Domain Trust Check

Give it domains. Each one comes back with a 0–100 trust score, a risk level (low / medium / high) and a list of flags explaining why. Built for AI agents deciding whether to trust a domain, and for signup and lead screening.

Checks run inline, with plain DNS, HTTPS and registry lookups. No browser, no proxy, no login.

Price: $2.50 per 1,000 domains ($0.0025 each) plus $0.001 per run start. Inputs that cannot be read as a domain are returned with an error and are not charged. A domain that does not exist is charged, because the answer ("does not exist") is still delivered.

What is checked

Check	How	Flags it can raise
Disposable domain	5 merged public lists (CC0 / MIT), refreshed weekly	disposable_domain
Free provider	Gmail-style list	free_email_provider (no penalty)
Domain exists	DNS A / AAAA / MX	domain_does_not_exist, domain_does_not_resolve
Domain age	RDAP, straight from the registry	domain_under_30_days_old, domain_under_90_days_old, domain_under_1_year_old, domain_age_unavailable (no penalty)
SSL certificate	TLS handshake on port 443	no_https, ssl_invalid, ssl_expires_within_14_days
Email DNS	MX, SPF, DMARC, DKIM	no_mx_records, no_spf, no_dmarc, dmarc_policy_none, no_dkim_on_common_selectors

How the score is made

It starts at 100 and subtracts a fixed penalty per flag (never below 0). low risk is 75 or more, medium is 45–74, high is below 45.

Flag	Penalty
disposable_domain	70
domain_does_not_exist	70
domain_does_not_resolve	40
domain_under_30_days_old	30
ssl_invalid	25
domain_under_90_days_old	15
no_https	15
no_mx_records	10
no_spf	8
no_dmarc	8
domain_under_1_year_old, ssl_expires_within_14_days	5
dmarc_policy_none	3
no_dkim_on_common_selectors	2

The score is a heuristic built from these public signals. It is not a guarantee that a domain is safe or unsafe, and it is not a certification. Use the raw fields (flags, ssl, email, domainAgeDays) if you want to apply your own rules.

Limits you should know about

• Domain age needs a public RDAP service for the TLD. Tested on 150 real business domains: .com, .org, .net, .uk and the new gTLDs (.agency, .dev, .marketing and similar) returned an age. .ae, .io, .co, .me, .ru and .pk have no public RDAP service, so domainAgeStatus is unsupported. .au returned no registration date or rate-limited the lookup. In those cases the flag domain_age_unavailable is added, with no penalty, and domainAgeNote says why.
• DKIM cannot be listed from DNS. The Actor probes 16 common selectors (google, selector1, s1, k1, default, …). Finding none does not prove a domain has no DKIM, so the penalty is only 2 points. If a domain has a wildcard DNS record that answers for every selector, the probe is ignored (dkimWildcardDns: true).
• SSL is checked on the domain you give, port 443. A domain with no website but working email (a mail-only domain) will get no_https.
• Up to 5,000 domains per run.

Input

Field	What it does
domains	Domains, URLs or email addresses, one per line. Only the domain part is used. Duplicates are removed.
concurrency	Domains checked at the same time, 1–50 (default 10).

Example output

Input: stripe.com

{
  "input": "stripe.com",
  "domain": "stripe.com",
  "valid": true,
  "trustScore": 100,
  "riskLevel": "low",
  "flags": [],
  "disposable": false,
  "disposableMatchedDomain": null,
  "freeProvider": false,
  "registeredDomain": "stripe.com",
  "domainAgeDays": 11346,
  "registeredAt": "1995-09-12T04:00:00.000Z",
  "registrar": "SafeNames Ltd.",
  "domainAgeStatus": "ok",
  "domainAgeNote": null,
  "ssl": {
    "https": true,
    "valid": true,
    "error": null,
    "issuer": "DigiCert, Inc.",
    "validTo": "2026-12-10T23:59:59.000Z",
    "daysRemaining": 66
  },
  "email": {
    "hasMx": true,
    "mxHosts": ["aspmx.l.google.com", "alt2.aspmx.l.google.com", "alt1.aspmx.l.google.com", "aspmx2.googlemail.com", "aspmx3.googlemail.com"],
    "spf": true,
    "dmarc": true,
    "dmarcPolicy": "reject",
    "dkimSelectorsFound": ["google", "mandrill", "s1", "s2"],
    "dkimWildcardDns": false
  },
  "listsUpdatedAt": "2026-10-05T10:09:51.295Z",
  "error": null
}

Scores from the same run, for the other prefilled domains:

Domain	Score	Risk	Flags
mailinator.com	30	high	disposable_domain
gmail.com	95	low	free_email_provider, dmarc_policy_none, no_dkim_on_common_selectors
this-domain-should-not-exist-84721.com	0	high	domain_does_not_exist, domain_age_unavailable, no_https, no_mx_records, no_spf, no_dmarc, no_dkim_on_common_selectors

Use it from code

curl -X POST "https://api.apify.com/v2/acts/leadharbor~domain-trust-check/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["stripe.com","mailinator.com"]}'

Python, with the apify-client package:

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("leadharbor/domain-trust-check").call(
    run_input={"domains": ["stripe.com", "mailinator.com"]}
)
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row["trustScore"], row["riskLevel"], row["flags"])

FAQ

What does the trust score mean? It starts at 100 and loses a fixed penalty for each flag (table above). 75 or more is low risk, 45-74 medium, below 45 high. It is a heuristic from public signals, not a guarantee and not a certification.

Why is domainAgeStatus unsupported for my domain? The TLD has no public RDAP service (for example .ae, .io, .co, .me). The flag domain_age_unavailable is added with no penalty and domainAgeNote says why.

Does no_dkim_on_common_selectors mean the domain has no DKIM? No. DKIM cannot be listed from DNS, so the Actor probes 16 common selectors. Finding none costs 2 points only.

Why does a mail-only domain get no_https? SSL is checked on the domain you give, on port 443. A domain with email but no website has nothing to answer there.

Am I charged for domains that do not exist? Yes, one check, because the answer ("does not exist") is delivered. Inputs that cannot be read as a domain are not charged.

Can I pass emails or URLs? Yes. Only the domain part is used, and duplicates are removed.

How many domains per run? Up to 5,000. Split larger lists into several runs.

Can I apply my own rules instead of the score? Yes. Use the raw fields: flags, ssl, email, domainAgeDays.

Find us on RapidAPI

• Domain Trust Score on RapidAPI: a REST API that returns a trust score for one domain per call.

Related actors

• Disposable Email & Domain Checker: list-only throwaway check, $0.30 per 1,000.
• Bulk Email Verifier: MX, SPF, DMARC and a score for each email address.
• Website Contact Extractor: find emails and phones on business websites, then screen the domains here.
• Google Maps Scraper, MX-Checked Business Email Leads: business leads with emails from Google Maps.
• Website Technology Detector — Detects the CMS, frameworks, analytics and 100+ other technologies a website uses from its homepage. $9 per 1,000 sites.