DMARC, SPF & DKIM Checker (Bulk Email Security Audit)

Email & DNS Security Audit: SPF, DMARC, DKIM, MTA-STS Checker

Check how well any domain is protected against email spoofing and phishing, in bulk. Get a score out of 100, a spoofing risk rating and step-by-step fixes.

Quick start

1. Press Try for free. The form opens with a working example (apify.com, stripe.com and more).
2. Replace it with your own domains or URLs.
3. Press Start. Results appear as they are found; download them as Excel, CSV or JSON, or use the API.

A result looks like this (some columns):

domain	score	grade	spoofingRisk
acme.com	62	C	high

What it checks

• 📮 MX records (can the domain receive email?)
• ✅ SPF: present, only one record, under the 10-lookup limit, ending in ~all or -all
• 🛡️ DMARC: present, policy (none, quarantine or reject), reporting addresses, subdomain policy
• 🔑 DKIM: keys on 20 common selectors (Google, Microsoft 365, Mailchimp, Zoho, Proton and more)
• 🔒 MTA-STS (policy file read and mode reported) and TLS-RPT
• 🏷️ BIMI and CAA

Who it's for

IT and security teams checking their own domains, MSPs auditing clients, deliverability consultants, and sales teams building lead lists of companies with weak email security.

Input

Field	What to enter
Domains or URLs	acme.com, https://www.acme.com or someone@acme.com; one per line, duplicates removed

{ "domains": ["acme.com", "example.org", "ceo@startup.io"] }

Output

One row per domain:

{
  "domain": "acme.com", "score": 62, "grade": "C", "spoofingRisk": "high",
  "mx": ["aspmx.l.google.com"],
  "spf": { "record": "v=spf1 include:_spf.google.com ~all", "records": 1, "dnsLookups": 1, "allQualifier": "~" },
  "dmarc": { "record": "v=DMARC1; p=none; rua=mailto:dmarc@acme.com", "policy": "none", "aggregateReports": "mailto:dmarc@acme.com" },
  "dkim": { "selectorsFound": [{ "selector": "google", "revoked": false, "keyType": "rsa" }], "selectorsChecked": 20 },
  "mtaSts": null, "tlsRpt": null, "bimi": null, "caa": [], "nameservers": ["ns1.example-dns.com"],
  "recommendations": ["DMARC policy is \"none\", so spoofed email is still delivered. Move to quarantine, then reject.", "..."]
}

Scoring: DMARC (present 20, enforced 15, reports 5), SPF (present 15, single record 5, under 10 lookups 5, strict ending 5), MX 10, DKIM 10, MTA-STS 4, TLS-RPT 2, BIMI 2, CAA 2. Grade A is 90 or more, B 75, C 55, D 35, below that E. Spoofing risk is high with no DMARC or p=none, medium with quarantine and low with reject.

Pricing

Pay per domain audited. Domains that do not exist or cannot be resolved cost the lower failed fee.

Event	When it is charged	Price per 1,000 (Free / Bronze / Silver / Gold plan)
Domain audited	Each domain audited.	$5 / $4.50 / $4 / $3.50
Domain failed	A domain that does not exist or could not be resolved.	$1.50 on every plan

Set Maximum cost per run to cap your spend: the run stops cleanly at your limit.

Notes

DKIM can only be found on known selectors; a custom selector may show as missing even when DKIM is set up. Input can be domains, URLs or email addresses.

Use with AI agents (MCP)

Connect this tool to Claude, Cursor, VS Code or any other MCP client through the Apify MCP server. To load only this tool, use this server URL:

https://mcp.apify.com?tools=pagecraft/email-dns-security-audit

Then ask, for example: "Check whether our domain can be spoofed by email and what DNS records we need to fix it". The agent gets back SPF, DMARC, DKIM and related results, a score out of 100 and step-by-step fixes. Each call is charged per event at the prices in Pricing above. Agents without an Apify account can also pay per run through Apify's agentic payments.

Workflows with other Pagecraft tools

Pagecraft tools are built to work together. Ideas that use this one:

Check a domain before you buy, partner or send. Due diligence on any domain in minutes.

1. WHOIS Lookup: Age, expiry date and registrar.
2. This tool: SPF, DKIM and DMARC email security records.
3. Company Data Enrichment from Domain: Who runs the site and how to contact them.
4. Website Screenshot & PDF: A dated screenshot or PDF of the site as evidence.

More Pagecraft tools

• WHOIS Lookup (Bulk Domain Age, Expiry & Registrar): domain age, expiry date and registrar in bulk.
• Company Data Enrichment from Domain (Contacts, Tech Stack): logo, contacts and tech stack for a list of company websites.
• Tech Stack Detector (Website Technology Lookup): what any website is built with.