# Email Deliverability & Domain Posture Auditor (`gp005/email-deliverability-auditor`) Actor

Audit email deliverability and domain posture in bulk: MX, SPF, DKIM (common selectors), DMARC policy, DNSSEC, MTA-STS, TLS-RPT, and BIMI. Returns a 0-100 posture score, a prioritized fix list, and per-record detail. Pure DNS-over-HTTPS — no scraping, no API keys.

- **URL**: https://apify.com/gp005/email-deliverability-auditor.md
- **Developed by:** [Geo](https://apify.com/gp005) (community)
- **Categories:** Developer tools, Marketing
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $21.00 / 1,000 domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Email Deliverability & Domain Posture Auditor

> Bulk audit email deliverability posture: **MX · SPF · DKIM · DMARC · DNSSEC · MTA-STS · TLS-RPT · BIMI** — with a 0–100 score and a prioritized fix list.

Audit a single domain or thousands. Pure **DNS-over-HTTPS** — no scraping, no proxies, no API keys. Built for **cold-email teams, IT/security teams, email-marketing agencies, and MSPs** who need to keep customer domains out of the spam folder.

### What it checks

| Area | What we look for | Why it matters |
|---|---|---|
| **MX** | Mail-exchange records present and valid | Without MX, the domain can't receive mail at all |
| **SPF** | TXT record at apex, `v=spf1`, includes, the `all=` policy, +all hazard, >10 lookups | Receiving servers reject spoofed mail from non-listed IPs |
| **DKIM** | Probes common selectors (`google`, `default`, `selector1`, `selector2`, `s1`, `k1`, `mail`, …) for public signing keys | Cryptographic email signing — stops tampering and verifies sender |
| **DMARC** | `_dmarc` TXT: policy `p=` (none/quarantine/reject), `sp`, `pct`, `rua` reporting | The master policy that tells receivers what to do with mail that fails SPF/DKIM |
| **DNSSEC** | Authentic-Data flag on queries | Cryptographic chain of trust for DNS — stops cache poisoning |
| **MTA-STS** | `_mta-sts` TXT + policy file at `mta-sts.<domain>/.well-known/mta-sts.txt` (RFC 8461) | Forces TLS on inbound SMTP — stops STARTTLS downgrade / MITM |
| **TLS-RPT** | `_smtp._tls` TXT (RFC 8460) | Daily reports on STARTTLS failures so you can detect misconfigurations |
| **BIMI** | `default._bimi` TXT | Shows your logo in recipient inboxes (requires DMARC enforcement first) |

Each domain gets a **0–100 posture score** (A–F grade), a sorted issue list (critical → info) with an exact **fix** string per issue, and a `top_fix` summary.

### Why run an email deliverability audit?

Every domain that sends email needs a correct email authentication setup. Without it:

- **Cold-email campaigns land in spam.** Gmail and Outlook check SPF, DKIM, and DMARC before deciding inbox vs spam folder.
- **Your domain can be spoofed.** Without DMARC enforcement (`p=reject`), anyone can send mail that looks like it's from you.
- **MTA-STS gaps expose STARTTLS downgrades.** A motivated attacker can strip TLS mid-session if MTA-STS isn't published.
- **BIMI unlocks branded inbox logos.** but only after DMARC `p=quarantine` or `p=reject` is enforced.

A single audit pass catches all eight of these surface areas and gives you exact DNS changes to fix each one.

### Use cases

- **Cold-email / outreach teams** — audit your sending domains before a campaign to maximize inbox placement.
- **MSPs & agencies** — batch-audit your entire customer portfolio; flag every domain missing DMARC or with `+all` SPF.
- **Security / IT teams** — detect email spoofing exposure (`p=none` DMARC, no MTA-STS, no DNSSEC) across your asset list.
- **Deliverability consultants** — generate a prioritized fix list per domain in one run.
- **Compliance** — confirm enforcement (`p=reject`, `-all`) before audits.

### Example input

```json
{
  "domains": ["example.com", "github.com"],
  "dkimSelectors": ["google", "default", "selector1"]
}
```

### Example output (per domain)

```json
{
  "domain": "example.com",
  "posture_score": 72,
  "posture_grade": "C",
  "spf_status": "fail",
  "dkim_found": false,
  "dmarc_policy": "none",
  "mta_sts": "absent",
  "dnssec": false,
  "issue_count": 4,
  "top_fix": "Publish an SPF TXT record at the domain apex, e.g. \"v=spf1 include:_spf.google.com -all\".",
  "issues": [
    { "severity": "critical", "area": "DMARC", "message": "No DMARC record found…", "fix": "Publish a DMARC TXT at _dmarc.<domain>…" },
    { "severity": "high", "area": "DKIM", "message": "No DKIM public keys found…", "fix": "Enable DKIM signing in your email provider…" }
  ],
  "mx": [],
  "spf": { "found": true, "qualifier": "fail", "includes": [] },
  "dmarc": { "found": false },
  "dkim": { "selectors_probed": 7, "keys_found": 0, "keys": [] },
  "mta_sts": { "found": false },
  "tls_rpt": { "found": false },
  "bimi": { "found": false }
}
```

### Pricing (pay-per-event)

| Event | Unit | Price |
|---|---|---|
| `actor-start` | per run | $0.0005 |
| `domain-audited` | per domain fully audited (all record sets pulled) | $0.01 |
| `issue-flagged` | per issue flagged (capped at 8/domain) | $0.005 |

**Worked cost example** — auditing a portfolio of 100 domains, average 3 issues each:
`actor-start` ($0.0005) + 100 × `domain-audited` (100 × $0.01 = $1.00) + 300 × `issue-flagged` (300 × $0.005 = $1.50) = **~$2.51 for 100 domains** (≈ 2.5¢ per domain).

Compare: a one-off DMARC/SPF scan from a deliverability vendor runs $15–$50/domain.

### Integration

- **API / SDK** — standard Apify actor; call via HTTP API, JavaScript/Python SDK, or Schedule.
- **Webhooks** — set an actor webhook to POST results to Make/n8n/Zapier on run completion.
- **Bulk** — pass up to thousands of domains in the `domains` array; queries run sequentially with polite timeouts.
- **Clay / lead-enrichment** — outputs are flat JSON, ready for Clay/GSC enrichment tables.

### Frequently asked questions

**What is an email deliverability audit?** An email deliverability audit checks a domain's DNS records to determine whether its outgoing mail is authenticated and secure. This actor inspects MX, SPF, DKIM, DMARC, DNSSEC, MTA-STS, TLS-RPT, and BIMI, then scores the domain 0–100 with a prioritized fix list.

**How do I check my DMARC policy?** Run any domain through this actor. The DMARC check queries `_dmarc.<domain>` and returns the policy — `none`, `quarantine`, or `reject` — plus the parsed `sp`, `pct`, `rua`, and `ruf` tags. If no record is found, the fix field tells you exactly which TXT record to publish.

**What is a good domain posture score?** Scores 80–100 (A–B grade) indicate strong email authentication with DMARC enforcement, DKIM signing, and MTA-STS enabled. Scores below 60 mean critical gaps exist — typically missing DMARC or an overly permissive SPF `+all` policy. The output lists the highest-impact fix first.

**What does SPF +all mean and how do I fix it?** An SPF record ending in `+all` (or no explicit `all` qualifier) tells receiving servers to accept mail from any IP address — the domain is trivially spoofable. Fix by replacing `+all` with `-all` (hard fail) or `~all` (soft fail), and ensure every legitimate sending source is listed in the `include:` statements.

**What is MTA-STS and do I need it?** MTA Strict Transport Security (RFC 8461) forces inbound mail servers to use TLS, preventing STARTTLS downgrade attacks. You need it if your domain accepts email and you want to guarantee encrypted delivery. Configure a `_mta-sts` TXT record and serve a policy file at `mta-sts.<domain>/.well-known/mta-sts.txt`.

**Can I audit thousands of domains in one go?** Yes. Pass an array of up to several thousand domain names in the `domains` input field. Each domain is audited sequentially with polite timeouts — no rate-limit risk. The output is one result object per domain for easy post-processing.

**Does this check live mailbox deliverability?** No — this actor inspects published DNS posture, not live SMTP responses. For mailbox-level probing (bounce detection, SMTP handshake), pair it with a dedicated SMTP-check actor.

### Limitations & honest notes

- **DKIM is selector-based.** DKIM public keys live at `<selector>._domainkey.<domain>` — there is no "list all DKIM keys" DNS query. We probe the common selectors (`google`, `default`, `selector1`, `selector2`, `s1`, `k1`, `mail`) plus any custom selectors you provide. A domain using a non-standard selector without you supplying it will report `dkim_found: false` even though it signs mail.
- **DNSSEC detection** uses the DoH resolver's AD (Authentic Data) flag. Rare split-horizon or private-DNS setups may report differently than a validating resolver on your network.
- **MTA-STS** requires fetching a policy file over HTTPS from `mta-sts.<domain>` — a handful of domains do not have this subdomain configured even when they publish a `_mta-sts` TXT.
- **No SMTP handshake / mailbox-probe.** This actor inspects published DNS posture, not live mailbox state. Pair with a dedicated SMTP-probe actor for bounce-list cleaning.
- **No personal data.** All inputs are domain names; outputs are DNS records and posture scores. Incidental emails in SPF/DMARC `rua` reporting addresses are operator-published infrastructure config, not collected personal data.

### Data sources

All DNS records resolved via **DNS-over-HTTPS** public resolvers (Cloudflare 1.1.1.1, Google Public DNS) using the standard DoH JSON API. MTA-STS policy fetched over HTTPS from the domain's own well-known endpoint. No third-party APIs, no scraping, no API keys.

### Related Apify Actors

- **[SSL/TLS Certificate Expiry Monitor](https://apify.com/gp005/tls-cert-monitor)** — Check TLS certificate expiry, issuer changes, and SAN drift across your domain portfolio. Complements email posture auditing by verifying the TLS layer your mail servers depend on.
- **[HTTP Security Headers & OWASP Posture Auditor](https://apify.com/gp005/security-headers-auditor)** — Audit your web application's security headers, CSP, and OWASP-recommended protections. Use alongside email posture checks for a full-domain security picture.
- **[GEO & llms.txt Readiness Auditor](https://apify.com/gp005/geo-llms-auditor)** — Check your domain's AI crawler access policies and llms.txt, sitemap, and robots.txt configuration for generative-engine optimisation.

# Actor input Schema

## `domains` (type: `array`):

Domains to audit for email deliverability posture. Ideally your own domains. The auditor queries DNS records (MX, TXT, A, AAAA, NS) via DNS-over-HTTPS and fetches the domain's published MTA-STS policy file. No login, no proxy, no API key.

## `dkimSelectors` (type: `array`):

DKIM selectors to probe for public keys (e.g. google, default, selector1). Common ones are tried automatically; add your custom selectors here.

## `checkMTASTS` (type: `boolean`):

Fetch the domain's MTA-STS policy file from mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461).

## `checkBIMI` (type: `boolean`):

Check for a BIMI record at default.\_bimi.<domain> (Brand Indicators for Message Identification).

## `timeoutSecs` (type: `integer`):

Timeout for each DNS-over-HTTPS query or MTA-STS fetch.

## Actor input object example

```json
{
  "domains": [
    "yourbrand.com",
    "mail.yourbrand.com"
  ],
  "dkimSelectors": [
    "google",
    "default",
    "selector1",
    "selector2",
    "s1",
    "k1",
    "mail"
  ],
  "checkMTASTS": true,
  "checkBIMI": true,
  "timeoutSecs": 10
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ],
    "dkimSelectors": [
        "google",
        "default",
        "selector1",
        "selector2",
        "s1",
        "k1",
        "mail"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("gp005/email-deliverability-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": ["example.com"],
    "dkimSelectors": [
        "google",
        "default",
        "selector1",
        "selector2",
        "s1",
        "k1",
        "mail",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("gp005/email-deliverability-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ],
  "dkimSelectors": [
    "google",
    "default",
    "selector1",
    "selector2",
    "s1",
    "k1",
    "mail"
  ]
}' |
apify call gp005/email-deliverability-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=gp005/email-deliverability-auditor",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/llfvH3hxeEM6W19AP/builds/0oFynLiYfMHIXrGNS/openapi.json