Domain & Website Health Check: Expiry, SSL, DNS, SPF/DMARC

Check hundreds of domains in one run and get a plain-English list of what's wrong with each. For every domain you get the registration and expiry date, registrar and DNSSEC (from the registry's official RDAP service), SSL certificate expiry and validity, whether HTTP redirects to HTTPS, HSTS, DNS records, and email security (SPF and DMARC), plus a 0–100 health score.

Great for:

• 🛠️ Web agencies and freelancers: audit every client site at once; catch expiring domains and certificates before the client does
• 📧 Email deliverability: find domains without SPF/DMARC, or with p=none / +all
• 🔎 Lead generation and sales: find businesses with broken HTTPS or expired certificates who need help
• 🗂️ Domain portfolios: expiry dates, registrars and statuses in one sheet; spot names that look unregistered
• ⏰ Monitoring: schedule weekly and alert when issueCount goes up

Input

Field	What to put in	Default
domains	Domains, URLs or email addresses, one per line (example.com.au, https://shop.example.com, info@example.com)	–
checkRegistration	RDAP registration, expiry, registrar, DNSSEC	on
checkDns	A/AAAA, MX, CAA, SPF, DMARC	on
checkSsl	Certificate issuer, expiry, trust, host coverage	on
checkWebsite	http:// → final URL, redirects, status, HTTPS redirect, HSTS	on
expiryWarningDays	Flag domains expiring within N days	30

Output

One row per domain. Highlights: score, issues, registered, registrar, expiresAt, daysToExpiry, dnssec, mxRecords, spfRecord, spfAll, dmarcPolicy, sslValid, sslIssuer, sslDaysLeft, sslError, httpStatus, finalUrl, redirectChain, httpsRedirect, hsts.

{
  "host": "example.com.au", "score": 76,
  "issues": ["DMARC policy is p=none (monitoring only, no protection)", "No HSTS header"],
  "registered": true, "registrar": "Example Registrar Pty Ltd", "expiresAt": null,
  "spfAll": "~all", "dmarcPolicy": "none",
  "sslValid": true, "sslIssuer": "Let's Encrypt / R11", "sslDaysLeft": 61,
  "httpsRedirect": true, "finalUrl": "https://www.example.com.au/"
}

Pricing

Pay per result: one charge per domain checked, whatever checks you turn on. Invalid inputs and duplicates are skipped for free.

Notes

• Registration data comes from RDAP, the public protocol ICANN requires of gTLD registries. Some country registries don't run RDAP (e.g. .io, .de, .co), or don't publish expiry dates (e.g. .au). Then rdapError explains why, and registration is inferred from DNS.
• "Not registered" is a hint, not a guarantee of availability. Premium and reserved names can still be unavailable.
• DNS is queried over HTTPS from Cloudflare (1.1.1.1) with Google Public DNS as a fallback.
• The website check loads only the home page (headers only, body discarded). It's not a crawler and puts no load on the site.
• Only public domain names are accepted. IP addresses and internal names (localhost, .local, .internal) are refused.

Built by Eddie Power, a Melbourne web developer. Need help fixing what this finds? Get in touch through the Apify profile.