Domain Health Checker: SPF, DKIM, DMARC, SSL & Security Headers

What does Domain Health Checker do?

Domain Health Checker audits any list of domains in bulk and tells you, in plain English, what's broken and how to fix it. For every domain you get:

• Email security and deliverability: SPF (including the 10-lookup limit), DKIM (30+ common selectors), DMARC policy, MTA-STS, TLS reporting and BIMI
• SSL certificate: issuer, expiry date, days left, trust errors and TLS version
• Website security: HTTP to HTTPS redirect, HSTS, Content-Security-Policy and other security headers
• DNS: DNSSEC, nameservers and DNS host
• Who they use: mail provider (Google Workspace, Microsoft 365, Zoho...), DNS host (Cloudflare, Route 53, GoDaddy...) and website platform (Shopify, WordPress, Wix...)
• A 0–100 score and an A–F grade, with every issue ranked by severity and a one-line fix

It only reads public information: DNS records, the TLS certificate, and the response headers of the home page. Page content is never downloaded and nothing is scanned or probed.

Who uses it?

• Cold email and lead-gen teams: check prospect lists or your own sending domains before a campaign so emails don't land in spam.
• IT service providers and MSPs: find local businesses with spoofable domains or expiring certificates and offer to fix them.
• Agencies: run a quick health report for every client domain each month.
• Security and IT teams: audit all the domains your company owns, including forgotten ones.
• Sales teams: see which prospects use Google Workspace vs Microsoft 365, or Shopify vs WordPress.

How much does it cost?

You pay per domain checked, and nothing else. Domains that don't exist, invalid input and lookups that time out are never charged. Set a spending limit on the run and the checker stops before going over it.

How to use it

1. Paste your domains into Domains, one per line. Website URLs and email addresses work too; duplicates are removed automatically.
2. Leave both checks on, or turn off the website check if you only care about email.
3. Click Start. A few hundred domains usually finish in a couple of minutes.
4. Open the Overview tab for one row per domain, or All issues with fixes for a to-do list. Export to CSV, Excel or JSON, or pull results through the API.

Input example

{
  "domains": ["example.com", "https://www.shopify.com", "sales@acme.co.uk"],
  "checkEmail": true,
  "checkWebsite": true
}

Output example

{
  "domain": "example.com",
  "grade": "C",
  "score": 72,
  "criticalIssues": 1,
  "warnings": 1,
  "topIssue": "No DMARC record. Spoofed email using this domain isn't blocked and the owner gets no reports.",
  "mailProvider": "Google Workspace",
  "dnsProvider": "Cloudflare",
  "spf": "ok",
  "dmarcPolicy": "missing",
  "dkimSelectors": ["google"],
  "sslDaysLeft": 61,
  "sslIssuer": "Let's Encrypt",
  "httpsRedirect": true,
  "hsts": false,
  "webTechnologies": ["Cloudflare", "WordPress"],
  "issues": [
    {
      "severity": "critical",
      "area": "DMARC",
      "message": "No DMARC record. Spoofed email using this domain isn't blocked and the owner gets no reports.",
      "fix": "Publish '_dmarc' TXT 'v=DMARC1; p=none; rua=mailto:<you>' then tighten to quarantine/reject."
    }
  ],
  "details": { "...": "every raw record and measurement" },
  "checkedAt": "2026-10-15T14:00:00+00:00"
}

How the score works

Every domain starts at 100. Each critical issue removes 20 points, each warning 8 and each info item 2. Grades: A is 90+, B is 80+, C is 70+, D is 60+, F is below 60.

Critical issues are things that let attackers spoof the domain or break the site: no SPF or DMARC, broken SPF, an expired or untrusted certificate.

FAQ

Why does it say "No DKIM key found" when I know I have DKIM? DKIM keys can only be looked up by their selector name. The checker tries the 30+ most common ones. If yours is custom, add it under Extra DKIM selectors. A missing DKIM key is only ever reported as "info" for this reason.

Is this legal to run on domains I don't own? It reads the same public DNS records and certificate that every mail server and browser reads. It doesn't scan ports, test logins or crawl pages.

Can I schedule it? Yes. Save your input as a task and add a schedule (for example monthly) to track certificate expiry and email setup over time. Use an Apify webhook or integration to send the results to Slack, Google Sheets or email.

Something looks wrong. Open an issue on the Issues tab with the domain and what you expected. Fixes are usually shipped within a few days.