Bulk Domain Security Posture Checker

Audit public domains and export one normalized row per domain with DNS, SPF, optional-selector DKIM, DMARC, TLS certificate, HTTPS, and security-header observations.

This domain security checker turns live public protocol evidence into severity-tagged findings, a diagnostic score, timestamps, and practical remediation guidance. Use it for one-time reviews or scheduled portfolio checks in Apify.

What does Bulk Domain Security Posture Checker do?

For every unique hostname, the Actor checks:

• A and AAAA address records
• MX and locally published NS records (not a delegation audit)
• Local CAA records (without claiming that absence rules out inherited policy)
• SPF presence, multiplicity, weak policies, and DNS-lookup pressure
• DMARC presence, policy, percentage, subdomain policy, and reporting destinations
• caller-supplied DKIM selectors
• TLS reachability, trust, protocol, cipher, issuer, subject, and validity dates
• HTTPS status, redirect destination, and response time
• HSTS, CSP, nosniff, clickjacking, referrer, and permissions controls

It returns partial observations when one subsystem fails. A missing DNS record is a typed finding, not a silently dropped domain.

Who is it for?

Security teams can triage a company domain portfolio.

Managed service providers can produce comparable customer-domain reports.

IT and email administrators can find SPF and DMARC remediation work.

Platform teams can watch certificate expiry and web-header regressions.

Data teams can export normalized rows to a warehouse, spreadsheet, webhook, or reporting workflow.

This Actor is diagnostic. It does not certify compliance and does not perform intrusive vulnerability scanning.

Why use this Actor?

• One row per domain: easy to compare between scheduled runs.
• Broad posture in one request: DNS, email authentication, TLS, HTTPS, and headers share one output contract.
• Explicit DKIM behavior: selectors are optional; without them DKIM is not_checked, never guessed.
• Remediation-ready findings: every finding has severity, category, stable code, message, and suggested action.
• Bounded network behavior: DNS retries and one HTTPS transient retry are built in; there is no hidden browser or residential-proxy fallback.
• International domain support: Unicode hostnames are normalized to ASCII/Punycode.

What data is returned?

Field	Meaning
input	Sanitized normalized hostname; URL paths, credentials, query strings and fragments are not retained
domain	Normalized hostname checked
status	secure, attention, high_risk, or error
score	Diagnostic score from 0 to 100
highestSeverity	Highest current finding severity
findingCount	Number of findings
findings[]	Severity, category, code, message, and remediation
dns	A, AAAA, MX, NS, CAA, and resolver errors
spf	SPF status, optional raw values, and lookup mechanism count
dmarc	Policy, enforcement state, reporting URIs, and optional raw values
dkim	Per-selector query observations
tls	Certificate and negotiated TLS observations
https	Status, final URL, timing, and security headers
checkedAt	UTC audit timestamp
durationMs	Total time spent on the domain
assessmentComplete	All requested observations available; not full standards validation
spfStatus, dmarcStatus, effectiveDmarcPolicy	Flat basic/legacy-compatible email assessment for exports
certificateDaysRemaining, httpsStatusCode	Flat certificate/HTTPS observations
remediationSummary	Finding codes and actions in one spreadsheet-friendly cell

Output fields are nullable where the public service does not expose a value or a subsystem is unreachable.

How to run your first audit

1. Open the Actor in Apify Console.
2. Add one or more public domains in Domains or URLs.
3. Optionally add DKIM selectors you know are used by those domains.
4. Keep concurrency at 10 for a normal portfolio.
5. Click Start.
6. Open the default dataset to inspect or export the normalized rows.
7. Schedule the Task when you want recurring snapshots.

A useful starter input is:

{
  "domains": ["apify.com", "github.com", "wikipedia.org"],
  "concurrency": 3,
  "timeoutMs": 10000
}

Input parameters

domains

Required list of 1–1,000 public domain names or HTTP(S) URLs without credentials or non-default ports. URLs are reduced to hostnames; paths, query strings and fragments are discarded. Duplicates are checked once; distinct subdomains remain distinct. IP literals, single-label names, empty strings, malformed hostnames and unsupported schemes fail validation before charging. Resolved TLS/HTTPS destinations must be public, including every redirect hop; private, reserved, mixed public/private answers and unresolved address families fail closed.

dkimSelectors

Optional list of up to 20 DNS-safe selectors. Examples include google, selector1, and selector2. DKIM selectors are chosen by each sender and cannot be enumerated reliably through DNS. If this list is empty, output reports dkim.status as not_checked.

concurrency

Number of domains processed together, from 1 to 50. The default is 10. Lower it for slow or fragile infrastructure.

timeoutMs

Per-operation timeout from 1,000 to 30,000 milliseconds. The default is 10,000.

includeRawRecords

When enabled, raw SPF, DMARC, and matched DKIM values are included. Parsed status and remediation fields are always available.

Output example

This abbreviated record comes from a local candidate audit on 2026-10-24; omitted nested fields remain in the complete JSON. Values are observations, not fixed expected scores:

{
  "input": "apify.com",
  "domain": "apify.com",
  "status": "attention",
  "score": 90,
  "highestSeverity": "low",
  "findingCount": 2,
  "findings": [
    {
      "severity": "low",
      "category": "headers",
      "code": "missing_permissions_policy",
      "message": "Permissions-Policy is absent.",
      "remediation": "Disable browser capabilities the application does not need."
    },
    {
      "severity": "low",
      "category": "headers",
      "code": "missing_referrer_policy",
      "message": "Referrer-Policy is absent.",
      "remediation": "Set an explicit Referrer-Policy appropriate for the application."
    }
  ],
  "assessmentComplete": true,
  "spf": { "status": "valid", "record": null, "records": [], "lookupMechanismCount": 6, "fullEvaluationPerformed": false },
  "dmarc": { "status": "enforced", "policy": "reject", "percentage": 100 },
  "dkim": { "status": "not_checked", "selectors": [] },
  "tls": { "reachable": true, "authorized": true, "protocol": "TLSv1.3" },
  "https": { "reachable": true, "statusCode": 200, "finalUrl": "https://apify.com/" },
  "checkedAt": "2026-10-24T10:40:40.863Z"
}

Exact records, certificates, headers, scores, and findings change as domain owners update infrastructure.

How findings and scores work

Findings are ordered from highest to lowest severity.

Critical findings include an unreachable TLS service, an untrusted certificate, or an expired certificate.

High findings include confirmed missing SPF/DMARC, invalid/duplicate policies, certificate expiry within 30 days, legacy TLS, or an HTTPS server error. Transient TXT/DMARC/DKIM resolver failures produce unknown, not missing-policy findings. dns.errors identifies unavailable operations; no local NS/CAA absence is interpreted as a registrar or inherited-CAA defect.

SPF is a basic local assessment, not a recursive SPF evaluator. lookupMechanismCount estimates reachable local lookup terms only; includes/redirects are not expanded. Bare all and +all allow all senders; terms after all do not affect effective-policy conclusions. valid means this limited check found no basic issue, not proof of RFC-complete SPF validity.

DMARC uses an explicitly RFC 7489-compatible diagnostic model: exact-host precedence, then one organizational-domain fallback using a maintained public-suffix implementation. policySource, inherited and effectivePolicy expose p/sp provenance; percentage/enforcement describe legacy pct semantics (0: no enforcement, 1–99: partial, 100: full). Duplicate/malformed tags and out-of-range percentages are reported invalid.

Current-standard limit: RFC 9989 supersedes RFC 7489, uses bounded DNS tree-walk discovery and removes pct. This Actor does not simulate a current mail receiver, tree-walk/PSD policy discovery, np handling, message alignment or actual delivery. Its legacy-compatible effective policy and pct diagnostic must not be treated as the action every current receiver applies. Consult your mail provider for current enforcement; a complete snapshot is not a complete standards evaluation.

Medium and low findings identify weaker policies and missing defense-in-depth headers.

The score subtracts fixed weights from 100 and floors at zero. It is a prioritization aid, not a standards audit, penetration test, or guarantee of security.

How much does it cost to check domain security posture?

Pay-per-event pricing includes a $0.005 start fee and one charge per emitted domain report.

Apify plan tier	Price per domain
Free	$0.02760
Bronze	$0.02400
Silver	$0.01872
Gold	$0.01440
Platinum	$0.01440
Diamond	$0.01440

At Bronze, 1 domain costs about $0.029, 10 domains about $0.245, and 100 domains about $2.405, including one start event. Platform usage is included in PPE pricing; failed input validation does not create domain rows.

Prices shown here must match the active Actor pricing configuration. Apify may apply plan-specific billing behavior.

Recurring portfolio monitoring

Create an Apify Task with a stable domain list and schedule it daily, weekly, or monthly. Each run writes fresh checkedAt, certificate lifetime, status, score, and finding codes.

For change tracking, compare rows by domain. Alert when:

• highestSeverity increases
• a new finding code appears
• tls.daysRemaining crosses your threshold
• dmarc.status leaves enforced
• HTTPS becomes unreachable
• a required security header disappears

The Actor stores snapshots; it does not send alerts or compare prior datasets by itself.

Export and integration workflows

Download the dataset as JSON, CSV, Excel, XML, or RSS from Apify. The overview uses flat email/TLS/HTTPS columns; focused Email policy evidence, Certificate and HTTPS evidence, and Remediation register views support spreadsheet workflows. Full nested JSON is preserved.

Connect runs to:

• Google Sheets for remediation registers
• Slack or email automation for high-severity findings
• a SIEM or warehouse for trend analysis
• Make, Zapier, n8n, or webhooks
• an internal asset inventory keyed by normalized domain

Stable finding codes are better automation keys than human-readable messages.

Run with the Apify API

Replace YOUR_TOKEN with an Apify API token.

cURL

curl -X POST \
  "https://api.apify.com/v2/acts/automation-lab~bulk-domain-security-posture-checker/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["apify.com","github.com"],"dkimSelectors":["google"]}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('automation-lab/bulk-domain-security-posture-checker').call({
  domains: ['apify.com', 'github.com'],
  dkimSelectors: ['google'],
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("automation-lab/bulk-domain-security-posture-checker").call(
    run_input={"domains": ["apify.com", "github.com"]}
)
items = client.dataset(run["defaultDatasetId"]).list_items().items
print(items)

Use with Apify MCP

Add this Actor to Claude Code:

claude mcp add --transport http apify \
  "https://mcp.apify.com?tools=automation-lab/bulk-domain-security-posture-checker"

Claude Desktop, Cursor, and VS Code setup

For Claude Desktop, Cursor, VS Code, or another MCP-capable desktop/editor client:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=automation-lab/bulk-domain-security-posture-checker"
    }
  }
}

Example prompts:

• “Audit apify.com and github.com, then summarize only high and critical findings.”
• “Check these customer domains and return a CSV-ready remediation list.”
• “Run the domain portfolio Task and compare finding codes with last week’s dataset.”

Reliability, retries, and network vantage point

The Actor runs direct DNS, TLS, and HTTPS checks from its Apify container. That is the observed vantage point; results may differ from a corporate network, another geography, split-horizon DNS, or a browser with authenticated cookies.

The DNS resolver makes up to two attempts under a shared per-domain DNS deadline. TLS and HTTPS validate all resolved addresses and connect to a pinned public address, preserving hostname/SNI. HTTPS uses normal certificate validation, at most five HTTPS redirects on port 443, one transient retry across the operation, a 16 KiB header ceiling, and a total request deadline. It performs GET but cancels immediately after headers rather than downloading the body. Redirect queries/fragments are discarded; destinations requiring them may fail. The separate TLS probe observes untrusted certificates for diagnostics, without weakening HTTPS verification. Stable malformed inputs are not retried. There is no automatic residential proxy or browser fallback.

The run stops admitting domains at the available paid-report budget, including at high concurrency. SDK-integrated persistence/charging keeps one domain event per delivered report; invalid input produces no start or domain charge.

Each domain still gets a row when only part of the audit fails. Inspect dns.errors, tls.error, https.error, and related findings.

Limits and interpretation

• Only public domain infrastructure is supported.
• The Actor does not scan ports other than TLS on 443.
• It does not test application vulnerabilities, cipher suites exhaustively, DNSSEC validation chains, certificate-chain internals, MTA-STS, TLS-RPT, BIMI, or SMTP delivery.
• A DKIM result covers only selectors you supply.
• Wildcard, CDN, geolocation, and load-balancer behavior can vary between runs.
• Security headers on / may differ from headers on other routes.
• HSTS should be enabled carefully only after HTTPS coverage is complete.
• Scores are diagnostic and may not match an organization’s risk framework.

Legality and responsible use

The Actor queries public DNS and makes a normal HTTPS request to each supplied hostname. Use it only for domains you are authorized to assess and at a reasonable frequency.

Do not describe the output as a compliance certificate, penetration test, or proof that a domain is safe. Review remediation against your architecture and change-management process.

Avoid placing credentials, private hostnames, session cookies, or personal data in input. This Actor does not need them.

Diagnostic privacy

Failed operations send sanitized diagnostic input, exceptions, and Actor/build/run IDs to our private GlitchTip service for repair. Secret fields and URL queries/fragments are removed; this Actor additionally redacts the entire supplied domain list in telemetry. Reports are retained for 30 days. Dataset input values contain only normalized hostnames. Apify still stores your original run input under its own access and retention controls.

Dependencies, storage and support

The Actor uses public DNS resolvers, target domain infrastructure, Apify storage/compute/billing and our private GlitchTip diagnostics. These operational costs are included in the documented pay-per-event price; no external account/key or off-platform fee is required. No AI/model provider is used and no input/output is sent for model training. It is an independent Automation Lab tool, not affiliated with or endorsed by the domains assessed.

Dataset reports, original input and run logs follow your Apify account's retention/access controls; delete them through Apify Console/API. The Actor creates no separate persistent cache or customer-domain database. Private diagnostic reports have 30-day retention; request help or diagnostic deletion through the Actor's Issues tab. Include a run link and a safe description, never credentials or private input.

Troubleshooting

Why is DKIM not_checked?

No selectors were supplied. Add the selector names configured by the domain’s mail providers. The Actor intentionally does not guess a fixed universal list.

Why is a known domain marked error?

Several DNS operations plus TLS and HTTPS were unreachable from the run. Check dns.errors, tls.error, and https.error, increase timeoutMs within the supported range, then confirm the hostname is public.

Why did two inputs produce one row?

URLs and hostnames are normalized and deduplicated. https://www.example.org/path and www.example.org refer to the same hostname.

Why did the score change?

DNS, certificates, redirects, headers, and upstream availability are live observations. Compare finding codes and raw subsystem fields to explain the change.

Related Automation Lab Actors

• Bulk DMARC Record Checker for deeper DMARC syntax and reporting diagnostics.
• Bulk DNS Record Lookup for general A, AAAA, MX, NS, TXT, CNAME, and SOA inventory.
• Domain Registration & RDAP Lookup for registrar, expiry, nameserver, and registration status data.
• Lighthouse Website Audit for performance, accessibility, best-practice, and SEO checks.

Use this Actor when the primary job is a normalized cross-layer security posture report rather than one specialized protocol lookup.

FAQ

Does the Actor modify a domain?

No. It performs read-only public DNS queries, a TLS handshake, and an HTTPS GET.

Can it check subdomains?

Yes. Supply each public subdomain as its own input. Exact-host DMARC is preferred; the documented legacy-compatible PSL fallback exposes policy provenance. SPF is local; NS/CAA are local observations, not exhaustive inherited-policy audits.

Does a score of 100 prove a domain is secure?

No. It only means this bounded checklist produced no findings. Application security and many infrastructure controls are outside scope.

Can I run it on a schedule?

Yes. Save the input as an Apify Task and configure a schedule. Dataset rows contain timestamps suitable for snapshot comparison.

Are raw SPF and DMARC values included?

Only when includeRawRecords is true. Parsed statuses and findings are always returned.

What happens when one domain is offline?

The Actor emits a typed row with errors and remediation findings, then continues with the remaining domains.