Website Security Headers & Email DMARC/SPF Checker

What does Website Security & Email Trust Check do?

Website Security & Email Trust Check tests any list of domains for the basics that customers, insurers and security questionnaires ask about. You get a 0–100 score, an A–F grade and a prioritised fix list for each domain. It covers:

• Web: HTTP → HTTPS redirect, TLS version, certificate validity and expiry, HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy, software version leaks and security.txt (RFC 9116).
• Email: SPF (including the 10-lookup limit), DMARC policy and reporting, DKIM keys on common selectors, MTA-STS and SMTP TLS reporting.
• DNS: DNSSEC validation.

It's a bulk, API-friendly alternative to checking domains one by one in online header and DMARC checkers. It uses only public HTTP, TLS and DNS data. No browser, no proxy and no API key.

Why use this security headers and DMARC checker?

• 🏢 Agencies and web developers: audit every client site in one run and send the HTML report.
• 📧 Email deliverability: Google and Yahoo require SPF, DKIM and DMARC from bulk senders. See which domains are missing them.
• 🛡️ Security questionnaires, NIS2 and cyber-insurance forms: document the current state of HTTPS, HSTS and email authentication for all your domains.
• 🔁 Monitoring: schedule it weekly on Apify and get notified through webhooks, Slack, Zapier, Make or n8n when a score drops or a certificate is about to expire.
• 🤖 AI agents: small input, flat output and fast runs make it easy to call from Claude, ChatGPT or other agents through the Apify MCP server.

What does the security check return?

Field	Description
domain	Domain that was checked
score, grade	Overall 0–100 score and A–F grade
webScore, emailScore	Sub-scores for website and email security
failCount, warnCount	Number of failed and warning checks
httpRedirectsToHttps, tlsVersion, certDaysLeft	HTTPS facts
hsts, csp, securityTxt	Whether these protections are present
spf, dmarcPolicy, dkimSelectorsFound, mtaStsMode, dnssec	Email and DNS facts
topFixes	Up to 5 most important fixes, in plain language
checks	Every check with status (pass / warn / fail / info), finding, fix and reference (RFC or standard)

How to check website security headers and DMARC in bulk

1. Click Try for free.
2. Paste your domains (one per line), e.g. example.com.
3. Click Start.
4. Open the Overview table, or download report.html from the key-value store to share with a client.

How much does it cost?

Pay per event: you pay per domain checked (see the Pricing tab), plus a small amount of platform usage. Domains that don't resolve and aren't reachable are not charged. A run with 100 domains typically finishes in a few minutes at 256 MB memory.

Input

Only domains is required. Optional settings: your own DKIM selectors, whether to generate the HTML report, concurrency and timeout. See the Input tab.

Output example

{
  "domain": "example.com",
  "score": 58,
  "grade": "D",
  "webScore": 55,
  "emailScore": 50,
  "failCount": 3,
  "httpRedirectsToHttps": true,
  "tlsVersion": "TLSv1.3",
  "certDaysLeft": 71,
  "hsts": false,
  "spf": "v=spf1 -all",
  "dmarcPolicy": "reject",
  "dnssec": true,
  "topFixes": ["Add \"Strict-Transport-Security: max-age=31536000; includeSubDomains\" once all subdomains support HTTPS."]
}

You can download the dataset as JSON, CSV, Excel or HTML, or read it through the Apify API.

How is the score calculated?

Each check scores 1 for pass, 0.5 for warn and 0 for fail. Critical checks (certificate, HTTPS, HSTS, SPF, DMARC, DNSSEC) count double or triple. Informational checks (MX, optional MTA-STS, missing DKIM on common selectors) don't affect the score. The categories follow the public internet.nl tests and NCSC-NL TLS guidelines, but this Actor is independent and not affiliated with them.

FAQ

Why is DKIM "info" instead of "fail"? DNS can't list DKIM selectors. The Actor probes the most common ones (Google Workspace, Microsoft 365, Mailchimp and others). If you use a custom selector, add it under Custom DKIM selectors.

Is this a penetration test? No. It reads only public HTTP headers, TLS handshakes and DNS records, the same data any browser or mail server sees. It doesn't scan ports or try exploits.

Does it collect personal data? No. It only collects technical configuration data about the domains you enter.

Something looks wrong? Open an issue on the Issues tab. Issues get a reply within a couple of days.

Related: EU Accessibility Scanner · GDPR Cookie Consent Verifier · Bulk Core Web Vitals Monitor

Automated technical checks for information purposes; not legal or security advice.