Domain Security Checker: DNS, SPF/DKIM/DMARC, TLS, Security Headers & Tech Stack

One input, one clean JSON record per domain. Combine DNS records, email-authentication grade (SPF, DKIM, DMARC, MTA-STS), TLS certificate details, HTTP security-header score, cookie flags and detected technology stack - plus a prioritised list of findings. No browser, no proxies, no API keys needed. Built for agencies, IT/security teams, sales prospecting and AI agents that need a quick, structured "state of this domain".

What you get per domain

Block	Contents
dns	A, AAAA, CNAME, MX, NS, CAA, SOA, reverse DNS of the first IP
emailAuth	SPF (with DNS-lookup count and all policy), DMARC (policy, pct, report domains), DKIM selectors found among ~25 common ones, MTA-STS, TLS-RPT, BIMI, score 0-100 and grade A-F
tls	Protocol, cipher, ALPN, issuer, validity dates, days remaining, SANs, trust status, hostname match, key type/size
http / securityHeaders	Final URL and redirect chain, http-to-https redirect, server, HSTS details, CSP, X-Frame-Options, Referrer-Policy etc., score and grade
cookies	Count and how many lack Secure / HttpOnly / SameSite (cookie values are never stored)
page	Title, meta description, language, canonical, Open Graph / structured-data flags, external script domains
technologies	CMS, frameworks, analytics, CDN, hosting, web server, payments, consent tools - with version and evidence when available
findings	Sorted issues (high / medium / low / info) with stable code values such as SPF_MISSING, DMARC_P_NONE, CERT_EXPIRES_SOON, NO_HSTS
summary	Quick fields for sorting: grades, finding counts, certificate days left, technology names

Use cases

• Agencies / freelancers: audit prospects' email deliverability and security basics before a pitch.
• IT & security teams: monitor certificate expiry, missing SPF/DMARC, weak headers across many domains on a schedule.
• Sales intelligence: find which sites run Shopify, WordPress, HubSpot, Cloudflare and so on.
• Due diligence / vendor checks: quick external hygiene check of a supplier domain.
• AI agents: a single tool call that returns structured, machine-readable domain facts.

Input

{
  "domains": ["github.com", "https://www.example.org/"],
  "checkDns": true,
  "checkEmailAuth": true,
  "checkTls": true,
  "checkHttp": true,
  "detectTechStack": true,
  "dkimSelectors": ["myselector"],
  "maxItems": 100
}

All checks are on by default; switch off what you do not need. maxItems caps billed results. For email results use the apex domain (e.g. example.com), because SPF/DMARC usually live there rather than on www.

Output (abridged)

{
  "recordType": "domain_snapshot",
  "url": "https://github.com/",
  "domain": "github.com",
  "dns": { "a": ["140.82.121.4"], "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }], "ns": ["dns1.p08.nsone.net"], "caa": [] },
  "emailAuth": { "spf": { "found": true, "all": "~all", "dnsLookups": 10 }, "dmarc": { "found": true, "policy": "quarantine", "pct": 100 }, "score": 90, "grade": "A" },
  "tls": { "protocol": "TLSv1.3", "issuer": "Sectigo Limited", "daysRemaining": 59, "certificateTrusted": true },
  "securityHeaders": { "score": 80, "grade": "B", "missing": ["Permissions-Policy"] },
  "technologies": [{ "name": "Cloudflare", "category": "CDN", "version": null, "evidence": ["header"] }],
  "findings": [{ "area": "dns", "severity": "info", "code": "NO_CAA", "message": "No CAA records: ..." }],
  "summary": { "highFindings": 0, "mediumFindings": 0, "emailGrade": "A", "headersGrade": "B", "tlsDaysRemaining": 59 },
  "scrapedAt": "2026-10-01T19:30:00.000Z"
}

Domains that do not exist, or that fail unexpectedly, produce a free recordType: "error" record and never stop the run.

How much does it cost?

Pay per event: 0.006 USD per successfully analysed domain (6.00 USD per 1,000) plus a start fee of 0.00005 USD per run. Failed and non-existent domains produce a free error record. Platform usage is included in the event price.

Scenario	Results	Approx. cost
Quick check of one prospect	1	0.006 USD
Audit 100 client or prospect domains	100	0.60 USD
Weekly monitoring of 50 domains (about 4.3 runs/month)	50 per run	0.30 USD per run, about 1.29 USD/month
Bulk list of 1,000 domains	1,000	6.00 USD
One run with default settings (maxItems 100)	max 100	max 0.60 USD

Cost control: maxItems caps billed results per run (default 100); the Actor also stops when your run's maximum cost per run setting is reached. Test with 3-5 domains first.

Why this Actor (vs. alternatives)

Several Store Actors cover parts of this: email-deliverability checkers (SPF/DKIM/DMARC), DNS/WHOIS lookups, tech-stack detectors and security-posture checkers. This one returns DNS + email-auth grade + TLS + security-header score + cookie flags + tech stack + a prioritised findings list in one record per domain, with stable finding codes for alerting. It does not include WHOIS/RDAP or DNSSEC validation (some alternatives do) and it is not a vulnerability scanner. Prices of other Actors differ and change; compare on the Store page. (Based on public Store listings, 2026-10-02.)

Use it from n8n, Make, code and AI agents

• n8n / Make: "Run Actor" (Apify node/module) with {"domains": ["{{domain}}"]}, then read dataset items; route on summary.highFindings > 0 to alert your team.
• API:

curl -X POST "https://api.apify.com/v2/acts/ai_solution~website-domain-snapshot/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' -d '{"domains":["example.com"]}'

• MCP / AI agents: available through the Apify MCP server (https://mcp.apify.com, tool ai_solution/website-domain-snapshot). Fields and stable code values make results easy for an LLM to reason about.

Scheduling and webhooks

1. In Apify Console open Schedules, create e.g. 0 6 * * 1 (Mondays 06:00 UTC) and add this Actor with your domain list.
2. Add a webhook for ACTOR.RUN.SUCCEEDED (Actor Integrations tab) to your endpoint or an n8n/Make Webhook node; the payload contains resource.defaultDatasetId.
3. Read GET https://api.apify.com/v2/datasets/<defaultDatasetId>/items?token=... and alert when summary.highFindings > 0 or summary.tlsDaysRemaining < 14, or diff findings against the previous run.

How it works and good-citizen behaviour

DNS queries go to public resolvers (1.1.1.1 / 8.8.8.8). TLS is a single normal handshake. HTTP is one GET to the homepage like a browser would make, preceded by a robots.txt check; if the homepage is disallowed for this Actor the HTTP part is skipped and reported. The Actor identifies itself in its User-Agent, throttles per host and refuses private/localhost targets. It does not port-scan, brute-force subdomains or probe vulnerabilities, and it does not bypass bot protection.

Limitations

• DKIM selectors cannot be enumerated via DNS, so only ~25 common plus your custom selectors are probed; "not found" does not prove DKIM is absent.
• Technology detection uses an independent, built-in signature set based on headers, cookies, meta tags and script/link URLs of the homepage. It is not exhaustive and cannot see server-side-only technology.
• No WHOIS/RDAP data and no DNSSEC validation.
• Sites behind bot protection may return a challenge page; the Actor reports what it receives and does not try to bypass it.
• Grades are heuristics for triage, not a security audit.

Changelog

• 1.0.4 - Lower price: 0.006 USD per result (was 0.008 USD). No other changes.
• 1.0.3 - Clearer README (cost examples, comparison, scheduling), new Store title and description. No changes to input, output fields, behaviour or pricing.
• 1.0.2 - Output schema (dataset views in the Output tab).
• 1.0.0 - First release.

Support / Issues

Found a bug or need another check? Open a ticket in this Actor's Issues tab in Apify Console.

Legal

Only public DNS data, public TLS handshake data and a single public homepage request are used. No personal data is collected (DMARC report addresses are reduced to domains; cookie values are not stored). You are responsible for using the results lawfully.