# Bulk Domain Health Checker – DNS, MX, SPF, DMARC & SSL Expiry (`kestrelwick/domain-health-checker`) Actor

Check hundreds of domains in one run: A/AAAA/NS/MX records, SPF and DMARC, SSL certificate expiry and hostname match. One flat row per domain with a health grade. No API keys.

- **URL**: https://apify.com/kestrelwick/domain-health-checker.md
- **Developed by:** [Kestrelwick Studios](https://apify.com/kestrelwick) (community)
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.90 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk Domain Health Checker – DNS, MX, SPF, DMARC & SSL Expiry

Paste a list of domains and get **one clean row per domain**: DNS records, mail servers, SPF and DMARC, SSL certificate expiry, issuer, trust and hostname match, a list of problems found, and an **A–F health grade**. No API keys, no browser, no proxies, no scraping. We only use public DNS and a standard TLS handshake.

Built and maintained by **Kestrelwick Studios**.

### Who it's for

- **Agencies and IT teams** watching many client domains for expiring certificates before visitors see a browser warning.
- **Cold-email and deliverability teams** checking that sending domains have MX, a single valid SPF record and an enforcing DMARC policy.
- **Lead-list enrichment**: find out which domains in a list actually resolve, receive mail and run HTTPS.
- **M\&A / portfolio audits**: get a quick health snapshot of hundreds of domains as a spreadsheet.

### What we check

| Area | Fields |
|---|---|
| DNS | `a`, `aaaa`, `ns`, `caa` |
| Email | `mx`, `spf`, `dmarc`, `dmarcPolicy` |
| SSL | `sslIssuer`, `sslSubject`, `sslValidFrom`, `sslValidTo`, `sslDaysToExpiry`, `sslExpiresSoon`, `sslTrusted`, `sslTrustError`, `sslHostnameMatch`, `sslProtocol`, `sslSan` |
| Summary | `status` (`ok` / `no_data` / `failed` / `invalid_input`), `grade` (A–F), `issues[]`, `checkedAt` |

Issues we flag include an expired or soon-expiring certificate, an untrusted chain, a hostname mismatch, missing A/AAAA, missing MX, missing or duplicate SPF, `+all`/`?all` SPF, missing DMARC, and `p=none` DMARC.

### Input

- **Domains or URLs**: one per line (or comma-separated). We strip `https://`, paths and duplicates automatically.
- **Check SSL certificate** / **Check MX, SPF & DMARC**: switch off what you don't need.
- **SSL expiry warning (days)**: defaults to 30.
- **Use DNS-over-HTTPS**: resolve through Cloudflare's public 1.1.1.1 resolver for consistent results.
- **Concurrency**, **timeout** and **Max domains** to control speed and spend.

```json
{ "domains": ["example.com", "https://github.com/about", "expired.badssl.com"], "expiryWarningDays": 30 }
```

### Output example

```json
{ "domain": "github.com", "status": "ok", "grade": "A", "issues": [],
  "a": ["140.82.112.3"], "mx": ["0 github-com.mail.protection.outlook.com"],
  "spf": "v=spf1 ip4:192.30.252.0/22 include:_netblocks.google.com ... ~all", "dmarcPolicy": "quarantine",
  "sslIssuer": "Sectigo Limited", "sslValidTo": "2026-11-29T23:59:59.000Z", "sslDaysToExpiry": 53,
  "sslExpiresSoon": false, "sslTrusted": true, "sslHostnameMatch": true, "checkedAt": "2026-10-07T15:20:00.000Z" }
```

Export as JSON, CSV, Excel or XML, or call the actor from the Apify API, Make, Zapier or n8n.

### Pricing

Pay per result: **$1.35 per 1,000 domains checked** on the Free plan, with lower prices on higher Apify plans. **There's no start fee, and you're never charged for failed checks**: invalid input, domains that don't resolve and DNS failures come back as free rows. Platform usage is included.

### Tips

- **Weekly SSL watch**: schedule the actor weekly and filter `sslExpiresSoon = true`.
- Set a maximum charge per run in Apify to cap spend.

### FAQ

**Is this scraping?** No. We read public DNS records and the certificate any browser sees on port 443. We don't load any web pages.
**Does it check WHOIS/domain registration expiry?** Not yet. This version covers DNS, email authentication and SSL.
**Support:** open an issue on the actor's Issues tab and we'll respond.

# Actor input Schema

## `domains` (type: `array`):

One domain or URL per entry. URLs are reduced to their hostname; duplicates are removed.

## `checkSsl` (type: `boolean`):

TLS handshake on port 443 to read issuer, expiry and hostname match.

## `checkEmailAuth` (type: `boolean`):

Look up mail servers and email-authentication records.

## `expiryWarningDays` (type: `integer`):

Flag certificates expiring within this many days.

## `concurrency` (type: `integer`):

Domains checked in parallel.

## `timeoutSecs` (type: `integer`):

Timeout for each DNS/TLS operation.

## `useDoh` (type: `boolean`):

Resolve via Cloudflare public DoH instead of system DNS, for consistent, unfiltered answers.

## `maxItems` (type: `integer`):

Cap on domains processed (and charged) per run.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "example.com"
  ],
  "checkSsl": true,
  "checkEmailAuth": true,
  "expiryWarningDays": 30,
  "concurrency": 20,
  "timeoutSecs": 10,
  "useDoh": false,
  "maxItems": 10000
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("kestrelwick/domain-health-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("kestrelwick/domain-health-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "example.com"
  ]
}' |
apify call kestrelwick/domain-health-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,kestrelwick/domain-health-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/F8ciCnPiXC6uN52dO/builds/TFZ7JC3urWaV8CnFb/openapi.json