Bulk Domain Health Checker – DNS, MX, SPF, DMARC & SSL Expiry

Paste a list of domains and get one clean row per domain: DNS records, mail servers, SPF and DMARC, SSL certificate expiry, issuer, trust and hostname match, a list of problems found, and an A–F health grade. No API keys, no browser, no proxies, no scraping. We only use public DNS and a standard TLS handshake.

Built and maintained by Kestrelwick Studios.

Who it's for

• Agencies and IT teams watching many client domains for expiring certificates before visitors see a browser warning.
• Cold-email and deliverability teams checking that sending domains have MX, a single valid SPF record and an enforcing DMARC policy.
• Lead-list enrichment: find out which domains in a list actually resolve, receive mail and run HTTPS.
• M&A / portfolio audits: get a quick health snapshot of hundreds of domains as a spreadsheet.

What we check

Area	Fields
DNS	a, aaaa, ns, caa
Email	mx, spf, dmarc, dmarcPolicy
SSL	sslIssuer, sslSubject, sslValidFrom, sslValidTo, sslDaysToExpiry, sslExpiresSoon, sslTrusted, sslTrustError, sslHostnameMatch, sslProtocol, sslSan
Summary	status (ok / no_data / failed / invalid_input), grade (A–F), issues[], checkedAt

Issues we flag include an expired or soon-expiring certificate, an untrusted chain, a hostname mismatch, missing A/AAAA, missing MX, missing or duplicate SPF, +all/?all SPF, missing DMARC, and p=none DMARC.

Input

• Domains or URLs: one per line (or comma-separated). We strip https://, paths and duplicates automatically.
• Check SSL certificate / Check MX, SPF & DMARC: switch off what you don't need.
• SSL expiry warning (days): defaults to 30.
• Use DNS-over-HTTPS: resolve through Cloudflare's public 1.1.1.1 resolver for consistent results.
• Concurrency, timeout and Max domains to control speed and spend.

{ "domains": ["example.com", "https://github.com/about", "expired.badssl.com"], "expiryWarningDays": 30 }

Output example

{ "domain": "github.com", "status": "ok", "grade": "A", "issues": [],
  "a": ["140.82.112.3"], "mx": ["0 github-com.mail.protection.outlook.com"],
  "spf": "v=spf1 ip4:192.30.252.0/22 include:_netblocks.google.com ... ~all", "dmarcPolicy": "quarantine",
  "sslIssuer": "Sectigo Limited", "sslValidTo": "2026-11-29T23:59:59.000Z", "sslDaysToExpiry": 53,
  "sslExpiresSoon": false, "sslTrusted": true, "sslHostnameMatch": true, "checkedAt": "2026-10-07T15:20:00.000Z" }

Export as JSON, CSV, Excel or XML, or call the actor from the Apify API, Make, Zapier or n8n.

Pricing

Pay per result: $1.35 per 1,000 domains checked on the Free plan, with lower prices on higher Apify plans. There's no start fee, and you're never charged for failed checks: invalid input, domains that don't resolve and DNS failures come back as free rows. Platform usage is included.

Tips

• Weekly SSL watch: schedule the actor weekly and filter sslExpiresSoon = true.
• Set a maximum charge per run in Apify to cap spend.

FAQ

Is this scraping? No. We read public DNS records and the certificate any browser sees on port 443. We don't load any web pages. Does it check WHOIS/domain registration expiry? Not yet. This version covers DNS, email authentication and SSL. Support: open an issue on the actor's Issues tab and we'll respond.