Domain Health Check: DNS, SSL, Security Headers, SPF & DMARC

Check the health of one domain or thousands in a single run. For every domain you get DNS records, email authentication (SPF and DMARC), the TLS certificate and its days remaining, six common HTTP security headers with a score, HTTPS redirect behaviour, and whether robots.txt, security.txt and llms.txt exist. Results are flat JSON with a plain list of issues, ready for dashboards, monitoring, or an AI agent.

What you get per domain

Area	Fields
DNS	A, AAAA, MX, NS, CAA records
Email auth	SPF present and all mechanism; DMARC present and policy
TLS	issuer, subject, alt names, valid from/to, daysRemaining, expired, expiringSoon (30 days), trusted or not, protocol
HTTP	status, final URL, whether http:// redirects to https://
Security headers	HSTS (with max-age), CSP, X-Content-Type-Options, X-Frame-Options (CSP frame-ancestors counts), Referrer-Policy, Permissions-Policy, score out of 6
Files	/robots.txt, /.well-known/security.txt, /llms.txt exist
issues	list of {severity, code, message} such as TLS_EXPIRING_SOON, DMARC_MISSING, NO_HTTPS_REDIRECT

Example input

{ "domains": ["github.com", "example.com"], "maxDomains": 100 }

Example output (trimmed)

{
  "domain": "github.com",
  "dns": { "spf": { "present": true }, "dmarc": { "present": true, "policy": "quarantine" } },
  "tls": { "issuer": "Sectigo Limited", "daysRemaining": 32, "authorized": true },
  "http": { "status": 200, "redirectedToHttps": true },
  "headers": { "score": 5, "maxScore": 6, "missing": ["permissionsPolicy"] },
  "files": { "robotsTxt": true, "securityTxt": true, "llmsTxt": true },
  "issues": [{ "severity": "info", "code": "HEADER_MISSING_PERMISSIONS_POLICY", "message": "Missing security header: permissionsPolicy" }]
}

Pricing

Pay per event: a small start fee per run plus a charge for each domain successfully checked. Invalid inputs, domains with no DNS address, domains that resolve but answer on neither HTTPS nor HTTP, refused (private-address) domains and failed checks are free. If your spending limit is reached, the Actor stops cleanly instead of running unpaid. Current prices are shown on this page.

Good to know

• Public domain names only. IP addresses, localhost, private and internal hostnames are rejected, and redirects to private addresses are refused.
• It performs a handful of ordinary requests per domain (one TLS handshake, DNS lookups, a few GETs to the site root and well-known files). It does not crawl the site. Every connection, including each redirect hop, is made to an address validated as public at connect time.
• Header scoring checks presence only. It does not judge whether a CSP is strong.
• llmsTxt, robotsTxt and securityTxt are true only for a 200 non-HTML response.
• DNS lookups for TXT records use DNS-over-HTTPS (Cloudflare) with a fallback to the system resolver.
• A domain behind a bot-protection wall may return a 403 for the home page. The status is reported as-is.