Email & Domain Auth Checker: MX, SPF, DKIM & DMARC
Check MX, SPF, DKIM and DMARC records from DNS alone — spot disposable and role addresses too.
In plain language.
Every domain publishes its own DNS records for MX, SPF, DKIM and DMARC — the public signals that determine whether mail sent to it will actually arrive and be trusted. This tool reads all of them directly, with no SMTP connection and no mailbox ping.
Five honestly distinct outcomes replace one generic failure: a domain that doesn't exist, one that resolves but can't receive mail, a genuine DNS hiccup, bad input, or a fully checked domain — plus disposable and role-address flags for cleaning a list.
Runs the same whether a person checks one address or an AI agent bulk-checks a hundred mid-workflow.
Two questions get confused with each other: whether mail to an address will bounce, and whether a domain is configured so its own mail reaches inboxes. They have different answers and different fixes, and only the second is answerable reliably.
Mailbox-existence checks open an SMTP conversation with the receiving server. Most large providers deliberately answer those unreliably, and being seen probing mailboxes carries its own reputational cost. This tool does not do it.
SPF and DMARC records are parsed rather than merely detected. You get the qualifier on the SPF all mechanism and the actual DMARC policy, because a DMARC record set to monitoring-only reports problems without stopping anything — a distinction that a present/absent flag hides completely.
A DNS failure is never reported as an absent record. A timeout or SERVFAIL returns its own status, so a transient resolver problem is a retry rather than a false finding about a domain’s configuration.
Disposable-provider lists and role-address patterns both age, and both are reported as flags rather than verdicts. A domain not on the disposable list means only that: not on our list. A role address like info@ or support@ is worth knowing about at signup, but a real person can legitimately sit behind one.
A clean configuration is also not a promise of inbox placement. Content, sending history and recipient-side filtering all matter and none of them are visible in DNS. What this tells you is whether the foundations are right, which is the part you control.
Who it's for
- For marketing and email operations. Before a campaign, check your own sending domains and confirm SPF is strict and DMARC is enforcing rather than monitoring-only — the two settings most often left permissive after setup.
- For sales and revenue operations. Clean an imported lead list: flag disposable domains and role addresses before they enter the CRM and depress deliverability.
- For IT and security. Audit every domain the organisation owns, including parked ones. A domain with no DMARC record is a spoofing opportunity whether or not it sends mail.
- For developers and AI agents. Branch on status and the disposable flag at signup to accept, challenge or reject a registration, without ever touching SMTP.
Pricing
$0.005 per input checked.
No subscription. Failed or empty inputs are never charged.
Fewer knobs. Better defaults.
DNS-only, no SMTP
No mailbox ping, no greylisting false negatives — just the public MX/SPF/DKIM/DMARC records.
Five honest outcomes
Doesn't-exist, can't-receive-mail, DNS-error, bad-input and fully-checked are never collapsed into one failure.
Disposable & role flags
Checked against bundled open lists — clean a signup or lead list before it hits your CRM.
Same tool, callable as an MCP server.
Email & Domain Auth Checker runs on Apify, which means it's exposed as a remote MCP tool with no extra setup. Point any MCP-compatible agent (Claude, Cursor, and others) at the endpoint below.
View full API reference on Apify{ "inputs": ["user@example.com", "mailinator.com"] }