Vendor Security Posture - DMARC, TLS, Headers & security.txt

A quick, passive, outside-in configuration check of every vendor on your list, for third-party risk (TPRM) and procurement reviews. Give a list of supplier domains and get one compact row per domain with:

• A 0-100 score, letter grade and reviewPriority (how soon to follow up), from a published rubric (below), on every fully checked row
• An email-only emailScore on every row, and webStatus showing whether the vendor's website could be checked from Apify's servers
• A fix list ordered by points, e.g. +12: Enforce DMARC: move from p=none to p=quarantine or p=reject at pct=100
• Email spoofing protection: DMARC policy, SPF, DKIM, and the DNS side of the Gmail/Yahoo bulk-sender rules
• TLS: certificate status, days to expiry, issuer and TLS version
• HTTP security headers: HSTS, Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy
• security.txt (RFC 9116): present, has a Contact, Expires date, signed. Contact values are never output.
• Mail provider and email security gateway (Microsoft 365, Google Workspace, Proofpoint, Mimecast…)

Use it to pre-screen vendors before a questionnaire, to evidence outside-in checks in a vendor review, or to re-check your supplier list on a schedule.

Example output

{ "domain": "example-vendor.com", "status": "ok", "score": 66, "grade": "D", "reviewPriority": "medium", "emailScore": 88,
  "scoreCoverage": ["emailAuth", "tls", "headers", "securityTxt"], "webStatus": "ok",
  "scoreBreakdown": { "emailAuth": "35/40", "tls": "25/25", "headers": "6/25", "securityTxt": "0/10" },
  "fixes": ["+10: Publish /.well-known/security.txt (RFC 9116) with Contact and Expires", "+6: Send a Content-Security-Policy header", "+5: Add a DMARC rua= reporting address", "..."],
  "spoofable": false, "dmarcPolicy": "reject", "tlsCertStatus": "ok", "tlsDaysLeft": 71, "hsts": true, "csp": null, "securityTxtFound": false }

A vendor whose website blocks Apify's servers gets a partial row instead of a grade:

{ "domain": "blocking-vendor.com", "status": "partial", "score": null, "grade": null, "reviewPriority": null, "emailScore": 100,
  "scoreCoverage": ["emailAuth"], "webStatus": "blocked-by-site",
  "scoreBreakdown": { "emailAuth": "40/40", "tls": "not assessed", "headers": "not assessed", "securityTxt": "not assessed" },
  "note": "HTTPS could not be fully checked from Apify's servers (HTTP 403). TLS, headers and security.txt were not assessed; this is not evidence the vendor lacks them." }

Values are illustrative.

Scoring rubric (0-100)

Category	Check	Points
Email authentication (40)	DMARC enforced (p=quarantine or p=reject, pct=100); DMARC p=none earns 8	20
	SPF valid (at most 10 lookups) and not +all	10
	DKIM key found among 30 common selectors. Not found means "not verified" (a custom selector may exist): these 5 points are left out of the maximum, not deducted	5
	DMARC rua= reporting address	5
TLS (25)	Certificate valid: trusted chain, covers the hostname, in date	15
	More than warnDays (default 30) days to expiry	5
	TLS 1.2 or 1.3 negotiated	5
HTTP security headers (25)	HSTS max-age at least 180 days (shorter: 4)	8
	Content-Security-Policy enforced (report-only: 2)	6
	Clickjacking protection (X-Frame-Options DENY/SAMEORIGIN or CSP frame-ancestors)	4
	X-Content-Type-Options: nosniff	4
	Referrer-Policy set (not unsafe-url)	3
security.txt (10)	File with a Contact field (file without Contact: 2)	6
	Expires present and in the future	4

About the score. The score, grade and review priority summarize a small set of public, outside-in configuration checks (email-authentication DNS records, the homepage TLS certificate and response headers, and security.txt) as seen from Apify's servers at the time of the run. They are not a security rating, certification or audit, and say nothing about a vendor's internal controls, data handling or breach history. Results can be incomplete or wrong. For example, a vendor may block automated traffic, use a DKIM selector this tool doesn't try, or send different headers to browsers. Rows that couldn't be fully checked are marked partial and are not graded. Confirm findings with the vendor before relying on them, and don't publish scores about a third party as a statement about its security.

Grades: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, F < 60. The score is the points earned out of the points available for the categories assessed, scaled to 100. emailScore is the email-authentication category alone, scaled to 100, and is returned on every checked row.

reviewPriority is how soon to follow up with the vendor, not a measure of risk. It is null on partial rows and when web checks are off. Otherwise it is high when the score is under 60, DMARC is missing or invalid, or the certificate is expired or invalid; medium when the score is under 80, the domain is spoofable (DMARC not enforced) or the certificate expires soon; otherwise low.

Partial rows (website not fully checkable)

webStatus says how the homepage looked from Apify's servers:

• ok: it answered normally (a 404 or 410 homepage still counts as answered).
• blocked-by-site: the final response was any 4xx except 404 and 410 (for example 401, 403, 417 or 429), any 5xx, or a challenge or bot-block page (a cf-mitigated, x-amzn-waf-action or x-sucuri-block header, or a bot-check page title such as "Just a moment…" or "Access Denied" on a 200). These rows get no web subscore: TLS, headers and security.txt are all not assessed. Challenge pages are recognised from the status code, a few WAF headers and the page title; a bot-check page that looks like a normal page can still be scored. The homepages of CAPTCHA and DDoS-protection vendors themselves may come back as blocked-by-site because their own page titles use those words; such a row is free and has no grade.
• partial: only the TLS certificate was obtained (for example the homepage redirects to another site or to http, or the connection dropped after the handshake). TLS is scored, since an expired, mismatched or untrusted certificate is a real finding; the note says headers and security.txt not assessed, and no grade is given. redirectsTo gives the host of a redirect that wasn't followed.
• unreachable: timeout, connection refused or reset, host unreachable, or a TLS handshake failure with no certificate.
• skipped: you turned web checks off (see below).

Whenever web checks were on and the homepage wasn't ok, the row has status: "partial": score, grade and reviewPriority are null, the categories that weren't checked read not assessed in scoreBreakdown with their fields null and no fixes, scoreCoverage lists what was assessed, and note explains why. Partial rows are not charged.

security.txt counts as missing only on a 404 or 410, or when the server returns a page that isn't a security.txt (for example an HTML "not found" page with status 200). If the security.txt request errors, times out, is blocked or redirects elsewhere, it is not assessed and the row is partial.

With Check TLS, security headers and security.txt off, webStatus is skipped and the row's note says "Web checks were turned off: grade based on email checks only." The score and grade are then based on email checks only (scaled to 100), scoreBreakdown and scoreCoverage show just that category, and reviewPriority is null.

How much does it cost?

$0.004 per domain ($4 per 1,000). No subscription and no start fee. You're charged once per domain that was scored: fully checked, or email-only when you turn web checks off. Partial rows (website not fully checkable from Apify's servers), invalid, duplicate, non-existent (NXDOMAIN) and DNS-failure domains are free. Set a maximum total charge per run and the Actor stops at your budget.

On Apify's free plan, the $5 monthly usage credit covers up to about 1,250 domains a month (less if you use other Apify Actors or services).

How it compares

Multi-check domain posture Actors in the Apify Store (checked Oct 26, 2026) charge about $0.004 to $0.15 per domain, several with a start fee of $0.005 or more; most charge $0.006 to $0.03. Single-purpose header, security.txt or DMARC checkers charge $0.0005 to $0.02 each. This Actor covers email authentication, TLS, headers and security.txt in one row at the low end of that range, with a published rubric and no start fee.

How does it work?

All checks are passive:

• Public DNS: MX, SPF (with include chain), DMARC, 30 common DKIM selectors.
• At most two HTTPS requests per domain: GET https://<domain>/ (the certificate is read from this request's connection and the response headers are checked; on a 200 response only the first 8 KB of the page are read, to recognise a bot-check page by its title, and nothing from the page is stored) and GET https://<domain>/.well-known/security.txt (up to 32 KB; requested only when the homepage answered normally). Within each, redirects to the same registrable domain (e.g. apex → www) are followed, at most 2 hops.

There's no port scanning, crawling, login, form submission or vulnerability probing, and no email is sent. Private, loopback and cloud-metadata addresses are refused in every IPv4 and IPv6 form, and the connection goes only to the address that was checked. Each HTTPS request has a hard time limit. Requests identify themselves with a LenticLabs-Actor User-Agent. Use it only on domains you own, vendors you're assessing as part of your own risk process, or for research on public DNS and web data. No personal data is collected: security.txt Contact values aren't stored, and only whether a Contact exists is reported.

Gmail and Yahoo also require alignment, one-click unsubscribe and low spam rates; Microsoft recommends similar practices. These can only be seen in real mail. This checks the DNS side only.

Every row has a rowId, stable per input item. In the rare case a dataset save times out after the row was stored, an uncharged error row with the same rowId follows; keep the non-error row for each rowId.

Use from AI agents (Apify MCP)

Add https://mcp.apify.com?tools=lentic_labs/domain-email-tls-check to your MCP client and ask "Check DMARC, TLS, headers and security.txt for these 20 vendors and list the top fixes." Agents without an Apify account can use Apify's agentic payments (experimental): buy a prepaid token with x402, or pay per request with Skyfire.

Input compatibility

The older checkTls input is still accepted as an alias of checkWeb.

Data sources and attribution

No third-party dataset is used: every result comes from public DNS and from the vendor's own HTTPS responses at run time. The security.txt format is defined in RFC 9116 (IETF). Header guidance follows common public recommendations such as the OWASP Secure Headers Project; this Actor is not affiliated with or endorsed by OWASP or the IETF.

Need more depth?

• Email-security audit with MTA-STS, TLS-RPT and BIMI: DMARC Checker Bulk - SPF, DKIM & Email Security
• Single-purpose tools: Email Provider Lookup - Bulk MX for Microsoft 365 & Google, DMARC & SPF bulk-sender check, SSL certificate expiry checker

---

Microsoft 365 and Outlook are trademarks of Microsoft Corporation. Google Workspace and Gmail are trademarks of Google LLC. Yahoo is a trademark of Yahoo. Proofpoint and Mimecast are trademarks of their respective owners. Names are used only to describe the providers checked; Lentic Labs is not affiliated with or endorsed by them.