Domain Health Checker — DNS, SSL & Email Authentication Audit

Point this Actor at a list of domains and get a full technical audit of each one: DNS records, SSL certificate status, and email-spoofing protection (SPF and DMARC), with a 0–100 health score and a plain-English list of what is broken. Every field comes from a direct DNS lookup or a live TLS handshake — no WHOIS, no paid API, no browser, nothing to configure.

What you get

• A verdict, not raw records. A 0–100 score across seven checks, plus an issues list you can hand to whoever has to fix it: "SSL certificate expires in 9 days", "No DMARC record — no policy against email spoofing".
• DNS: A, AAAA, MX (priority-sorted), NS, and the www CNAME.
• SSL: issuer, expiry date, days left, and whether the chain is actually trusted.
• Email authentication: whether the domain can receive mail at all, its SPF record, its DMARC record and the policy in force (none / quarantine / reject).
• Built for lists. Concurrency up to 50, one row per domain, so a portfolio of a few hundred domains is a single run.
• Runs on Apify: schedule it, monitor it, call it from the API or the MCP server, export to JSON, CSV or Excel, or push results straight into your own pipeline.

Who uses it

• Agencies and consultants — bulk-audit a client's domain portfolio before a pitch or a retainer review.
• IT and security teams — catch expiring certificates and missing email auth before they become an outage or a spoofing incident.
• Due diligence — check the technical hygiene of a target company's domains at scale.
• Deliverability teams — verify SPF and DMARC really are in place on every sending domain, not just the main one.

How to run it

1. Click Try for free — no card needed on the free plan.
2. Paste your domains into Domains, one per line. Scheme, path and www. are stripped for you, so https://www.example.com/pricing and example.com are the same input.
3. Press Start. Results appear in the dataset — read them in the UI, pull them from the API, or have a webhook push them onward.

Pricing

Pay-per-event: $0.005 per run start + $0.005 per domain audited. No monthly seat, no minimum. 100 domains cost about $0.51; 1,000 domains about $5.01.

A domain that could not be audited is still returned, with found: false and the reason — and it is not charged for. You pay for answers, not for attempts.

Input

Field	Required	What it does
domains	yes	Domains to audit. Up to 100 per run.
maxConcurrency	no	How many to check at once, 1–50 (default 10).

{
    "domains": ["apify.com", "example.com", "github.com"],
    "maxConcurrency": 10
}

Output

One row per domain. This is a real row from a real run, trimmed only where a list repeats:

{
    "domain": "apify.com",
    "found": true,
    "healthScore": 100,
    "resolves": true,
    "records": {
        "a": ["3.170.42.100", "3.170.42.76", "3.170.42.68", "3.170.42.109"],
        "aaaa": ["2600:9000:2870:bc00:9:a03e:6540:93a1", "…"],
        "mx": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "…"],
        "ns": ["ns-449.awsdns-56.com", "ns-839.awsdns-40.net", "…"],
        "wwwCname": []
    },
    "email": {
        "canReceive": true,
        "spf": "v=spf1 a mx include:_spf.google.com include:mailgun.org -all",
        "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com",
        "dmarcPolicy": "reject"
    },
    "ssl": {
        "issuer": "Amazon",
        "validTo": "2027-01-16T23:59:59.000Z",
        "daysLeft": 174,
        "authorized": true
    },
    "issues": [],
    "summary": "Healthy — DNS, email auth and SSL all in order (score 100/100).",
    "checkedAt": "2026-07-26T13:58:02.872Z"
}

Field	What it means
healthScore	0–100 across seven checks (see FAQ)
resolves	The domain answers DNS at all
records	A, AAAA, MX, NS and the www CNAME as returned
email.canReceive	There is at least one MX record
email.dmarcPolicy	none, quarantine or reject — none is a policy in name only
ssl.authorized	The certificate chain is trusted, not merely present
ssl.daysLeft	Days until expiry; negative means already expired
issues	Human-readable findings, empty when nothing is wrong
found	false means the audit failed; the row says why and is not billed

Related tools

Related tools for adjacent workflows in AI and search visibility.

Actor	What it does
Social Preview Checker	Pair it in the AI and search visibility workflow: See exactly how your links look when shared on Telegram, WhatsApp, X, LinkedIn, Slack, Facebook & Discord
AI Crawler Access Checker	Pair it in the AI and search visibility workflow: Check which AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended & more) can access your website
AI Overview Citation Tracker	Pair it in the AI and search visibility workflow: For each query that matters, see which sources and domains AI assistants cite in their answer — grounded...
AI Answer Change Alert	Pair it in the AI and search visibility workflow: Track whether an AI assistant's answer to a query you care about changed since last time — new sources...
LLM Brand Visibility Tracker	Pair it in the AI and search visibility workflow: For each query that matters, check whether AI assistants recommend YOUR brand — and which competitors they...

FAQ

Does it use WHOIS or any paid data source? No. Every field comes from a direct DNS lookup or a live TLS handshake on port 443. Nothing rate-limited, nothing to pay for separately.

What goes into the health score? Seven checks: the domain resolves, has MX, has SPF, has a real DMARC policy (p=none counts as weak), has SSL, that SSL is not expiring soon, and has NS records. The score is the percentage passed.

Does a domain with no email get penalised for missing SPF and DMARC? No. Those are only raised when the domain has MX records, i.e. is actually set up to receive mail.

Can it check subdomains? Yes — mail.example.com is just another domain here.

Is this legal? Yes. DNS records and TLS certificates are public information, served to anyone who asks, exactly as dig or openssl would see them.

Can I call it from an AI agent? Yes — standard Apify Actor, callable from the Apify API, the SDK, or the Apify MCP server.

What this is NOT. It does not scan for vulnerabilities, probe ports, check blacklists, or read page content. It answers one question — is this domain's DNS, mail and certificate setup sound — and answers it honestly, including when it cannot.

Found a wrong result, or need a check we don't run? Open an issue on this Actor's page.

---

Built by zinin. Questions? Telegram @timzinin.