DNS failure is distinguished from an absent record throughout, which is why LOOKUP_ERROR exists as a separate status.

9. API & MCP usage

cURL

curl -X POST "https://api.apify.com/v2/acts/apifmcpfactory~email-domain-checker/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"inputs":["user@example.com","example.org"]}'

As an Apify MCP tool. This Actor is callable directly by AI agents such as Claude and Cursor. Usage bills through your own Apify account.

https://mcp.apify.com?tools=apifmcpfactory/email-domain-checker

Claude Desktop (claude_desktop_config.json):

{
    "mcpServers": {
        "email-domain-checker": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com?tools=apifmcpfactory/email-domain-checker",
                "--header",
                "Authorization: Bearer YOUR_APIFY_TOKEN"
            ]
        }
    }
}

As a standalone MCP server. The same checks run as a dedicated hosted MCP server, with check_email_domain for one input and bulk_check_email_domain for up to 100. See the product page for that endpoint.

10. Pricing

$0.005 per email or domain checked, billed per input written to the dataset. A 1,000-address list costs $5.00.

11. Limits & performance

Memory	256 MB
Concurrency	5 inputs in parallel
Lookups per input	MX, SPF, DMARC, plus one per DKIM selector
Throughput	Bounded by DNS response time

12. Limitations

• No SMTP verification. This reports auth-record posture, not mailbox existence. It cannot tell you whether a specific mailbox is real, and deliberately does not try.
• DKIM selectors cannot be enumerated. DNS provides no directory of selectors. An empty dkim.found means the common selectors did not match — not that DKIM is absent. Supply your own selector for a definitive answer.
• A valid configuration is not a guarantee of inbox placement. Content, sending history and recipient-side filtering all matter and are outside DNS.
• Disposable-domain lists age. New throwaway providers appear constantly; a false means "not on our list".
• Role-address detection is pattern-based on the local part, and a real person can legitimately sit behind sales@.
• DNS is a snapshot. Records change; a result describes the moment it was taken.

13. FAQ

Does this tell me if an email address exists? No, and that is deliberate. It reports whether the domain is configured to accept and authenticate mail. Mailbox existence requires an SMTP probe, which large providers answer unreliably and which can harm your sending reputation.

Does it check SPF, DKIM and DMARC? Yes, all three, and it parses them — you get SPF's all qualifier and DMARC's policy, not just presence.

What does an SPF policy of ~all mean? Soft fail: unauthorised senders are marked suspicious rather than rejected. -all is a hard fail and is stricter. +all passes everything and offers effectively no protection.

My DMARC record exists but mail is still spoofed — why? Check dmarc.policy. A policy of none is monitoring only; it reports but does not block. Enforcement requires quarantine or reject.

Why is dkim.found empty when I know DKIM is set up? DNS cannot enumerate selectors, so only common ones are tried. Supply your provider's selector in dkimSelector.

What is a null MX? An RFC 7505 record by which a domain explicitly declares it accepts no mail. It is reported as NO_MX — a deliberate configuration, not an error.

What is the difference between NO_MX and LOOKUP_ERROR? NO_MX means DNS answered and there are no usable mail records. LOOKUP_ERROR means DNS did not answer. The first is a finding; the second is a retry.

Does it detect disposable email addresses? Yes, against a bundled list of known throwaway providers, reported as disposable.

GDPR & lawful use

Only public DNS records are queried — no mailbox is contacted, no message is sent, and nothing is stored beyond your own run's dataset. Email addresses supplied as input are reduced to their domain for every check.

More tools from MCP Factory

• IBAN Validator — offline ISO 13616 IBAN checksum and structure validation.
• EU VAT Validator — validate EU VAT numbers against the official VIES registry.
• Sanctions Screening — screen names against official OFAC, EU, UK and UN sanctions lists in bulk.

— A Howth Technology Factory tool. Official sources, nothing stored.