Enter a domain and get an A–F email-security grade, a check-by-check breakdown (DMARC, SPF, DKIM, MTA-STS, TLS-RPT, BIMI, DNSSEC, security.txt) and the exact issues to fix. Free, no sign-up.
The plain-English reasons the bulk Actor attaches to each domain for teams that prospect on email posture. If this is your own domain, read them as a to-do list.
This page runs the same code as our paid Email Security Signals Actor: the grading files are copied byte for byte, so a domain gets the same grade here as in a bulk run (the one exception: security.txt is fetched from our server, and a site that blocks automated requests may answer it differently). Scores add up to 100:
| DMARC (40) | A valid record at p=reject earns 35, p=quarantine 30, p=none 15; plus 5 for a rua= reporting address. Enforcement in testing mode (t=y) or at pct below 100 costs 5. A subdomain without its own record is graded on its parent’s. |
|---|---|
| SPF (20) | Exactly one record, within the 10 DNS-lookup limit and with no permerror: 20. Ending in ?all costs 10, no all at all costs 5, and +all scores 0. A broken or duplicated record scores 5. |
| DKIM (15) | A key found at one of the common selectors we probe. |
| 5 points each | MTA-STS, TLS-RPT, BIMI, DNSSEC, and a /.well-known/security.txt with a Contact: field. |
| Letter | A from 85, B from 70, C from 55, D from 40, F below. Unless it has both a valid SPF record and a valid DMARC record, a domain is capped at D. |
A lookup that fails (resolver error or timeout) is reported as unknown and not penalised, so a flaky resolver never makes a domain look spoofable. DKIM keys can’t be listed, only probed by selector name, so “no DKIM key found” can mean the domain uses a selector we don’t try. “Bulk-sender compliant” means SPF passes, DMARC is published and DKIM was found, the authentication part of the Gmail, Yahoo and Microsoft bulk sender rules.
Privacy: DNS lookups go straight from your browser to Cloudflare’s public DNS resolver (cloudflare-dns.com). Browsers can’t read another site’s security.txt, so that one check goes through our server, which answers only yes or no. We don’t store the domains you check.
The same engine runs in bulk on Apify: paste domains, URLs or email addresses and get one row per domain with every field above, ready to export as CSV. $0.02 per graded domain; invalid inputs, duplicates, domains that don’t exist (NXDOMAIN) and DNS lookup failures are free.
Grade a list on Apify →More on what the Actor returns and how it’s priced, what Gmail, Yahoo and Microsoft require from bulk senders, and fixing SPF “too many DNS lookups”.
