Bulk Domain Security Posture Checker

Audit public domains and export one normalized row per domain with DNS, SPF, optional-selector DKIM, DMARC, TLS certificate, HTTPS, and security-header observations.

This domain security checker turns live public protocol evidence into severity-tagged findings, a diagnostic score, timestamps, and practical remediation guidance. Use it for one-time reviews or scheduled portfolio checks in Apify.

What does Bulk Domain Security Posture Checker do?

For every unique hostname, the Actor checks:

• A and AAAA address records
• MX and authoritative NS records
• CAA certificate-authority restrictions
• SPF presence, multiplicity, weak policies, and DNS-lookup pressure
• DMARC presence, policy, percentage, subdomain policy, and reporting destinations
• caller-supplied DKIM selectors
• TLS reachability, trust, protocol, cipher, issuer, subject, and validity dates
• HTTPS status, redirect destination, and response time
• HSTS, CSP, nosniff, clickjacking, referrer, and permissions controls

It returns partial observations when one subsystem fails. A missing DNS record is a typed finding, not a silently dropped domain.

Who is it for?

Security teams can triage a company domain portfolio.

Managed service providers can produce comparable customer-domain reports.

IT and email administrators can find SPF and DMARC remediation work.

Platform teams can watch certificate expiry and web-header regressions.

Data teams can export normalized rows to a warehouse, spreadsheet, webhook, or reporting workflow.

This Actor is diagnostic. It does not certify compliance and does not perform intrusive vulnerability scanning.

Why use this Actor?

• One row per domain: easy to compare between scheduled runs.
• Broad posture in one request: DNS, email authentication, TLS, HTTPS, and headers share one output contract.
• Explicit DKIM behavior: selectors are optional; without them DKIM is not_checked, never guessed.
• Remediation-ready findings: every finding has severity, category, stable code, message, and suggested action.
• Bounded network behavior: DNS retries and one HTTPS transient retry are built in; there is no hidden browser or residential-proxy fallback.
• International domain support: Unicode hostnames are normalized to ASCII/Punycode.

What data is returned?

Field	Meaning
input	Original domain or URL supplied
domain	Normalized hostname checked
status	secure, attention, high_risk, or error
score	Diagnostic score from 0 to 100
highestSeverity	Highest current finding severity
findingCount	Number of findings
findings[]	Severity, category, code, message, and remediation
dns	A, AAAA, MX, NS, CAA, and resolver errors
spf	SPF status, optional raw values, and lookup mechanism count
dmarc	Policy, enforcement state, reporting URIs, and optional raw values
dkim	Per-selector query observations
tls	Certificate and negotiated TLS observations
https	Status, final URL, timing, and security headers
checkedAt	UTC audit timestamp
durationMs	Total time spent on the domain

Output fields are nullable where the public service does not expose a value or a subsystem is unreachable.

How to run your first audit

1. Open the Actor in Apify Console.
2. Add one or more public domains in Domains or URLs.
3. Optionally add DKIM selectors you know are used by those domains.
4. Keep concurrency at 10 for a normal portfolio.
5. Click Start.
6. Open the default dataset to inspect or export the normalized rows.
7. Schedule the Task when you want recurring snapshots.

A useful starter input is:

{
  "domains": ["apify.com", "github.com", "wikipedia.org"],
  "concurrency": 3,
  "timeoutMs": 10000
}

Input parameters

domains

Required list of 1–1,000 public domain names or URLs. URLs are reduced to hostnames and duplicates are checked once. IP literals, single-label names, empty strings, and malformed hostnames fail input validation.

dkimSelectors

Optional list of up to 20 DNS-safe selectors. Examples include google, selector1, and selector2. DKIM selectors are chosen by each sender and cannot be enumerated reliably through DNS. If this list is empty, output reports dkim.status as not_checked.

concurrency

Number of domains processed together, from 1 to 50. The default is 10. Lower it for slow or fragile infrastructure.

timeoutMs

Per-operation timeout from 1,000 to 30,000 milliseconds. The default is 10,000.

includeRawRecords

When enabled, raw SPF, DMARC, and matched DKIM values are included. Parsed status and remediation fields are always available.

Output example

This abbreviated record reflects the current output shape:

{
  "input": "apify.com",
  "domain": "apify.com",
  "status": "attention",
  "score": 90,
  "highestSeverity": "low",
  "findingCount": 2,
  "findings": [
    {
      "severity": "low",
      "category": "headers",
      "code": "missing_permissions_policy",
      "message": "Permissions-Policy is absent.",
      "remediation": "Disable browser capabilities the application does not need."
    }
  ],
  "spf": { "status": "valid", "record": null, "records": [], "lookupMechanismCount": 2 },
  "dmarc": { "status": "enforced", "policy": "reject", "percentage": 100 },
  "dkim": { "status": "not_checked", "selectors": [] },
  "tls": { "reachable": true, "authorized": true, "protocol": "TLSv1.3" },
  "https": { "reachable": true, "statusCode": 200, "finalUrl": "https://apify.com/" },
  "checkedAt": "2025-01-15T12:00:00.000Z",
  "durationMs": 742
}

Exact records, certificates, headers, scores, and findings change as domain owners update infrastructure.

How findings and scores work

Findings are ordered from highest to lowest severity.

Critical findings include an unreachable TLS service, an untrusted certificate, or an expired certificate.

High findings include missing SPF/DMARC, invalid duplicate policies, no nameservers, certificate expiry within 30 days, legacy TLS, or an HTTPS server error.

Medium and low findings identify weaker policies and missing defense-in-depth headers.

The score subtracts fixed weights from 100 and floors at zero. It is a prioritization aid, not a standards audit, penetration test, or guarantee of security.

How much does it cost to check domain security posture?

Pay-per-event pricing includes a $0.005 start fee and one charge per emitted domain report.

Apify plan tier	Price per domain
Free	$0.02760
Bronze	$0.02400
Silver	$0.01872
Gold	$0.01440
Platinum	$0.01440
Diamond	$0.01440

At Bronze, 1 domain costs about $0.029, 10 domains about $0.245, and 100 domains about $2.405, including one start event. Platform usage is included in PPE pricing; failed input validation does not create domain rows.

Prices shown here must match the active Actor pricing configuration. Apify may apply plan-specific billing behavior.

Recurring portfolio monitoring

Create an Apify Task with a stable domain list and schedule it daily, weekly, or monthly. Each run writes fresh checkedAt, certificate lifetime, status, score, and finding codes.

For change tracking, compare rows by domain. Alert when:

• highestSeverity increases
• a new finding code appears
• tls.daysRemaining crosses your threshold
• dmarc.status leaves enforced
• HTTPS becomes unreachable
• a required security header disappears

The Actor stores snapshots; it does not send alerts or compare prior datasets by itself.

Export and integration workflows

Download the dataset as JSON, CSV, Excel, XML, or RSS from Apify.

Connect runs to:

• Google Sheets for remediation registers
• Slack or email automation for high-severity findings
• a SIEM or warehouse for trend analysis
• Make, Zapier, n8n, or webhooks
• an internal asset inventory keyed by normalized domain

Stable finding codes are better automation keys than human-readable messages.

Run with the Apify API

Replace YOUR_TOKEN with an Apify API token.

cURL

curl -X POST \
  "https://api.apify.com/v2/acts/automation-lab~bulk-domain-security-posture-checker/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["apify.com","github.com"],"dkimSelectors":["google"]}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('automation-lab/bulk-domain-security-posture-checker').call({
  domains: ['apify.com', 'github.com'],
  dkimSelectors: ['google'],
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("automation-lab/bulk-domain-security-posture-checker").call(
    run_input={"domains": ["apify.com", "github.com"]}
)
items = client.dataset(run["defaultDatasetId"]).list_items().items
print(items)

Use with Apify MCP

Add this Actor to Claude Code:

claude mcp add --transport http apify \
  "https://mcp.apify.com?tools=automation-lab/bulk-domain-security-posture-checker"

Claude Desktop, Cursor, and VS Code setup

For Claude Desktop, Cursor, VS Code, or another MCP-capable desktop/editor client:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=automation-lab/bulk-domain-security-posture-checker"
    }
  }
}

Example prompts:

• “Audit apify.com and github.com, then summarize only high and critical findings.”
• “Check these customer domains and return a CSV-ready remediation list.”
• “Run the domain portfolio Task and compare finding codes with last week’s dataset.”

Reliability, retries, and network vantage point

The Actor runs direct DNS, TLS, and HTTPS checks from its Apify container. That is the observed vantage point; results may differ from a corporate network, another geography, split-horizon DNS, or a browser with authenticated cookies.

The DNS resolver makes two attempts. HTTPS makes one bounded retry for transient network/status failures. Stable malformed inputs are not retried. There is no automatic residential proxy or browser fallback.

Each domain still gets a row when only part of the audit fails. Inspect dns.errors, tls.error, https.error, and related findings.

Limits and interpretation

• Only public domain infrastructure is supported.
• The Actor does not scan ports other than TLS on 443.
• It does not test application vulnerabilities, cipher suites exhaustively, DNSSEC validation chains, certificate-chain internals, MTA-STS, TLS-RPT, BIMI, or SMTP delivery.
• A DKIM result covers only selectors you supply.
• Wildcard, CDN, geolocation, and load-balancer behavior can vary between runs.
• Security headers on / may differ from headers on other routes.
• HSTS should be enabled carefully only after HTTPS coverage is complete.
• Scores are diagnostic and may not match an organization’s risk framework.

Legality and responsible use

The Actor queries public DNS and makes a normal HTTPS request to each supplied hostname. Use it only for domains you are authorized to assess and at a reasonable frequency.

Do not describe the output as a compliance certificate, penetration test, or proof that a domain is safe. Review remediation against your architecture and change-management process.

Avoid placing credentials, private hostnames, session cookies, or personal data in input. This Actor does not need them.

Troubleshooting

Why is DKIM not_checked?

No selectors were supplied. Add the selector names configured by the domain’s mail providers. The Actor intentionally does not guess a fixed universal list.

Why is a known domain marked error?

Several DNS operations plus TLS and HTTPS were unreachable from the run. Check dns.errors, tls.error, and https.error, increase timeoutMs within the supported range, then confirm the hostname is public.

Why did two inputs produce one row?

URLs and hostnames are normalized and deduplicated. https://www.example.org/path and www.example.org refer to the same hostname.

Why did the score change?

DNS, certificates, redirects, headers, and upstream availability are live observations. Compare finding codes and raw subsystem fields to explain the change.

Related Automation Lab Actors

• Bulk DMARC Record Checker for deeper DMARC syntax and reporting diagnostics.
• Bulk DNS Record Lookup for general A, AAAA, MX, NS, TXT, CNAME, and SOA inventory.
• Domain Registration & RDAP Lookup for registrar, expiry, nameserver, and registration status data.
• Lighthouse Website Audit for performance, accessibility, best-practice, and SEO checks.

Use this Actor when the primary job is a normalized cross-layer security posture report rather than one specialized protocol lookup.

FAQ

Does the Actor modify a domain?

No. It performs read-only public DNS queries, a TLS handshake, and an HTTPS GET.

Can it check subdomains?

Yes. Supply each public subdomain as its own input. Email-authentication policies can inherit differently, so interpret missing records in context.

Does a score of 100 prove a domain is secure?

No. It only means this bounded checklist produced no findings. Application security and many infrastructure controls are outside scope.

Can I run it on a schedule?

Yes. Save the input as an Apify Task and configure a schedule. Dataset rows contain timestamps suitable for snapshot comparison.

Are raw SPF and DMARC values included?

Only when includeRawRecords is true. Parsed statuses and findings are always returned.

What happens when one domain is offline?

The Actor emits a typed row with errors and remediation findings, then continues with the remaining domains.