Domain Tech & Security Audit

Audit hundreds of domains in one run: DNS, SPF/DMARC email authentication, TLS certificate expiry, security-header score, CDN/cloud provider and server stack. Each domain returns one clean JSON row that's ready for a spreadsheet, a CRM or an AI agent.

What you can use it for

• Sales prospecting for MSPs, security and email-deliverability firms: find prospects with no DMARC, a weak SPF, missing security headers or certificates about to expire.
• Vendor and acquisition due diligence: see a company's hosting, CDN and basic security hygiene at a glance.
• Certificate and DNS monitoring: schedule a run and alert on tls.daysToExpiry < 14.
• AI agents: callable through Apify's MCP server, so an agent can audit domains as part of a research task.

Input

{ "domains": ["example.com", "https://www.github.com/some/page"], "concurrency": 10, "timeoutSecs": 10 }

URLs are reduced to their hostname. Duplicates and invalid entries are skipped and aren't billed.

Output (one item per domain)

{
  "domain": "www.github.com",
  "resolves": true,
  "dns": { "a": ["140.82.112.4"], "aaaa": [], "mx": [], "ns": ["dns1.p08.nsone.net"] },
  "email": {
    "spf": { "present": true, "policy": "~all", "strict": true },
    "dmarc": { "present": true, "policy": "quarantine", "enforced": true },
    "hasMx": false
  },
  "tls": { "valid": true, "issuer": "Sectigo Limited", "expiresAt": "2026-11-29T23:59:59.000Z", "daysToExpiry": 49, "protocol": "TLSv1.3" },
  "http": { "status": 200, "finalUrl": "https://github.com/", "error": null },
  "securityHeaders": { "present": ["strict-transport-security", "content-security-policy", "x-frame-options", "x-content-type-options", "referrer-policy"], "missing": ["permissions-policy"], "score": 83 },
  "providers": ["GitHub"],
  "stack": ["server: github.com"],
  "checkedAt": "2026-10-11T18:00:00.000Z"
}

Pricing

Pay per result: $2 per 1,000 domains audited. Platform usage is included, so you pay nothing per run and nothing for domains that are skipped.

How it works and its limits

• Uses live DNS, a TLS handshake on port 443 and one HTTPS request per domain. No third-party data providers, and nothing is crawled beyond the homepage response.
• Provider and stack detection is a heuristic based on response headers and nameservers. A site behind a CDN shows the CDN, not the origin host.
• If a subdomain has no DMARC record, the check falls back to the parent domain (organizational domain = last two labels).
• Expired or invalid certificates are reported (tls.valid: false, http.error) rather than skipped.