Domain Security Audit

Give it a list of domains and get each one back with a grade from A to F, a score out of 100 and a plain-English list of fixes. It checks:

• Email spoofing protection: SPF (missing, several records, weak ~all/+all, too many lookups), DMARC policy (none, quarantine or reject), and DKIM keys at common selectors
• TLS: whether the certificate is valid, when it expires, who issued it, and the protocol version
• HTTPS hygiene: whether http redirects to https, plus the HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers and clickjacking protection
• Hardening: server version leaks, CAA records and /.well-known/security.txt
• MX records, so you can tell domains that send email from ones that don't

It only uses public data: DNS over HTTPS (Cloudflare, with Google as fallback), a single HTTPS request to the homepage, the TLS handshake, and the security.txt file. There's no crawling, no login and no personal data.

Who it's for

• Agencies and MSPs prospecting for clients: "your domain can be spoofed, and here's the fix"
• Cold-email teams checking deliverability prerequisites (SPF, DKIM and DMARC) across their sending domains
• Security and IT teams watching certificate expiry and header drift across a portfolio (schedule it daily)
• AI agents through the Apify MCP server: "audit these 50 domains and list the ones without DMARC"

Input

{ "domains": ["example.com", "https://www.example.org/page"], "checkDkim": true, "maxConcurrency": 5 }

Output (one row per domain)

{ "domain": "example.com", "grade": "C", "score": 63,
  "findings": [{"severity": "high", "code": "NO_DMARC", "message": "No DMARC record"}],
  "spf": {...}, "dmarc": {...}, "mx": [...], "caa": [...], "dkim_selectors_found": [...],
  "tls": {"valid": true, "days_left": 64, "issuer": "..."}, "https": {...},
  "http_redirects_to_https": true, "security_txt": false, "checked_at": "2026-10-17T01:00:00+00:00" }

You can export the results as JSON, CSV or Excel, or pull them from the API.

Pricing (pay per event)

• domain-audited: $0.004 per domain ($4 per 1,000). Invalid inputs and failed audits are not charged.

Limitations

• DKIM is only probed at common selectors, so a custom selector shows as "not found" (severity: info).
• The score is a heuristic for prioritising fixes. It is not a penetration test.