# Changelog of Vendor Security Posture - DMARC, TLS, Headers & security.txt (`lentic_labs/domain-email-tls-check`) Actor

- **URL**: https://apify.com/lentic_labs/domain-email-tls-check/changelog.md
- **Full Actor documentation**: https://apify.com/lentic_labs/domain-email-tls-check.md

## Changelog

### 0.2

- Partial rows: when the homepage can't be fully checked from Apify's servers, the row has `status: "partial"`, `webStatus` (`unreachable`, `blocked-by-site` or `partial`, plus `redirectsTo`), a `note`, and no `score`, `grade` or `reviewPriority`. Headers and security.txt (and TLS when no certificate was obtained) read `not assessed` and get no fixes. Partial rows are not charged.
- Blocked = any 4xx except 404/410, any 5xx, or a challenge/bot-block page (`cf-mitigated`, `x-amzn-waf-action`, `x-sucuri-block`): partial, no web subscore (TLS not scored either). Certificate-only rows get `webStatus: "partial"` (TLS scored; headers and security.txt not assessed; no grade). Web checks off: `webStatus: "skipped"`, note "grade based on email checks only".
- New `emailScore` (email authentication only, scaled to 100) and `scoreCoverage` on every checked row.
- security.txt is missing only on 404/410 or a soft-404; errors, timeouts, blocks and unfollowed redirects are `not assessed`.
- DKIM not found among the selectors tried is "not verified": its 5 points are left out of the maximum instead of deducted.
- `riskLevel` renamed to `reviewPriority` (how soon to follow up; not a risk rating). Run summary: `reviewPriorities`, `partial`, `webStatus`.
- "About the score" disclaimer in the README and the dataset schema. SEO title: "Vendor Security Posture Check API - DMARC, TLS, Headers".
- Every row has a stable `rowId`.
- Challenge pages served with HTTP 200 are also recognised by the page title (only the first 8 KB of a 200 homepage are read; same request budget). `reviewPriority` is null when web checks are off. `webStatus` values: ok, blocked-by-site, partial, unreachable, skipped (an off-site redirect is `partial` with `redirectsTo`).
- Body limits are enforced: at most 8 KB of a 200 homepage and 32 KB of security.txt, even when the server has already sent the whole response.
- SSRF guard covers every IPv4/IPv6 form (IPv4-mapped/compatible, 6to4, Teredo); each HTTPS request has a hard time limit.
- Repositioned as a vendor security posture snapshot for third-party risk: adds HTTP security headers and security.txt, a 0-100 score with a published rubric, a grade and a points-ordered fix list.
- TLS is now read from the homepage HTTPS request itself (no separate handshake): 2 HTTPS requests per domain in total.
- `checkTls` input renamed to `checkWeb` (old key still accepted). New inputs: `domainsText`, `timeoutMs`, `maxDomains`.
- Price: $0.004 per domain (was $0.003; not yet published).