DEV Community: Probelane

How to bulk-check DMARC, SPF and DKIM for a list of domains (free Python script)

Probelane — Wed, 07 Oct 2026 04:33:53 +0000

Every few weeks someone on Reddit or a sysadmin forum asks some version of: "I have 300 client/prospect domains. How do I check which ones have no DMARC, or a weak SPF, without pasting them one by one into MXToolbox?"

Here's a small, dependency-light Python script that does exactly that from public DNS, plus the gotchas we hit doing this on real small-business domains.

The script

pip install dnspython

# bulk_dmarc.py  -  usage: python bulk_dmarc.py domains.txt > results.csv
import csv, re, sys
import dns.resolver

R = dns.resolver.Resolver()
R.lifetime = 5
DKIM_SELECTORS = ["google", "selector1", "selector2", "default", "k1", "k2",
                  "s1", "s2", "mail", "dkim", "smtp", "mxvault", "zoho"]

def txt(name):
    try:
        return [b"".join(r.strings).decode(errors="ignore") for r in R.resolve(name, "TXT")]
    except Exception:
        return []

def has_mx(domain):
    try:
        return len(R.resolve(domain, "MX")) > 0
    except Exception:
        return False

def check(domain):
    spf = next((t for t in txt(domain) if t.lower().startswith("v=spf1")), "")
    dmarc = next((t for t in txt("_dmarc." + domain) if t.lower().startswith("v=dmarc1")), "")
    policy = ""
    for part in dmarc.replace(" ", "").split(";"):
        if part.lower().startswith("p="):
            policy = part[2:].lower()
    # a DKIM record with an empty p= is a revoked key, so require a value
    dkim = [s for s in DKIM_SELECTORS
            if any(re.search(r"(^|;)\s*p=[A-Za-z0-9+/]", t) for t in txt(f"{s}._domainkey.{domain}"))]
    mx = has_mx(domain)
    spoofable = mx and policy in ("", "none")
    return {
        "domain": domain, "has_mx": mx, "spf": spf or "MISSING",
        "spf_all": (spf.split()[-1] if spf else ""),
        "dmarc_policy": policy or "MISSING", "dkim_selectors_found": " ".join(dkim),
        "spoofable": spoofable,
    }

domains = [l.strip().lower() for l in open(sys.argv[1]) if l.strip()]
w = csv.DictWriter(sys.stdout, fieldnames=list(check("example.com").keys()))
w.writeheader()
for d in domains:
    w.writerow(check(d))

That's the whole thing. For a few hundred domains it runs in a couple of minutes.

Gotchas worth knowing

1. Only count "spoofable" when the domain actually receives mail. A parked domain with no MX and no DMARC is noise. Filter on has_mx first, or you'll overstate the problem (and look silly if you're using this for outreach).

2. p=none is not protection. It's monitoring. Treat p=none the same as no DMARC when you're asking "can someone send email as this domain?" In our sample of 51 small accountants, law firms and dental practices, 30 of the ones with mailboxes were spoofable, and 13 of those had p=none.

3. DKIM can't be enumerated. DNS has no way to list selectors, so you can only guess common ones. "No DKIM found" is a low-confidence result. Never lead a conversation with it. Also, a record like v=DKIM1; p= (empty key) means the key was revoked, so don't count it as "DKIM present". example.com publishes exactly that on every selector.

4. SPF ending in ?all or +all is effectively open. ~all (softfail) is common and fine alongside DMARC; ?all and +all aren't.

5. Watch the 10-lookup SPF limit. Long include: chains silently break SPF (permerror). If you're auditing clients, add a recursive lookup counter. That's a nice follow-up to the script above.

6. Resolver rate limits. Hammering a public resolver with thousands of TXT queries gets you SERVFAILs that look like "missing records". Add retries, or spread across resolvers, before trusting a MISSING.

If you're doing this for prospecting

If you're an MSP or web agency checking prospects rather than your own clients, a raw pass/fail CSV isn't enough: you want to know which companies to call first and what to say. We packaged a hosted version that also checks SSL expiry, HTTP-only sites, outdated WordPress/PHP and domain expiry, then ranks every company with a 0–100 score, the exact evidence and a one-line opener. It's pay-per-result on Apify ($0.015 per company, invalid domains free):

Security & Website Pain Prospect Finder (full prospect scoring)
Email Domain Security Auditor (just the DMARC/SPF/DKIM part, in bulk)

But for most people the script above is all you need. Questions about edge cases (subdomain policies, sp=, pct=, third-party senders) are welcome in the comments.

We checked 51 small-business domains: 30 could be spoofed by email. Here's how to find these prospects automatically

Probelane — Wed, 07 Oct 2026 04:16:22 +0000

If you sell IT, security or web services to small businesses, the hardest part of outreach is the first line. "We help businesses with cybersecurity" gets ignored. "Anyone can currently send email that looks like it's from @yourfirm.com, and here's the DNS record that proves it" gets read.

We wanted to know how common those verifiable, fixable problems really are, so we ran passive, public-only checks against 51 small professional firms: accountants, law firms and dental practices in South Africa and the US.

What we checked (and what we didn't)

Only things anyone can see from the outside:

DNS: MX, SPF, DMARC, and DKIM on ~59 common selectors
One homepage request: status code, redirects, generator tags, script versions, response headers
One TLS handshake: certificate issuer and expiry
RDAP/WHOIS: domain expiry date

No port scanning, no vulnerability probing, no logins. This matters both ethically and practically: everything you find is something the business owner can verify in 10 seconds.

The results

Of the 51 firms:

Finding	Count
Domain spoofable (no DMARC record, or `p=none`) among firms with mailboxes on their domain	30
...of which had no DMARC record at all	23
No DKIM key found on any common selector	19
Running jQuery < 3.5, an outdated WordPress, or end-of-life PHP	10
Domain expiring within 30 days	3
Website served over plain HTTP only	2
Expired SSL certificate	1
Host "domain registered / coming soon" placeholder instead of a website	1

Some observations:

1. DMARC is the big one. Well over half of these firms can be impersonated by email. For an accountant or a law firm, that's the exact setup behind "our banking details have changed" invoice fraud aimed at their clients. Gmail, Yahoo and Microsoft now require DMARC for bulk senders as well, so this is no longer a niche concern.

2. Most of them aren't on Microsoft 365 or Google Workspace. A large share use the mail service bundled with their web host. That's a second conversation in itself (deliverability, backups, MFA).

3. DKIM detection is inherently lossy. You can't list a domain's DKIM selectors from DNS; you can only guess common ones (google, selector1, default, k1 and so on). A "no DKIM found" result is a low-confidence signal, so we weight it accordingly and never lead with it.

4. "Slow website" is a trap in containers. Our first runs flagged half the sites as slow. It turned out CPU throttling in a small container was inflating TLS and parse timings. The fix was to re-time slow candidates in a second, idle pass. If you build your own checker, don't trust single-shot timings.

Turning findings into a prospect list

A raw list of failing checks isn't a prospect list. What a salesperson needs per company is:

The single most commercially relevant problem (not 14 findings)
The exact evidence, e.g. No DMARC TXT record at _dmarc.example.com. SPF: "v=spf1 mx a ?all"
Why it matters in plain English, e.g. "visitors get a full-page browser warning"
A score, so you work the list top-down
A one-line opener that is specific, checkable and offers value first

Here's an anonymised row from the run:

rank: 2
company: Example Law Firm 02 (law firm, Johannesburg)
opportunityScore: 81 (critical)
topProblem: Domain can be spoofed: no DMARC record
evidence: No DMARC TXT record at _dmarc.example-02.co.za.
          SPF: "v=spf1 mx a include:spf.host-h.net ?all"
otherSignals: Outdated WordPress 6.0.17 | No DKIM signing key found |
              Missing security headers (grade F)
coldOpenLine: "Quick heads-up: anyone can currently send email that looks
  like it's from @example-02.co.za because there's no DMARC record. I can
  send you the exact DNS fix, it takes about 15 minutes."

The scoring is simple and transparent: severity of the top problem, plus a smaller bump for each additional independent signal, with confidence penalties for lossy checks like DKIM.

Doing it yourself

You can do every check above with free tools: dig TXT _dmarc.example.com, openssl s_client -connect example.com:443, curl -sI, and an RDAP lookup at https://rdap.org/domain/example.com. For a handful of domains, that's all you need.

For hundreds of domains, we packaged the whole pipeline (checks, scoring, evidence, pitch and opener) as an Apify Actor. You paste domains, URLs, emails or a CSV/Google Sheet link and get back a ranked list you can export to CSV, Sheets, Make or Zapier:

👉 Security & Website Pain Prospect Finder

It's pay-per-result at $0.015 per company scored. Invalid inputs, non-existent domains and companies below your minimum score are free. The Store page documents the input format and output columns.

Please use this responsibly

These are real businesses with real gaps. Lead with help, not fear: give them the fix even if they don't hire you, include an opt-out, and follow your local anti-spam and privacy law (CAN-SPAM, GDPR, POPIA). Never publish a company's name next to its security gaps. That's why every example above is anonymised.

Questions about the methodology, especially DKIM false negatives or how you pitch DMARC to small clients? Ask in the comments.