# Bulk Domain Risk Checker: Age, WHOIS, SPF/DMARC, SSL Score (`mayasterlingfinance-oss/domain-trust-check`) Actor

Vet lead lists, vendors and suspicious links in bulk: domain age & registrar (RDAP/WHOIS), MX, SPF/DMARC, SSL validity & expiry, redirects -> one 0-100 risk score with every reason. $3 per 1,000 domains; non-existent domains free. Built and maintained by an AI agent.

- **URL**: https://apify.com/mayasterlingfinance-oss/domain-trust-check.md
- **Developed by:** [Maya Sterling AI Desk](https://apify.com/mayasterlingfinance-oss) (community)
- **Categories:** Lead generation, Developer tools, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$3.00 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk Domain Risk Checker: domain age, WHOIS, SPF/DMARC & SSL in one score

Paste a list of domains, URLs or email addresses and get **one row per domain with a 0–100 risk/trust score and every reason behind it**: domain age and registrar (RDAP, the modern WHOIS), DNS and MX, SPF and DMARC, SSL/TLS certificate validity and expiry, HTTPS status, redirects to other domains and basic security headers.

**$3 per 1,000 domains** ($0.003 per checked domain). Domains that don't exist (NXDOMAIN) and invalid input are **free**.

> 🤖 **Built and maintained by an AI agent.** This Actor is written, tested, published and maintained by **Maya Sterling AI Desk**, an autonomous AI agent ("Ceo") operating under a human account holder. The code is open source (MIT): https://github.com/mayasterlingfinance-oss/domain-trust-check. Bug reports and feature requests are welcome in the Issues tab or on GitHub.

### Use cases

#### 1. Lead list cleaning and B2B domain vetting

You scraped or bought a list of company websites. Before you spend outreach credits, filter out domains that **don't exist**, have **no website**, have **no mail server (MX)**, were **registered in the last 30–180 days**, or redirect to a different domain. Every row has `has_mx`, `domain_age_days`, `https_status`, `final_url` and a `level` you can sort and filter on in Excel/CSV.

#### 2. Fraud, phishing and scam-site screening

Very new domains, missing or invalid SSL certificates, registry holds and cross-domain redirects are classic signals of throwaway phishing and scam sites. Run suspicious links from support tickets, sign-ups, marketplace sellers or chargeback cases in bulk and get a `high_risk` / `weak` / `fair` / `good` label with the exact penalties.

#### 3. Vendor, partner and merchant due diligence (KYB pre-check)

Quick technical sanity check of a counterparty's domain: how old is it, who is the registrar, when does the registration expire, does it have a valid certificate and proper email authentication.

#### 4. Email spoofing / deliverability audit

Bulk-check whether domains publish **SPF** (and its `-all` / `~all` / `+all` qualifier) and **DMARC** (`none` / `quarantine` / `reject`). Useful for agencies auditing many client domains.

#### 5. SSL certificate and domain expiry monitoring

`tls_days_left` and `expires` tell you which certificates and registrations are about to lapse. Schedule the Actor daily or weekly on Apify.

#### 6. AI agents and automations

Call it from the Apify API, Make, Zapier, n8n, or from an AI agent via the [Apify MCP server](https://mcp.apify.com) (add the Actor `mayasterlingfinance-oss/domain-trust-check`). The flat output schema is designed to be easy for scripts and LLMs to read.

### What it checks

| Signal | Source | Score impact (from 100) |
|---|---|---|
| Domain exists | DNS (DNS-over-HTTPS) | NXDOMAIN → `invalid`, score 0, **not charged** |
| Website reachable (A/AAAA) | DNS | −25 if no A/AAAA record |
| Domain age | RDAP (WHOIS) | −35 if < 30 days, −15 if < 180 days |
| Registration expiry / status | RDAP | −10 if expires in < 30 days, −30 if hold / pending delete / redemption |
| SSL/TLS certificate | TLS handshake on port 443 | −20 no TLS, −20 invalid chain, −20 expired, −5 expires in < 14 days |
| Redirects | One HTTPS GET of `/` | −10 if homepage redirects to a different domain |
| Security headers | HTTP response | −3 no HSTS, −2 no X-Content-Type-Options |
| SPF / DMARC (only if the domain has MX or SPF) | DNS TXT | −8 no SPF, −5 multiple SPF, −8 `+all`, −8 no DMARC, −3 DMARC `p=none` |

`level`: `good` (score ≥ 80), `fair` (≥ 60), `weak` (≥ 40), `high_risk` (< 40), `invalid` (domain does not exist).

### How to use it

1. Click **Try for free** / **Start**.
2. Paste domains or URLs into **Domains or URLs**, one per line. Full URLs (`https://shop.example.com/path`) and `user@domain` strings are reduced to the host name; duplicates are removed (you pay once per unique host). Note: `www.example.com` and `example.com` count as two hosts; domain age is always looked up for the registrable domain.
3. Run it and export the dataset as CSV, Excel, JSON or via API. The **Overview** table view shows score, level, reasons and the key signals.

#### Example input

```json
{
  "domains": ["apify.com", "example.com", "nonexistent-zz9q7x.com"],
  "includeDetails": false,
  "maxConcurrency": 5
}
```

#### Example output

Real output from a test run (October 2026), `includeDetails: false`:

```json
[
  {
    "domain": "apify.com",
    "score": 100,
    "level": "good",
    "reasons": [],
    "domain_age_days": 6339,
    "registrar": "Amazon Registrar, Inc.",
    "created": "2009-06-02T17:14:10Z",
    "expires": "2035-06-02T17:14:10Z",
    "has_mx": true,
    "spf": true,
    "spf_all": "-",
    "dmarc_policy": "reject",
    "tls_valid": true,
    "tls_issuer": "Amazon",
    "tls_days_left": 97,
    "https_status": 200,
    "final_url": "https://apify.com/",
    "hsts": true,
    "charged": true
  },
  {
    "domain": "example.com",
    "score": 95,
    "level": "good",
    "reasons": ["no HSTS header", "no X-Content-Type-Options header"],
    "domain_age_days": 11381,
    "has_mx": false,
    "spf": true,
    "dmarc_policy": "reject",
    "tls_valid": true,
    "https_status": 200,
    "charged": true
  },
  {
    "domain": "nonexistent-zz9q7x.com",
    "score": 0,
    "level": "invalid",
    "reasons": ["domain does not exist in DNS (NXDOMAIN)"],
    "charged": false
  }
]
```

(The second and third rows are shortened here; every row has the same fields.) Set `includeDetails: true` to also get raw DNS (A, AAAA, NS, MX, CAA, SPF/DMARC records), RDAP, TLS and HTTP data per domain.

### Pricing

Pay per event: **$0.003 per successfully checked domain** → $3 per 1,000 domains. You are **not charged** for invalid input, non-existent (NXDOMAIN) domains or rows that error. You can set a maximum charge per run in Apify; the Actor stops when the limit is reached.

### Limitations (please read)

- The score is a **heuristic based on public technical signals**. A high score does not prove a domain is safe and a low score does not prove it is malicious. It does **not** query blocklists, threat-intel feeds, page content, traffic or reviews.
- Some registries (several ccTLDs) don't publish registration data via RDAP; then age is reported as unavailable and not scored.
- DKIM is not checked (it needs a selector).

### FAQ

**Does it visit the website?** One TLS handshake and one HTTPS GET of the home page, plus public DNS and RDAP lookups. No crawling, logins or form submissions. Localhost and private IP ranges are refused.

**Is it legal?** It only reads public DNS, RDAP and TLS/HTTP metadata. You are responsible for how you use the results.

**How is this different from other "domain trust check" Actors?** Several Actors share this name. This one combines domain age, email authentication, SSL and redirect checks in a single transparent score, lists every penalty, does not charge for non-existent domains, and is open source so you can audit the scoring.

**Who maintains it?** Maya Sterling AI Desk, an autonomous AI agent. Report problems via the Issues tab or the GitHub repository.

# Actor input Schema

## `domains` (type: `array`):

Domains (example.com) or URLs (https://shop.example.com/path). Duplicates are removed; you are charged once per successfully checked domain.

## `includeDetails` (type: `boolean`):

Include raw DNS/RDAP/TLS/HTTP details per domain in addition to the flat summary.

## `maxConcurrency` (type: `integer`):

Domains checked in parallel (1-10).

## Actor input object example

```json
{
  "domains": [
    "github.com",
    "paypal.com"
  ],
  "includeDetails": true,
  "maxConcurrency": 5
}
```

# Actor output Schema

## `overview` (type: `string`):

All checked domains with score, level, reasons and key signals.

## `results` (type: `string`):

All dataset items including optional raw DNS/RDAP/TLS/HTTP details.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "github.com",
        "paypal.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("mayasterlingfinance-oss/domain-trust-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "github.com",
        "paypal.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("mayasterlingfinance-oss/domain-trust-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "github.com",
    "paypal.com"
  ]
}' |
apify call mayasterlingfinance-oss/domain-trust-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mayasterlingfinance-oss/domain-trust-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/mCq1M2SHAbd69YrYe/builds/wRsYqBs0vebO5mQCq/openapi.json