Give it a list of domains. Get back an A–F email-authentication grade for each, the exact problems found, whether it meets the Google/Yahoo/Microsoft bulk-sender rules, which vendors send its mail, who processes its DMARC reports — and plain-English pitch reasons for outreach.
Built for MSPs, email-security and deliverability vendors. A pay-per-domain alternative to EasyDMARC ($44.99/mo, or $35.99/mo billed yearly) or MxToolbox Delivery Center ($129/mo) when you need a bulk audit of other people’s domains.
Run on Apify Store →Just one domain? Grade it free in your browser with the same engine.
Want to see your own list graded first? Send up to 100 domains to hello@siftsmith.com, and we’ll grade them free and email you the results as a CSV file.
| grade, score | A–F and 0–100 on SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, DNSSEC and security.txt |
|---|---|
| bulkSender | Google & Yahoo (2024) and Microsoft (2025) bulk-sender authentication rules: pass, fail, or unknown |
| spf | Record, recursive DNS-lookup count against the 10-lookup limit, all qualifier |
| dmarc, dmarcReporting | Policy, pct, rua/ruf — and who receives the reports (dmarcian, Valimail, EasyDMARC, Proofpoint, Red Sift, …) |
| mtaSts, mtaStsPolicy | The MTA-STS policy file itself, fetched over HTTPS as sending servers fetch it: mode enforce, testing or none, its mx patterns and max_age, any MX hosts it doesn’t cover, or broken with the reason (host doesn’t resolve, HTTP 404, redirect, invalid policy) |
| sendingVendors | Senders authorised in SPF: SendGrid, Mailchimp, Amazon SES, HubSpot, Salesforce, Zendesk, … |
| issues, pitchReasons | e.g. “DMARC at p=none — not enforcing; candidate for DMARC enforcement service”, “SPF over 10 lookups (14) — candidate for SPF flattening/management” |
The most common SPF, DMARC and BIMI problems it reports (quoted below as they appear in pitchReasons) each have a step-by-step fix guide, most with a free in-browser checker:
One more it reports in issues rather than pitchReasons: dkim_not_found. When emailProvider is Microsoft 365, a common cause is that the selector1 and selector2 CNAMEs were never published, and the guide to Microsoft 365 DKIM “CnameMissing” shows how to check and fix them.
All guides are listed on the email error fixes page.
Public DNS records plus each domain’s public security.txt and MTA-STS policy file, no logins:
mta-sts.<domain> with the same rules senders apply (valid certificate, no redirects, text/plain) and checks it against the domain’s MX records. On a holdout sample of 59 real domains the built-in selectors find a DKIM key on 51 (86%).| Graded domain | $0.02 — charged only for a domain that exists in DNS and was fully looked up |
|---|
Free: unparseable inputs, IP addresses, private-network names, non-existent domains, DNS lookup failures (the row says to retry) and duplicates (stripe.com, https://www.stripe.com/pricing and jane@stripe.com are one domain). Set a max charge per run and the tool stops cleanly at that limit.