Pricing

$2.50 / 1,000 domain reports

Try for free

Go to Apify Store

Domain Health Report: DNS, Email Auth, TLS, Expiry

Try for free

Score 0-100 per domain: registration & expiry (RDAP/WHOIS), DNS, SPF/DKIM/DMARC/MTA-STS, TLS certificate, HTTPS redirect. Bulk, no login.

Pricing

$2.50 / 1,000 domain reports

Rating

0.0

(0)

Developer

Francesco Antonio Russo

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

Categories

Developer tools

SEO tools

Lead generation

domain

Required

Hostname as checked (lowercase ASCII, www. stripped).

Type:string

Example:

example.com

registrableDomain

Optional

Registered (apex) domain the host belongs to, e.g. example.co.uk for shop.example.co.uk.

Type:string

Example:

example.com

checkedAt

Required

ISO 8601 time the check started.

Type:string

status

Required

checked = a full report (the only status that is charged, and only with coverageComplete true) · nonexistent = the name does not exist (NXDOMAIN and no registration found): report delivered, free · invalid = the input entry is not a domain name (only written when the whole input has no valid domain): free.

Type:string

Options:

checkednonexistentinvalid

error

Optional

Only on status invalid: why the entry was rejected.

Type:string

score

Optional

0-100. 100 minus severity penalties (critical 25, high 12, medium 6, low 2).

Type:integer

Minimum:0

Maximum:100

grade

Optional

A ≥90 · B ≥75 · C ≥60 · D ≥40 · F below 40 or any critical issue.

Type:string

Options:

ABCDF

issueCount

Optional

Number of issues found.

Type:integer

criticalCount

Optional

Number of critical issues.

Type:integer

issues

Optional

Type:object[]

issueCodes

Optional

Just the codes of issues, for filtering.

Type:string[]

registered

Optional

true/false from the registry; null when the registry publishes no RDAP/WHOIS we can read (e.g. .eu, .es) — see registrationNote.

Type:boolean | null

registrationNote

Optional

Why registration data is missing, e.g. 'no RDAP service for this TLD' (the record stays complete). A registry that timed out, throttled or failed after retries is reported in checkErrors instead (incomplete, free).

Type:string | null

registrar

Optional

Registrar name as published by the registry.

Type:string | null

Example:

Cloudflare, Inc.

registrarIanaId

Optional

IANA registrar ID (RDAP only).

Type:string | null

createdAt

Optional

Registration date (ISO 8601).

Type:string | null

expiresAt

Optional

Registration expiry (ISO 8601). Not published by some registries: .uk (Nominet), .de (DENIC), .ch/.li (SWITCH).

Type:string | null

daysToExpiry

Optional

Days until registration expiry; negative when expired.

Type:integer | null

domainStatus

Optional

EPP/registry status codes, lowercase (e.g. clienttransferprohibited, ok, clienthold).

Type:string[]

transferLock

Optional

true = transfer lock set · false = the registry publishes lock states and there is none (NO_TRANSFER_LOCK) · null = this registry (DENIC, SWITCH, Nominet, registro.br, .it WHOIS) does not publish locks, so nothing is claimed.

Type:boolean | null

dnssec

Optional

Delegation signed (DNSSEC) according to the registry.

Type:boolean | null

rdapServer

Optional

Registry server that answered (RDAP host or whois.nic.it).

Type:string | null

resolves

Optional

Apex has at least one A or AAAA record.

Type:boolean | null

ipv4

Optional

A records.

Type:string[]

ipv6

Optional

AAAA records.

Type:string[]

nameservers

Optional

NS records at the apex, lowercase, sorted.

Type:string[]

wwwResolves

Optional

www. has an A or CNAME record.

Type:boolean | null

caa

Optional

CAA records found on the name or a parent (RFC 8659), as 'tag value'.

Type:string[]

hasMx

Optional

Domain publishes MX records (and not a null MX).

Type:boolean

Optional

MX hostnames by priority.

Type:string[]

mailProvider

Optional

Provider guessed from MX hostnames (Google Workspace, Microsoft 365, Zoho Mail, Cloudflare Email Routing, Aruba, OVH, IONOS …), 'other', or null without MX.

Type:string | null

spfRecord

Optional

The SPF TXT record (first one if several).

Type:string | null

spfAll

Optional

Qualifier of the all mechanism: '-', '~', '?', '+' or null.

Type:string | null

Options:

-~?+null

spfLookups

Optional

DNS-lookup terms of the SPF evaluation, counted through include: and redirect= (RFC 7208 §4.6.4, limit 10; recursion stops at depth 10 and 30 terms). If a nested lookup failed the number is a lower bound. More than 10 is a permerror.

Type:integer | null

dmarcRecord

Optional

The DMARC TXT record (own, or inherited from the registrable domain for subdomains).

Type:string | null

dmarcPolicy

Optional

DMARC p= value.

Type:string | null

Options:

nonequarantinerejectnull

dmarcRua

Optional

DMARC aggregate-report addresses.

Type:string[]

dkimSelectorsFound

Optional

DKIM selectors with a public key among those probed.

Type:string[]

mtaSts

Optional

_mta-sts TXT record present.

Type:boolean | null

mtaStsMode

Optional

MTA-STS policy mode when the policy file was fetched.

Type:string | null

Options:

enforcetestingnonenull

tlsRpt

Optional

_smtp._tls TXT record present.

Type:boolean | null

bimi

Optional

default._bimi TXT record present.

Type:boolean | null

httpsReachable

Optional

TLS handshake on port 443 completed.

Type:boolean | null

tlsTrusted

Optional

Certificate chain trusted by Node's root store.

Type:boolean | null

tlsProtocol

Optional

Negotiated protocol, e.g. TLSv1.3.

Type:string | null

tlsLegacyProtocols

Optional

Obsolete protocol versions the server still accepts (TLSv1, TLSv1.1), probed with a dedicated handshake. Empty = none; null = TLS not checked. A server that answers only with these is reported as HTTPS_LEGACY_ONLY, not unreachable.

Type:string[] | null

certIssuer

Optional

Issuer organisation of the leaf certificate.

Type:string | null

Example:

Let's Encrypt

certSubject

Optional

Common name of the leaf certificate.

Type:string | null

certExpiresAt

Optional

Certificate notAfter (ISO 8601).

Type:string | null

certDaysToExpiry

Optional

Days until the certificate expires; negative when expired.

Type:integer | null

certCoversHost

Optional

A SAN entry matches the host (wildcards one level).

Type:boolean | null

httpStatus

Optional

Status of HEAD http://host/ without following redirects.

Type:integer | null

httpsStatus

Optional

Status of HEAD https://host/.

Type:integer | null

redirectsToHttps

Optional

Following up to 4 redirects from http://host/, the chain reaches an https:// URL.

Type:boolean | null

hsts

Optional

Strict-Transport-Security header sent on a 2xx/3xx HTTPS answer; null when HTTPS answered 4xx/5xx or not at all.

Type:boolean | null

server

Optional

Server header over HTTPS, if any.

Type:string | null

checkErrors

Optional

Checks that failed with an error ('area: message'); the rest of the record is still valid.

Type:string[]

durationMs

Optional

Wall time for this domain in milliseconds.

Type:integer

coverageComplete

Optional

true when every requested check ran. false = at least one check failed (see checkErrors): the record is delivered but NOT charged, its grade is capped at C, and null fields mean 'unknown', not 'ok'.

Type:boolean

httpRedirectHops

Optional

Number of HTTP responses followed from http://host/ (max 4) to decide redirectsToHttps.

Type:integer | null

checksRun

Optional

Check areas that were requested for this run (dns always; registration, email, tls when enabled). The score covers only these areas.

Type:string[]

GuardHawk — Domain Security Audit: SSL, DNS, Takeover Risk

inexhaustible_glass/domain-health-audit

Full domain security audit in one call: SSL/TLS, DNS, SPF/DKIM/DMARC, security headers, WHOIS, blacklist, tech stack — PLUS subdomain-takeover risk and public S3-bucket exposure detection, which no other domain-audit tool checks. Returns a 0-100 health score + fix list. No API key, no login.

Hitman studio

5.0

(1)

DNS Lookup – Bulk DNS Records, MX, SPF & DMARC Checker

gazidev/bulk-dns-lookup

Bulk DNS lookup for thousands of domains: A, AAAA, MX, NS, TXT, CNAME, SOA, CAA records, SPF checker with 10-lookup limit, DMARC policy & rua, DKIM selectors, MTA-STS, BIMI, reverse DNS, change monitoring. Pick resolver: 1.1.1.1, 8.8.8.8 or custom. $1 per 1,000 domains.

Cemal Atakli

SSL Certificate Checker - Domain TLS Expiry & KYB API

pink_comic/ssl-certificate-checker

Bulk SSL/TLS certificate checker for domain KYB and HTTPS audits: expiry, issuer, SANs, chain validation, TLS version, and cipher evidence. Catch expired or misconfigured certs before outages. Related: whois-domain-lookup, dns-lookup-records, website-tech-stack-scanner.

Ava Torres

Website Health Report

automation-lab/website-health-report

Comprehensive website health audit in a single run. Checks HTTP status, SSL certificate, DNS resolution, security headers, meta tags, response time, and robots.txt. Returns a unified health score (0-100) with per-category grades.

Automation Lab

5.0

(1)

Domain WHOIS, DNS and SSL Expiry Lookup (RDAP)

pistachio_implementation/domain-whois-dns-ssl-lookup

Bulk domain lookup from official sources. Registrar, creation date, age and expiry date via RDAP, the modern WHOIS; A, MX, NS, TXT, SPF and DMARC records; and the SSL certificate issuer and days to expiry. $1.50 per 1,000 domains.

Hay Equipos

Public Email Auth DNS Readiness Agent

jacksu/public-email-auth-dns-readiness-agent

Check public email authentication DNS readiness for domains: MX, SPF, DMARC, DKIM selectors, BIMI, MTA-STS, TLS-RPT, risk labels, stable hashes, and useful-result pricing.

jack su

Bulk Domain DNS & RDAP Lookup – SPF, DMARC, MX, Registrar

polychrome_haymow/domain-dns-rdap

Enrich up to 10,000 domains per run: A/AAAA/MX/NS/TXT, SPF & DMARC via DNS-over-HTTPS, plus registrar, created/expiry dates, status and DNSSEC via RDAP. No WHOIS, no personal data.

Levani Zurabiani

Domain Security Checker: DNS, SPF/DMARC, TLS, Headers, Tech

ai_solution/website-domain-snapshot

One call, one JSON per domain: DNS records, SPF/DKIM/DMARC email-auth grade, TLS certificate, security-header score, detected tech stack and a prioritised findings list. Ideal for agencies, security checks and AI agents.

MB AISolution

SiteVerdict — robots.txt & Sitemap Monitor

siteverdict/siteverdict-robots-sitemap-monitor

Catch SEO disasters before Google does: watches robots.txt, XML sitemaps and key pages for Disallow: /, noindex, canonical and status changes, sitemap URL drops and errors. Diffs vs last run, Slack/webhook alerts, HTML report.

Aman Thakran

Domain Age Checker — Bulk RDAP + WHOIS Lookup

prodiger/domain-age-checker

Bulk-check domain age, registration date, expiry, registrar, nameservers, DNSSEC, and EPP status codes via IANA-bootstrapped RDAP with port-43 WHOIS fallback for ccTLDs (.de, .ru, .jp, .kr, .cn, .it, .br, .es, .pl, .nl).