Audit 1,000 domains for $1.00 instead of a $180 consultant report

Bulk Domain Security & SSL/TLS Audit Tool

Enterprise domain security & technical email authentication auditing for outbound lists, MSP client monitoring, and IT compliance. Audit domains for SSL/TLS expiration, HTTP security headers, SPF RFC 7208 lookup limits, DMARC policies, and RDAP registration age.

---

⚡ The Pain vs. Automated Relief

Operational Problem	Automated Diagnostic Relief
Expired SSL Certificates: Expired certificates trigger full-screen browser warnings that destroy buyer trust and halt conversions.	Proactive Expiry Detection: Alerts pinpoint certificates expiring within 14 to 30 days, complete with issuer, SAN hostnames, and remaining lifespan.
Authentication Failures (Google/Yahoo Standards): Missing SPF records, dangerous +all wildcards, or exceeding the RFC 7208 10-lookup limit cause mailbox authentication failures.	RFC 7208 & DMARC Validation: Recursively resolves SPF lookup depth, detects lookup overflows (>10) and circular loops, and verifies DMARC enforcement (reject, quarantine, none).
Missing HTTP Defenses: Absent HSTS, CSP, or X-Frame-Options headers leave domains vulnerable to protocol downgrades, clickjacking, and mime-sniffing.	Deterministic A+ to F Grading: Objective 0–100 compliance scoring with specific remediation strings for engineering teams.
Burner & Disposable Domains: Outbound lists often contain newly registered disposable domains with poor sender reputation.	RDAP Age Intelligence: Identifies domain registration dates, registrar name, and flags burner domains younger than 30 days.
Manual Terminal Auditing: Running openssl, dig, curl -I, and whois manually takes 15–20 minutes per domain.	Parallel Batch Audits: Scans 1 to 1,000 domains per run concurrently with configurable timeouts and rate controls.

---

💰 Cost Comparison vs. Enterprise Security SaaS

Solution	Model & Pricing	Setup & Lock-in	Best Use Case
Enterprise Attack Surface Platforms	$300 – $800 / month	Annual contract, rigid domain caps	Internal continuous enterprise attack surface management
Fragmented Point Tools	$50 – $150 / month each	Multiple distinct subscriptions	Isolated single-purpose SSL or DMARC checking
Bulk Domain Security Auditor	$0.001 base audit / domain	Zero setup (Pay-Per-Event)	High-volume B2B outbound lists, MSP audits, & automated cron pipelines

(Note: Platform compute and memory consumption are distinct from Actor event fees. Depending on your Apify monetization setup and plan, platform compute may be covered by the publisher or billed to your account; users should not assume all-inclusive pricing).

---

🛡️ Fair-Billing Guarantee

No Event Charges on Resolution Failures (charged: false):
Custom event charges are bypassed (charged: false) when an input domain fails DNS resolution (DNS_NXDOMAIN or missing A/AAAA records), fails input normalization, violates anti-SSRF protections, or encounters a global wallclock timeout.
Note: If a domain resolves to a public IP but its web server closes port 443 or refuses connection, it is assessed as a failing posture (letter_grade: "F") and billed the base audit fee.

---

🚀 Core Audit Capabilities

1. Anti-SSRF & DNS Pre-Flight Validation: Resolves IPv4/IPv6 addresses and blocks loopback (127.0.0.1), private RFC 1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and AWS/cloud metadata endpoints (169.254.169.254). Re-verifies on redirects up to 5 hops.
2. Deep SSL/TLS & Trust Chain Verification: Direct port 443 socket connection extracting protocol version (TLSv1.2, TLSv1.3), cipher suite, certificate authority issuer, SAN hostnames, and exact days until expiration.
3. HTTP Security Headers & Redirect Audit: Audits HSTS (max-age >= 31536000), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and identifies server banner leaks (Server, X-Powered-By).
4. Technical Email Authentication Checks (RFC 7208 & DMARC): Fingerprints apex MX providers (Google Workspace, Microsoft 365, Cloudflare, Proton, Zoho), evaluates SPF syntax and recursive DNS lookups against the 10-lookup limit, and parses DMARC policy enforcement (reject, quarantine, none, or missing).
5. RDAP Domain Age & Registrar Intelligence: Queries official RDAP registries for registration date, domain age in days, registrar name, and flags burner domains (<30 days old).

(Note: This Actor does NOT inspect DNSSEC or CAA records).

---

💻 Quickstart Copy-Paste Integration Examples

1. cURL (Direct API)

Run a synchronous audit and retrieve dataset items directly:

curl -X POST "https://api.apify.com/v2/acts/deepaksheoran172~domain-security-super-auditor/run-sync-get-dataset-items" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["stripe.com", "github.com"],
    "include_dns_deliverability": true,
    "include_rdap_age": true,
    "alert_threshold_days": 30
  }'

2. Python (official apify-client)

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")

run_input = {
    "domains": ["stripe.com", "github.com", "example.com"],
    "include_dns_deliverability": True,
    "include_rdap_age": True,
    "alert_threshold_days": 30,
    "concurrency": 10,
}

# Run the Actor and wait for completion
run = client.actor("deepaksheoran172/domain-security-super-auditor").call(run_input=run_input)

# Fetch dataset results
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(f"Domain: {item['domain']} | Grade: {item['letter_grade']} | Score: {item['overall_score']}")

3. Node.js / JavaScript (official apify-client)

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({
    token: 'YOUR_APIFY_TOKEN',
});

const input = {
    domains: ['stripe.com', 'github.com'],
    include_dns_deliverability: true,
    include_rdap_age: true,
};

const run = await client.actor('deepaksheoran172/domain-security-super-auditor').call(input);
const { items } = await client.dataset(run.defaultDatasetId).listItems();

console.log(items);

4. Clay.com Outbound Table Enrichment

Enrich company account lists in Clay with cybersecurity posture and SSL expiry signals:

• Action: HTTP API Request
• Method: POST
• URL: https://api.apify.com/v2/acts/deepaksheoran172~domain-security-super-auditor/run-sync-get-dataset-items
• Security & Authentication: Configure your Authorization header securely through Clay's workspace-level HTTP API (Headers) account (Bearer YOUR_APIFY_TOKEN). Never put tokens in query strings or request bodies.
• Request Headers:
  • Content-Type: application/json
  • Authorization: Bearer {{apify_api_token}}
• Request Body:

  {
    "domains": ["{{company.domain}}"],
    "include_dns_deliverability": true,
    "include_rdap_age": true,
    "timeout_seconds": 10
  }
  

• Verified Clay Column Extraction Formulas:
  • Composite Letter Grade: {{data[0].letter_grade}} (e.g. "A+", "B", "F")
  • Numeric Risk Score: {{data[0].overall_score}} (0–100)
  • Days Until SSL Expiry: {{data[0].ssl_audit.days_until_expiry}}
  • DMARC Policy Status: {{data[0].email_deliverability_audit.dmarc_policy}} (e.g. "reject", "quarantine", "none", "missing")
  • SPF Policy: {{data[0].email_deliverability_audit.spf_policy}} (e.g. "hardfail (-all)", "softfail (~all)", "dangerous (+all)", "missing")
  • Mail Provider: {{data[0].email_deliverability_audit.mx_provider}} (e.g. "Google Workspace", "Microsoft 365")

5. Claude Desktop & Cursor IDE (MCP Server)

{
  "mcpServers": {
    "domain-security-auditor": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch", "https://mcp.apify.com?tools=deepaksheoran172/domain-security-super-auditor"]
    }
  }
}

2. 1-Click cURL / n8n Webhook Trigger ($0.001/domain)

Trigger batch audits directly from your automation pipeline or CRM:

curl -X POST "https://api.apify.com/v2/acts/deepaksheoran172~domain-security-super-auditor/runs" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com", "targetdomain.org"],
    "include_dns_deliverability": true,
    "include_rdap_age": true
  }'

---

📥 Input Parameters

Parameter	Type	Required	Default	Description
domains	Array	Yes	["google.com", "cloudflare.com", "github.com"]	List of domain names, hostnames, or URLs to audit.
include_dns_deliverability	Boolean	No	true	Audit MX records, SPF syntax & RFC 7208 lookup limits, and DMARC enforcement. Assesses security-headers-dns-enrichment event ($0.001/domain). Defaults to true, so both base and enrichment events apply unless explicitly set to false.
include_rdap_age	Boolean	No	true	Query RDAP registries for registration date, domain age in days, and registrar name. (No additional event charge).
alert_threshold_days	Integer	No	30	Flag certificate as expiring soon if days <= threshold (1 to 365 days).
timeout_seconds	Integer	No	8	Network timeout limit per check in seconds (2 to 30 seconds).
concurrency	Integer	No	10	Concurrent domain workers (1 to 50).
max_domains	Integer	No	1000	Maximum number of domains to process in a single run (minimum: 1).

---

📤 Output Dataset Record Example (Illustrative)

The following record is an illustrative example demonstrating verified output schema structure and field types. It is not produced by a live Actor benchmark run.

{
  "domain": "example.com",
  "status": "COMPLETED",
  "charged": true,
  "events_charged": [
    "ssl-tls-base-audit",
    "security-headers-dns-enrichment"
  ],
  "audited_at": "2026-10-14T20:30:00Z",
  "resolved_ips": [
    "93.184.216.34"
  ],
  "overall_score": 92,
  "letter_grade": "A",
  "severity_status": "HEALTHY",
  "ssl_audit": {
    "status": "VALID",
    "tls_version": "TLSv1.3",
    "cipher_suite": "TLS_AES_256_GCM_SHA384",
    "issuer_org": "DigiCert Inc",
    "subject_cn": "example.com",
    "san_domains": [
      "example.com",
      "www.example.com"
    ],
    "hostname_matches_san": true,
    "valid_from_iso": "2026-01-15T00:00:00Z",
    "valid_to_iso": "2027-01-15T23:59:59Z",
    "days_until_expiry": 93,
    "is_expired": false,
    "expiring_soon": false,
    "trust_error": null
  },
  "http_headers_audit": {
    "status": "VALID",
    "enforces_https_redirect": true,
    "http_redirect_code": 301,
    "hsts_active": true,
    "hsts_max_age": 63072000,
    "csp_active": true,
    "x_frame_options": "DENY",
    "x_content_type_options": "nosniff",
    "referrer_policy": "strict-origin-when-cross-origin",
    "permissions_policy": null,
    "info_leakage_headers": {}
  },
  "email_deliverability_audit": {
    "status": "VALID",
    "mx_records": [
      "mail.example.com"
    ],
    "mx_provider": "Generic/Other",
    "spf_record": "v=spf1 -all",
    "spf_policy": "hardfail (-all)",
    "spf_lookup_count": 0,
    "spf_exceeds_10_lookups": false,
    "spf_circular_reference": false,
    "dmarc_record": "v=DMARC1; p=reject; pct=100",
    "dmarc_policy": "reject",
    "dmarc_pct": 100,
    "dmarc_rua": null
  },
  "rdap_audit": {
    "status": "FOUND",
    "registration_date_iso": "1995-08-14T04:00:00Z",
    "expiration_date_iso": "2028-08-13T04:00:00Z",
    "domain_age_days": 11384,
    "registrar_name": "Internet Assigned Numbers Authority",
    "is_newly_registered_burner": false
  },
  "actionable_recommendations": [
    "OPTIMIZE HSTS: Ensure max-age remains >= 31536000 for continuous preload compliance."
  ],
  "error_code": null,
  "error_message": null
}

---

🏷️ Transparent Pricing & Cost-Aware Execution Modes

This Actor operates under Apify's Pay-Per-Event (PPE) model with two distinct operating modes:

1. Base Audit Mode ($0.001 per domain)

Use this mode when you only require SSL/TLS certificate lifespan, cipher suites, and HTTP security header compliance:

• Configuration: Set "include_dns_deliverability": false. Optionally set "include_rdap_age": false if registrar details are unneeded.
• Expected Custom Event Fee: $0.001 per successfully evaluated domain (ssl-tls-base-audit).
• Billing Condition: Subject to event-charging failure rules (unresolvable hostnames or SSRF blocks yield charged: false; reachable public IPs with closed ports yield letter_grade: "F" and assess the base event fee).

2. DNS-Enriched Audit Mode ($0.002 per domain — Default)

Use this mode when auditing technical email authentication records (SPF RFC 7208 lookup depth, DMARC policies, MX providers) alongside SSL/TLS and headers:

• Configuration: "include_dns_deliverability": true (this is the default setting in the input schema).
• Expected Custom Event Fees: $0.001 base event + $0.001 DNS-enrichment event (security-headers-dns-enrichment), totaling $0.002 per domain when charged.
• RDAP Behavior: Controlled by "include_rdap_age" (defaults to true). When enabled, queries official RDAP registries for registration age and registrar authenticity at no additional event charge.

Important Billing Clarifications

• Actor Startup Fee: $0.00 (No initialization or per-run start fee).
• Platform Compute Costs: Platform compute and memory consumption (Actor compute units) are distinct from Actor event fees. Depending on your Apify monetization setup and account plan, platform usage costs may be covered by the publisher or billed against your platform usage credits; event prices should not be assumed to be universally all-inclusive.
• Fair-Billing Guarantee: Domains failing DNS pre-flight (DNS_NXDOMAIN or missing A/AAAA records), failing input validation, or blocked by anti-SSRF protections output charged: false and assess zero PPE fees.

Volume Cost Breakdown

Batch Size	Base Audit Mode (include_dns_deliverability=false)	DNS-Enriched Mode (include_dns_deliverability=true, default)
10 Domains	$0.01	$0.02
100 Domains	$0.10	$0.20
1,000 Domains	$1.00	$2.00

(Platform compute costs, if applicable under your account plan, are separate from Actor event fees).

---

❓ Frequently Asked Questions (FAQ)

Q: Does this Actor guarantee email deliverability or inbox placement?

A: No. The Actor inspects technical DNS records against RFC standards (RFC 7208 / RFC 7489) and sender guidelines (Google/Yahoo sender requirements). Actual inbox placement depends on mailbox provider algorithms, IP/domain reputation, sending volume, and message content.

Q: Does this Actor check DNSSEC or CAA records?

A: No. The Actor inspects SSL/TLS certificates, HTTP security headers, SPF syntax & 10-lookup limits, DMARC policies, and RDAP registration age. It does not inspect DNSSEC or CAA records.

Q: How does the Actor protect against Server-Side Request Forgery (SSRF)?

A: Target domains are resolved before connecting. Loopback addresses (127.0.0.1), private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata endpoints (169.254.169.254) are immediately blocked. Anti-SSRF verification re-runs on every HTTP redirect hop.

Q: Is this an intrusive port scanner or penetration tool?

A: No. It performs non-intrusive public compliance audits (standard TLS handshake on port 443, public HTTP headers, and public DNS records). It does not perform vulnerability exploitation or invasive port scanning.

Q: Does an 'A+' grade constitute formal regulatory compliance certification (e.g., ISO 27001, SOC 2)?

A: No. This Actor measures publicly observable technical parameters (TLS protocols, HTTP security headers, and DNS email authentication records). It is an automated diagnostic and posture monitoring tool, not a substitute for formal third-party regulatory certification, SOC 2 audits, or invasive penetration testing.

---

🚀 Ready to Audit Your Domain Posture?

Scan 1 to 1,000 domains for SSL/TLS, DMARC, and security headers in seconds:

1. Click Try for free at the top right of this page.
2. Enter your domains or paste a list from your CRM/spreadsheet.
3. Download the security compliance dataset or trigger automated weekly audits via webhook.