DNS Lookup & SSL Checker: SPF, DMARC, DKIM, Domain Expiry

A bulk DNS lookup, SSL certificate checker and SPF/DMARC/DKIM validator in one: every domain gets DNS records, email-security checks, SSL expiry, HTTPS/HSTS and domain expiry (official RDAP), plus a 0–100 score.

💲 $3 per 1,000 domains. Invalid domain names are free. Pay only for results. No subscription, and the Apify free plan's monthly credit covers small jobs.

Also known as: DNS lookup, bulk DNS records, MX lookup, SPF checker, DMARC checker, DKIM checker, SSL certificate checker, SSL expiry monitor, domain expiry checker, WHOIS/RDAP lookup, email deliverability check.

Quick start

1. Click Start. The prefilled input works as is.
2. Or paste this input (JSON tab):

{
  "domains": [
    "apify.com",
    "example.com"
  ]
}

Output (one dataset item):

{
  "domain": "apify.com",
  "score": 100,
  "issues": [],
  "tlsDaysToExpiry": 79,
  "domainDaysToExpiry": 3138,
  "email": {
    "spf": {
      "allQualifier": "-all",
      "dnsLookups": 10
    },
    "dmarc": {
      "policy": "reject"
    },
    "dkimSelectorsFound": [
      "google"
    ]
  }
}

Use it from the API, AI agents (MCP), n8n, Make or Zapier

curl -X POST "https://api.apify.com/v2/acts/gmyri~domain-health-check/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domains":["example.com","apify.com"],"expiryWarningDays":30}'

• AI agents / MCP: connect https://mcp.apify.com/?actors=gmyri/domain-health-check to Claude, Cursor, ChatGPT or any MCP client. The input schema is fully described for tool calling.
• Python: ApifyClient(token).actor("gmyri/domain-health-check").call(run_input={...})
• n8n / Make / Zapier: use the Apify "Run Actor" action with gmyri/domain-health-check, then read the dataset items.

Quick FAQ

• Does it return WHOIS contact details? No. It uses official RDAP and returns only the registrar, dates, status and DNSSEC. No personal data.
• What if I set a spending limit? The Actor stops cleanly at your Max cost per run and you're never charged above it.

Details

Check any number of domains in one run and get a scored health report for each:

• DNS records: A, AAAA, MX, NS, TXT, CAA (any type you choose)
• Email security / deliverability: SPF (syntax, ~all/-all, 10-DNS-lookup limit), DMARC policy and reporting, DKIM selectors, MTA-STS, BIMI
• TLS/SSL certificate: validity, issuer, days to expiry, TLS version
• HTTPS setup: http → https redirect, HSTS, homepage status
• Domain registration expiry from the registry's official RDAP service: registrar, created and expiry dates, status, DNSSEC

Each domain gets a 0–100 score and a list of issues with stable codes (NO_DMARC, SPF_TOO_MANY_LOOKUPS, TLS_EXPIRING, DOMAIN_EXPIRING…), so you can alert on them.

$3 per 1,000 domains. Invalid domain names are free.

Why this Actor

• Monitoring-ready: schedule it daily or weekly and get warned before a certificate or a domain expires (expiryWarningDays, default 30).
• Everything in one call: today you need a DNS lookup tool, an SPF/DMARC checker, an SSL checker and a WHOIS tool.
• Reliable in the cloud: DNS over HTTPS (Cloudflare with a Google fallback) by default, with classic DNS available.
• Privacy-safe: registration data comes from official RDAP, and registrant contact data is never collected.
• Agent-friendly: flat, predictable JSON, a single primary event, and fast results (about 1–2 s per domain).

Typical uses

• Agencies and MSPs: monitor every client domain for certificate and domain expiry, and for email spoofing protection
• Email deliverability audits (SPF, DMARC, DKIM) before a cold or marketing campaign on your own domains
• IT asset inventory: registrar, DNS provider, mail provider and CAA for a portfolio
• Due diligence on supplier and partner domains
• AI agents answering "is this domain set up correctly?"

Input example

{
  "domains": ["apify.com", "example.com", "https://www.bbc.co.uk/news"],
  "checkEmailSecurity": true,
  "checkWebsite": true,
  "checkRegistration": true,
  "expiryWarningDays": 30
}

Field	Default	What it does
domains	–	Domains or URLs (reduced to the domain, leading www. removed)
checkEmailSecurity	true	MX, SPF, DMARC, DKIM, MTA-STS, BIMI
checkWebsite	true	TLS certificate, http→https, HSTS
checkRegistration	true	RDAP registrar and expiry
expiryWarningDays	30	Warn about certificates and domains expiring sooner than this
recordTypes	A, AAAA, MX, NS, TXT, CAA	DNS records to return
dkimSelectors	common selectors	Selectors to probe (add your provider's)
dnsTransport	doh	doh (DNS over HTTPS) or udp
dnsServers	1.1.1.1, 8.8.8.8	Resolvers for udp
timeoutSecs	8	Per-check timeout
maxConcurrency	5	Domains in parallel

Output (one item per domain)

{
  "domain": "apify.com",
  "score": 100, "errorCount": 0, "issueCount": 0, "issues": [],
  "tlsDaysToExpiry": 79, "domainDaysToExpiry": 3138,
  "email": {
    "mx": ["1 aspmx.l.google.com", "…"],
    "spf": { "record": "v=spf1 … -all", "allQualifier": "-all", "dnsLookups": 10 },
    "dmarc": { "record": "v=DMARC1; p=reject; …", "policy": "reject", "hasRua": true },
    "dkimSelectorsFound": ["google"], "mtaSts": false, "bimi": false
  },
  "tls": { "valid": true, "issuer": "Amazon", "expiresAt": "2027-01-16T23:59:59+00:00", "daysToExpiry": 79 },
  "web": { "httpRedirectsToHttps": true, "httpsStatus": 200, "hsts": "max-age=…" },
  "registration": { "registrar": "Amazon Registrar, Inc.", "createdAt": "…", "expiresAt": "…", "dnssec": false },
  "dns": { "A": ["…"], "NS": ["…"], "CAA": ["0 issue \"letsencrypt.org\""] }
}

Issue codes

Severity	Codes
error	NXDOMAIN, MULTIPLE_SPF, SPF_TOO_MANY_LOOKUPS, TLS_INVALID, TLS_EXPIRED, DOMAIN_EXPIRED
warning	NO_SPF, WEAK_SPF_ALL, NO_DMARC, TLS_EXPIRING, DOMAIN_EXPIRING, NO_HTTPS_REDIRECT, HTTPS_ERROR_STATUS
notice	DMARC_P_NONE, DKIM_NOT_FOUND, NO_MX, NO_HSTS, NO_CAA, NOT_REGISTERED

Score = 100 − 25 per error − 10 per warning − 3 per notice (minimum 0).

Pricing (pay per event)

Event	Price
Domain checked (primary)	$0.003 ($3 / 1,000)
Actor start	$0.00005 per run (Apify default)

Platform usage is included, and the Actor stops cleanly at your Max cost per run.

Use from AI agents (MCP), n8n, Make, Zapier and the API

• MCP: add gmyri/domain-health-check to the Apify MCP server.
• n8n / Make / Zapier: run the Actor on a schedule and filter dataset items where errorCount > 0 or tlsDaysToExpiry < 14.
• API:

  curl -X POST "https://api.apify.com/v2/acts/gmyri~domain-health-check/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
    -H 'Content-Type: application/json' -d '{"domains":["example.com"]}'
  

FAQ

Is DKIM detection complete? DKIM keys can only be found if you know the selector. The Actor tries common ones (Google, Microsoft 365 and generic selectors). Add your provider's selector for a definitive answer.

Why is registration data missing for some TLDs? A few ccTLDs have no public RDAP service yet. Those domains still get every other check.

Do you collect WHOIS contact details? No. Only registrar, dates, status and DNSSEC are returned.

Related tools

• Broken Link Checker & SEO Audit: 404s, Redirects, Sitemap
• Website Screenshot API: Full Page, Mobile & URL to PDF
• Merge & Deduplicate Datasets: Remove Duplicates, Only New Items