# Bulk Email Deliverability Checker - SPF, DKIM, DMARC, MX (`codeblix/email-deliverability-checker`) Actor

Audit thousands of domains for email authentication, DNS issues, and deliverability risk. Checks SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT, BIMI. No login, no proxy, no API keys needed.

- **URL**: https://apify.com/codeblix/email-deliverability-checker.md
- **Developed by:** [Jayesh Choolun](https://apify.com/codeblix) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 domain checkeds

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Bulk Email Deliverability Checker — SPF, DKIM, DMARC, MX

> Audit thousands of domains for email authentication, DNS security, and deliverability risk. Check SPF, DKIM, DMARC, MX records, DNSSEC, MTA-STS, TLS-RPT, and BIMI in bulk. No proxy, no login, no API keys required — pure DNS queries.

### Why email deliverability matters

Email authentication failures cost businesses real money. Domains without SPF, DKIM, and DMARC are vulnerable to spoofing, phishing, and spam filtering. Cold emails from unauthenticated domains land in spam. Google and Yahoo now **require** DMARC for bulk senders (2024 enforcement). This actor lets you audit any domain portfolio in seconds.

### What it checks

| Check | Description |
|-------|-------------|
| **MX records** | Mail exchange records + email provider detection (Google Workspace, Microsoft 365, Zoho, SendGrid, Mailgun, ProtonMail, and 15+ others) |
| **SPF** | Sender Policy Framework validation — single record check, `all` mechanism, DNS lookup count (RFC 7208 limit), `+all` danger detection |
| **DKIM** | DomainKeys Identified Mail public key probing across 14+ common selectors (google, default, selector1, selector2, k1, sendgrid, mailgun, etc.) |
| **DMARC** | Domain-based Message Authentication parsing — policy (none/quarantine/reject), subdomain policy, percentage, rua/ruf report destinations |
| **DNSSEC** | DNS Security Extensions — zone signing check via DO-flag UDP query (fast, no DNSKEY round-trip) |
| **MTA-STS** | SMTP MTA Strict Transport Security — TXT record + HTTPS policy file validation |
| **TLS-RPT** | TLS Reporting — failure report destination at `_smtp._tls` |
| **BIMI** | Brand Indicators for Message Identification — logo authentication record |
| **Security headers** | Optional: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |

### Output

Each domain produces a dataset item with:

- `domain` — the domain name
- `score` — 0-100 deliverability score
- `grade` — letter grade (A through F)
- `emailProvider` — detected email provider (Google Workspace, Microsoft 365, Zoho, etc.)
- `spfValid` — boolean
- `dmarcPolicy` — none / quarantine / reject
- `dkimPresent` — boolean
- `dkimSelectorsFound` — list of selectors with public keys
- `dnssecEnabled` — boolean
- `mtaStsPresent` — boolean
- `tlsRptPresent` — boolean
- `bimiPresent` — boolean
- `criticalIssues` — list of critical problems
- `warnings` — list of non-critical issues
- `recommendations` — actionable fix suggestions
- `issuesCount` — total issue count
- Full nested details under `mx`, `spf`, `dmarc`, `dkim`, `dnssec`, `mtaSts`, `tlsRpt`, `bimi`

A `SUMMARY` key-value store entry contains aggregate stats: total domains, average score, grade distribution, throughput.

#### Example output

```json
{
  "domain": "cloudflare.com",
  "score": 92,
  "grade": "A",
  "emailProvider": "Other / Unknown",
  "spfValid": true,
  "dmarcPolicy": "reject",
  "dkimPresent": true,
  "dkimSelectorsFound": ["k1", "mandrill", "s1"],
  "dnssecEnabled": true,
  "mtaStsPresent": false,
  "tlsRptPresent": false,
  "bimiPresent": true,
  "criticalIssues": [],
  "warnings": ["MTA-STS not configured."],
  "recommendations": ["Configure MTA-STS to enforce TLS for inbound SMTP."],
  "issuesCount": 1
}
```

### Scoring

| Component | Points |
|-----------|--------|
| MX records present | 15 |
| SPF present + valid | 25 |
| DMARC present + enforced | 25 |
| DKIM present | 15 |
| DNSSEC enabled | 10 |
| MTA-STS configured | 5 |
| TLS-RPT configured | 3 (bonus) |
| BIMI configured | 2 (bonus) |
| **Maximum** | **100** |

Grades: A (90+), B (80-89), C (70-79), D (60-69), E (40-59), F (<40)

### Input

| Field | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `domains` | array\[string] | One of `domains`/`domainsText` | — | List of domains to check |
| `domainsText` | string | One of `domains`/`domainsText` | — | Newline or comma-separated domains for bulk paste (10,000+) |
| `dkimSelectors` | array\[string] | No | 14 common selectors | DKIM selector names to probe |
| `checkDNSSEC` | boolean | No | true | Check DNSSEC |
| `checkMTASTS` | boolean | No | true | Check MTA-STS + TLS-RPT |
| `checkBIMI` | boolean | No | true | Check BIMI |
| `checkSecurityHeaders` | boolean | No | false | Check HTTPS security headers |
| `timeout` | integer | No | 10 | DNS query timeout (seconds) |
| `concurrency` | integer | No | 10 | Concurrent domain checks (1-100) |
| `dnsResolver` | string | No | system default | Custom DNS resolver IP (e.g. 1.1.1.1) |

### Use cases

- **Cold email agencies**: Audit client domains before outreach campaigns — ensure SPF, DKIM, and DMARC are configured so emails land in inbox, not spam
- **SEO agencies**: Add email deliverability auditing to client reports as a value-add service
- **Lead generation teams**: Filter prospect domains by deliverability score — skip domains that can't receive email
- **Security teams**: Bulk-check domain portfolios for spoofing risk and DMARC enforcement gaps
- **Domain investors**: Assess domain email infrastructure quality before purchase
- **SaaS operations**: Monitor your own domain's email authentication posture over time
- **Compliance audits**: Verify Google/Yahoo 2024 bulk sender requirements across all sending domains
- **MSPs**: Audit all client domains as part of onboarding security checks

### Performance

- \~0.1s per domain (all DNS checks run in parallel per domain)
- \~6-25 domains/second depending on concurrency
- No proxy needed — pure DNS queries
- No API keys needed
- No login required
- Scales to 10,000+ domains per run
- Python 3.12, Apify SDK 3.x, dnspython 2.x

### Pricing

Pay-per-event: **$0.001 per domain checked**. You only pay for results delivered. No subscription, no minimum. Check 1 domain for $0.001 or 10,000 domains for $10.

### How it works

1. Provide a list of domains (via `domains` array or paste into `domainsText`)
2. The actor queries DNS records for each domain in parallel
3. For each domain, it checks MX, SPF, DMARC, DKIM (14 selectors), DNSSEC, MTA-STS, TLS-RPT, and BIMI
4. Results are scored 0-100 with letter grades and actionable recommendations
5. All results are pushed to the Apify dataset as structured JSON
6. A summary with aggregate stats is saved to the key-value store

### Categories

SEO tools, Business, Lead generation, Developer tools

# Actor input Schema

## `domains` (type: `array`):

List of domain names to audit (e.g. example.com, google.com). Either this or 'domainsText' must be provided.

## `domainsText` (type: `string`):

Alternative to 'domains': paste a large list of domains, one per line or comma-separated. Useful for bulk uploads of 10,000+ domains.

## `dkimSelectors` (type: `array`):

DKIM selector names to check for DKIM public keys. The actor will query <selector>.\_domainkey.<domain> for each. Defaults cover Google, Microsoft, SendGrid, Mailgun, Zoho, and others.

## `checkDNSSEC` (type: `boolean`):

Query DNSSEC status for each domain. Adds a small amount of time per domain.

## `checkMTASTS` (type: `boolean`):

Fetch and validate MTA-STS policy (\_mta-sts TXT + HTTPS policy file) and TLS-RPT (\_smtp.\_tls TXT). Adds 1-2 HTTP requests per domain.

## `checkBIMI` (type: `boolean`):

Check for BIMI (Brand Indicators for Message Identification) record at default.\_bimi.<domain>.

## `checkSecurityHeaders` (type: `boolean`):

Fetch the domain over HTTPS and inspect security headers (HSTS, CSP, X-Frame-Options, etc.). Adds 1 HTTP request per domain.

## `timeout` (type: `integer`):

Timeout for each DNS query in seconds. Increase for slow resolvers.

## `concurrency` (type: `integer`):

Number of domains to check in parallel. Higher = faster but may hit local resolver rate limits.

## `dnsResolver` (type: `string`):

IP address of a DNS resolver to use instead of the system default (e.g. 1.1.1.1 for Cloudflare, 8.8.8.8 for Google). Leave empty to use system default.

## Actor input object example

```json
{
  "domains": [
    "google.com",
    "github.com"
  ],
  "dkimSelectors": [
    "google",
    "default",
    "selector1",
    "selector2",
    "k1",
    "mail",
    "smtp",
    "sendgrid",
    "mandrill",
    "mailgun",
    "zoho",
    "dkim",
    "s1",
    "selector"
  ],
  "checkDNSSEC": true,
  "checkMTASTS": true,
  "checkBIMI": true,
  "checkSecurityHeaders": false,
  "timeout": 10,
  "concurrency": 10,
  "dnsResolver": ""
}
```

# Actor output Schema

## `dataset` (type: `string`):

Dataset containing one item per domain with deliverability score, grade, and full check details

## `summary` (type: `string`):

Key-value store entry with aggregate stats (total domains, average score, grade distribution)

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "google.com",
        "github.com"
    ],
    "dkimSelectors": [
        "google",
        "default",
        "selector1",
        "selector2",
        "k1",
        "mail",
        "smtp",
        "sendgrid",
        "mandrill",
        "mailgun",
        "zoho",
        "dkim",
        "s1",
        "selector"
    ],
    "checkDNSSEC": true,
    "checkMTASTS": true,
    "checkBIMI": true,
    "timeout": 10,
    "concurrency": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("codeblix/email-deliverability-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "google.com",
        "github.com",
    ],
    "dkimSelectors": [
        "google",
        "default",
        "selector1",
        "selector2",
        "k1",
        "mail",
        "smtp",
        "sendgrid",
        "mandrill",
        "mailgun",
        "zoho",
        "dkim",
        "s1",
        "selector",
    ],
    "checkDNSSEC": True,
    "checkMTASTS": True,
    "checkBIMI": True,
    "timeout": 10,
    "concurrency": 10,
}

# Run the Actor and wait for it to finish
run = client.actor("codeblix/email-deliverability-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "google.com",
    "github.com"
  ],
  "dkimSelectors": [
    "google",
    "default",
    "selector1",
    "selector2",
    "k1",
    "mail",
    "smtp",
    "sendgrid",
    "mandrill",
    "mailgun",
    "zoho",
    "dkim",
    "s1",
    "selector"
  ],
  "checkDNSSEC": true,
  "checkMTASTS": true,
  "checkBIMI": true,
  "timeout": 10,
  "concurrency": 10
}' |
apify call codeblix/email-deliverability-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=codeblix/email-deliverability-checker",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/acts/oxpbHN3GdV729HBoH/builds/WxuFOhvYvaEc09EhX/openapi.json