Bulk Domain Checker: DNS, HTTP Status, SSL & WHOIS

Paste a list of domains. Get back one row per domain with everything you would otherwise collect by hand from five different tools: DNS records, the mail provider behind the MX, SPF and DMARC, HTTP status and the full redirect chain, SSL certificate expiry, and WHOIS/RDAP registration data — plus a short, plain-English list of what is actually wrong with each domain.

No API keys. No account anywhere else. Nothing to configure.

What you get per domain

Group	Fields
Verdict	status (live / parked / unreachable / client_error / server_error / does_not_resolve / not_registered), healthScore (0–100), issues[]
Reachability	httpsStatus, httpStatus, finalUrl, redirectCount, redirectChain[], redirectsOffsite, httpsUpgrade, hsts, serverHeader
DNS	ipv4[], ipv6[], hasIpv6, nameservers[], dnsProvider, cname
Email	acceptsEmail, mx[], mxProvider, hasSpf, spfRecord, hasDmarc, dmarcPolicy, emailReady
Certificate	certIssuer, certValidTo, certDaysUntilExpiry, certExpired, certHostnameMatches, certTrusted, tlsProtocol
Registration	registered, registrar, domainCreatedAt, domainExpiresAt, domainAgeDays, domainStatuses[]

The issue list is the point

Raw DNS dumps are easy to get and hard to act on. Every run also returns a punch list you can hand to someone:

"issues": [
  { "severity": "high",   "code": "cert_expiring",       "message": "TLS certificate expires in 9 days." },
  { "severity": "medium", "code": "no_https_redirect",   "message": "HTTP does not redirect to HTTPS." },
  { "severity": "medium", "code": "no_dmarc",            "message": "No DMARC record." },
  { "severity": "info",   "code": "redirects_offsite",   "message": "HTTPS ends up on newbrand.com." }
]

Sort by highSeverityCount and the domains that need attention today are at the top.

Typical uses

• Certificate and domain expiry watch — schedule a daily run over the domains you own and alert on certDaysUntilExpiry or domainExpiresAt.
• Clean a prospect list before a campaign — drop anything that is parked, does_not_resolve, or not_registered, and segment what is left by mxProvider.
• Post-migration check — confirm every old domain still redirects where you think it does, using finalUrl and redirectChain.
• Due diligence on a domain portfolio — domainAgeDays, registrar and domainStatuses in one table.

Input

{
  "domains": ["apify.com", "https://www.example.com/pricing", "example.org"],
  "checkHttp": true,
  "checkCertificate": true,
  "checkEmail": true,
  "checkRegistration": true,
  "maxConcurrency": 10
}

• domains accepts bare domains or full URLs — URLs are reduced to the domain automatically. A single entry may hold many domains separated by spaces, commas or newlines, so pasting a column out of a spreadsheet works.
• Turn individual checks off to run faster over a large list.
• dnsServers (optional) resolves against specific servers, e.g. ["1.1.1.1"].

Notes on accuracy

Small details that are easy to get wrong, and how this Actor handles them:

• A null MX (RFC 7505) is not a missing MX. A domain publishing MX . has deliberately opted out of email; it is reported as null_mx (info), and no SPF/DMARC findings are raised against it.
• Registration is looked up on the registrable domain. A query for status.example.co.uk walks up until RDAP has an answer, so subdomains are not reported as unregistered.
• DNS beats RDAP. Anything that resolves is treated as registered, because RDAP legitimately returns nothing for some registries.
• Wildcard certificates cover exactly one label. *.example.com matches www.example.com but not a.b.example.com.
• The certificate is read even when it is invalid. Reporting "expired" or "hostname mismatch" requires completing the handshake without verification; nothing is ever sent over that socket, and the verification result is reported verbatim as certTrusted.

What it does not do

• It does not fetch or parse page content — only status codes and response headers.
• It does not connect to mail servers. Whether an individual mailbox exists cannot be answered here; only whether the domain is set up to receive mail at all.
• It reads public DNS, public certificates and public registration data. It does not attempt to access anything that is not already served to any client.

Performance

Checks for one domain run in parallel, and domains run through a fixed-size worker pool, so memory stays flat regardless of list length. A healthy domain with every check enabled takes well under a second; unreachable ones are bounded by short per-check timeouts rather than hanging the run.

---

Built by Ai-Q Labs.