Skip to content

Email Deliverability & Domain Security Checker

Try for free

Check email deliverability and domain security in bulk: MX and mail provider, SPF with the 10-lookup count, DMARC policy, DKIM keys, MTA-STS, TLS-RPT, BIMI, DNS blocklists for the domain and its mail servers, an email-auth grade A to F, full DNS records and a DNS propagation check. Domains, websites or email addresses in, one row per domain out. No login or API key needed.

📧 Email Deliverability & Domain Security Checker

Check whether a domain's email setup is ready to land in the inbox, for one domain or 10,000 at once. Paste domains, websites or email addresses and get one row per domain with MX and mail provider, SPF (with the 10-lookup count), DMARC policy, DKIM keys, MTA-STS, TLS-RPT, BIMI, DNS blocklist status for the domain and its mail servers, an email-auth grade from A to F and the full DNS records. No login, no API key, $0.85 per 1,000 domains with platform usage included.

✨ Why use Email Deliverability & Domain Security Checker?

  • 🛡️ Every email check in one row: SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, MX and blocklists, plus a plain list of issues such as missing_dmarc or spf_too_many_lookups.
  • 🔁 Real SPF evaluation: every include: and redirect= is followed the way a receiving mail server does it, so you see the true DNS-lookup count against the limit of 10, void lookups and broken includes.
  • 🚫 Blocklist status: the domain on 2 domain blocklists and each mail-server address on 10 IP blocklists (SpamCop, Barracuda, UCEPROTECT, PSBL, Mailspike and more).
  • 🅰️ Grade A to F and the Gmail / Yahoo bulk-sender check: sort hundreds of domains by emailAuthGrade and see at a glance which ones would fail the bulk-sender rules.
  • 🌍 DNS propagation mode: compare answers from 8 public resolvers after a DNS change.
  • 📋 Bulk-ready: paste a CSV export or link a file; results stream in as each domain finishes, so long lists work in one run.

🎯 Use cases

  • 📬 Email deliverability audits: check SPF, DKIM and DMARC for every sending domain before a campaign or a client onboarding.
  • 🧹 Lead list hygiene: find which prospects run Google Workspace, Microsoft 365 or a filtering gateway (Proofpoint, Mimecast, Cisco), and which domains accept no mail at all.
  • 🔐 Security and compliance reviews: list domains without DMARC enforcement, with +all SPF, weak DKIM keys, no MTA-STS or no DNSSEC.
  • 🚨 Blocklist monitoring: schedule a daily run and get every domain whose mail servers landed on a blocklist.
  • 🏢 Agencies and MSPs: grade every client domain and hand over the issue list.
  • 🔄 Migrations: after moving mail or DNS, use propagation mode to see whether public resolvers already serve the new records.

🚀 How to use

  1. Paste domains, websites or email addresses under Domains, websites or email addresses. For long lists use Bulk list (text or CSV) or Bulk list file URL.
  2. Keep the default checks or turn options on and off: DKIM selectors, blocklists, reverse DNS, record types.
  3. Click Start.
  4. Open the Overview, Email authentication or Blocklists view and export to JSON, CSV, Excel or HTML, or read the results through the API.

📥 Input

FieldWhat it does
domainsDomains, websites or email addresses, one per line. jane@example.com and https://www.example.com/page both become example.com.
bulkTextA pasted list or CSV; the first cell of each row that looks like a domain, website or email address is used.
sourceFileUrlPublic link to a TXT or CSV file.
maxDomainsCheck at most this many unique domains (empty = all).
lookupTargetauto (default), asEntered or rootDomain.
emailSecuritySPF, DMARC, MTA-STS, TLS-RPT, BIMI, grade and bulk-sender check (default on).
checkDkim / dkimSelectorsCommon DKIM selectors plus those of the domain's sending services (default on) and your own selectors.
checkBlocklistsDomain and mail-server blocklists (default on).
reverseDnsPTR names of web and mail servers with the forward-confirmed check (default off).
recordTypesDNS record types to return (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA by default; DS, DNSKEY, HTTPS, NAPTR, PTR optional).
modelookup (full check, default) or propagation (8 resolvers).
resolverCloudflare (default), Google, Quad9, OpenDNS, AdGuard, DNS4EU, DNS.SB, Mullvad or your own DNS-over-HTTPS URL.
{
  "domains": ["github.com", "jane@python.org", "https://www.scrape.ly/"],
  "checkBlocklists": true,
  "reverseDns": true
}

📤 Output

One row per domain. The flat columns fit a spreadsheet; the nested objects hold every detail.

FieldMeaning
domain, statusThe checked name and OK, NO_RECORDS, NXDOMAIN (does not exist) or SERVFAIL (its name servers fail)
emailProvider, mxHosts, hasMx, nullMxMail servers by priority and the provider or gateway behind them
spf, spfRecord, spfLookups, spfValidSPF all policy, the record, the recursive DNS-lookup count and whether it passes the RFC limits
dmarcPolicy, dmarcRecord, dmarcRuaDMARC policy (none, quarantine, reject, missing), record and report addresses
dkimSelectors, dkimFoundSelectors with a DKIM key; key type, size and revoked flag under emailSecurity.dkim
mtaSts, mtaStsMode, tlsRpt, bimiMTA-STS record and policy mode (enforce, testing, none), TLS-RPT and BIMI
emailAuthGrade, emailAuthScore, emailAuthIssuesGrade A to F, score 0 to 100 and what cost points
bulkSenderReady, bulkSenderMissingWhether the DNS side of the Gmail / Yahoo bulk-sender rules is met, and what is missing
blocklisted, blocklistHits, blocklistsCheckedBlocklist result, the hits as List: address and the number of lookups made
issuesFlags such as missing_dmarc, dmarc_policy_none, spf_too_many_lookups, dkim_not_found_common_selectors, no_mx, blocklisted, no_caa
ipv4, ipv6, nameservers, cname, dnssecMain DNS facts
records, ttlsEvery selected record type with its TTL
emailSecurity, blocklists, reverseDnsFull details of each check

Example (shortened, from a test run):

{
  "input": "github.com",
  "domain": "github.com",
  "status": "OK",
  "ipv4": "140.82.112.3",
  "mxHosts": "0 github-com.mail.protection.outlook.com",
  "nameservers": "dns1.p08.nsone.net, dns2.p08.nsone.net, ns-1283.awsdns-32.org, ns-421.awsdns-52.com",
  "emailProvider": "Microsoft 365",
  "hasMx": true,
  "dnssec": false,
  "spf": "~all (softfail)",
  "spfLookups": 10,
  "spfValid": true,
  "dmarcPolicy": "quarantine",
  "dmarcRua": "mailto:dmarc@github.com",
  "dkimSelectors": "google, selector1, k1, k2, k3, s1, s2, cm, smtpapi, zendesk1, zendesk2",
  "dkimFound": true,
  "mtaSts": false,
  "tlsRpt": false,
  "bimi": false,
  "emailAuthGrade": "A",
  "emailAuthScore": 95,
  "emailAuthIssues": ["No MTA-STS", "No TLS-RPT"],
  "bulkSenderReady": true,
  "blocklisted": false,
  "blocklistHits": [],
  "blocklistsChecked": 42,
  "issues": [],
  "emailSecurity": {
    "spf": {"dnsLookupCount": 10, "lookupLimitExceeded": false, "includes": ["spf.protection.outlook.com", "_netblocks.google.com", "mail.zendesk.com"], "voidLookups": 0, "warnings": []},
    "dmarc": {"policy": "quarantine", "subdomainPolicy": "reject", "pct": 100, "rua": ["mailto:dmarc@github.com"], "adkim": "r", "aspf": "r"},
    "dkim": [{"selector": "google", "keyType": "rsa", "keyBits": 2048, "revoked": false, "testing": false}]
  },
  "blocklists": {"listed": false, "hits": [], "checkedIps": ["52.101.60.71", "52.101.202.150", "52.101.60.151", "52.101.40.5"], "lookups": 42, "notChecked": []},
  "resolver": "cloudflare",
  "checkedAt": "2026-11-13T01:23:16Z"
}

In propagation mode each row has consistent, consistentExceptAddresses, inconsistentTypes, mismatches (resolver, answer and majority answer), respondedResolvers, failedResolvers and propagation with every resolver's answer per record type. Sites behind a CDN often return different A/AAAA answers per resolver; consistentExceptAddresses ignores those.

The run's key-value store also holds SUMMARY: counts per status and grade, email providers, blocklisted domains, invalid entries and domains that got no answer.

How the grade works

The score starts at 100 and loses points per finding: no DMARC −35, no SPF −30, DMARC p= missing −30, SPF +all −25, DMARC p=none, several SPF or DMARC records or SPF over 10 lookups −20 each, SPF ?all −15, no DKIM key under common selectors, a weak DKIM key, a broken SPF include or SPF without an all term −10 each, smaller deductions for pct below 100, no rua, sp=none, a 1024-bit key, no MTA-STS and no TLS-RPT. A ≥ 90, B ≥ 80, C ≥ 65, D ≥ 50, otherwise F; a domain with neither SPF nor DMARC is always F. DKIM, MTA-STS and TLS-RPT count only for domains that receive mail (have MX). Subdomains without MX get no grade.

💰 Pricing

$0.85 per 1,000 domains ($0.00085 per domain), on every plan. Platform usage (compute and proxy traffic) is included. Email authentication, DKIM, blocklists, reverse DNS, propagation mode and the grade cost nothing extra.

Only answered domains are charged (OK, NO_RECORDS, NXDOMAIN and SERVFAIL are real answers). Invalid entries, duplicates and domains no resolver answered for are free. Example: a list of 1,000 domains costs about $0.85. Set a maximum cost per run and the run stops cleanly when it is reached.

❓ FAQ

Is this legal? Yes. DNS records and blocklists are public by design, and the actor only sends standard DNS queries.

Do I need a login, an API key or my own proxy? No. Queries go over DNS-over-HTTPS through Scrape.ly datacenter proxies, already included in the price.

How many domains can I check? As many as you like: the actor streams results and keeps memory flat. Each domain takes 40 to 100 DNS lookups, so plan about 12 minutes per 1,000 domains with every check on. The default run timeout of 3 hours fits about 14,000 domains; raise it for longer lists, or turn off the checks you do not need. A run that reaches its timeout keeps every row checked so far.

Why "DKIM not found" when the domain signs its mail? DNS cannot list DKIM keys. The actor checks a core set of common selectors plus the ones used by the sending services named in the domain's SPF record and by its mail provider; add your own under Your own DKIM selectors (the selector is in the s= tag of a signed message's DKIM-Signature header).

What if a field is empty? It means the record does not exist (for example mtaSts: false) or the check is off. Domains that do not exist come back as NXDOMAIN; entries that are not domains are listed in the run's SUMMARY and not charged.

Can I schedule it or use the API? Yes. Schedule a daily run to watch blocklists and DMARC, and read the dataset through the Scrape.ly API, or connect it to Make, Zapier or n8n.

⚠️ Limits

  • The grade only uses public DNS. It cannot see DKIM keys under custom selectors, sending reputation, message content or whether a mail server actually signs and aligns its mail.
  • Mail servers are not contacted: the actor does not open SMTP connections or test mailbox existence.
  • Blocklists are checked for the IPv4 addresses of the domain's mail servers (MX), up to 20 per domain; outgoing servers that do not receive mail are not known from DNS. Spamhaus does not answer queries from public resolvers and is not included. A list that refuses a query is reported under blocklists.notChecked, never as clean.
  • Reverse DNS covers up to 5 addresses of the domain and 10 mail-server addresses.
  • Propagation mode queries all resolvers from the same datacenter location, so it shows resolver caches, not answers from different countries.

Related actors

//From the blog\\

Latest articles

All articles
G2
4.7/5
Excellent
Trustpilot

The internet is full of data.
Start owning yours.

Scrape.ly gives you the infrastructure, the tooling, and the team to extract, process, and operationalize web data at any scale. Setup takes minutes.

Get Started FreeChat with Support
No credit card. No setup calls.