Domain Security Posture Checker

DNS, SPF, DMARC, TLS

📊 Sample Output

domain	dmarcPolicy	sslIssuer	sslExpires	registrar	created
stripe.com	reject	DigiCert Inc	2026-11-12	SafeNames Ltd.	1995-09-12T04:00:00Z
github.com	quarantine	Sectigo Limited	2026-11-29	MarkMonitor Inc.	2007-10-09T18:20:50Z

Real rows from run Bbqpx0Fr1GhFHTOCp on build 0.0.6 (2026-09-25), unedited apart from masked emails/phones and shortened long text; fields the source does not publish are empty.

⚙️ Sample inputs

This is the Store example input — the same input Apify's automated check runs — so it is proven to return rows on the current build. Paste it into the input form, or send it through the API, CLI or a schedule:

{
  "domains": [
    "stripe.com",
    "github.com"
  ]
}

🔧 Input reference

Field	Type	Default	What it does
domains (required)	array	["stripe.com", "github.com"]	Domains to assess, e.g. ["stripe.com","example.org"].

🧾 JSON sample record

One real record from run Bbqpx0Fr1GhFHTOCp (emails/phones masked, long text shortened):

{
  "domain": "stripe.com",
  "score": 100,
  "grade": "A",
  "hasSPF": true,
  "spf": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
  "hasDMARC": true,
  "dmarcPolicy": "reject",
  "sslIssuer": "DigiCert Inc",
  "sslExpires": "2026-11-12",
  "sslDaysLeft": 48,
  "sslValid": true,
  "registrar": "SafeNames Ltd.",
  "created": "1995-09-12T04:00:00Z",
  "expires": "2027-09-11T04:00:00Z",
  "mx": [
    "10 aspmx.l.google.com.",
    "20 alt1.aspmx.l.google.com.",
    "20 alt2.aspmx.l.google.com.",
    "30 aspmx2.googlemail.com.",
    "30 aspmx3.googlemail.com."
  ],
  "nameservers": [
    "ns-1087.awsdns-07.org.",
    "ns-1882.awsdns-43.co.uk.",
    "ns-423.awsdns-52.com.",
    "ns-705.awsdns-24.net."
  ],
  "a": [
    "198.137.150.161",
    "198.202.176.161"
  ],
  "findings": []
}

💰 Pricing

Event	Price (USD)	When it is charged
Actor Start (apify-actor-start)	$0.005	Charged when the Actor starts running. Number of events charged depends on Actor memory (one event per GB, minimum one event).
Domain report (domain-report)	$0.15	Charged per domain report.

Pay-per-event: you pay only for what the run delivers. A run that delivers nothing bills no result events (only the actor-start event, when the actor defines one). Example: a run that delivers 100 results costs 100 × $0.15 = $15.00 plus the start fee.

🔗 Related Actors

More from the NexGenData Leads, contacts & enrichment family:

• Company SERP Snapshot Monitor
• Website Tech Stack Audit — Bulk BuiltWith Alternative API
• Website Contact Scraper — Emails & Phones from a URL List API
• Email DMARC Auditor — SPF/DKIM/DMARC Bulk Check
• Bulk Email Validator — Verify & Clean Lists API
• Google Maps Reviews Scraper — Local Review Monitoring API

30 more in this family on the NexGenData Store page.

⏰ Schedule it

Run on a schedule (0 8 * * 1) to monitor changes over time — an always-on domain watch.

📊 What you get

Clean JSON output (18 fields):

• domain — Domain
• score — Score
• grade — Grade
• hasSPF — Has SPF
• spf — Spf
• hasDMARC — Has DMARC
• dmarcPolicy — Dmarc Policy
• sslIssuer — Ssl Issuer

Pricing: $0.150 per domain (Pay-Per-Event) — about 7 domains per $1.

🤖 Use with AI agents

Point Claude, the OpenAI Agents SDK, an n8n flow or any MCP-aware client at it.

Sample agent prompt:

Run Domain Security Posture Checker on my input and return the structured results.

Agentic payments (x402): Supports agentic payment via x402 — call this actor with USDC, no API key required.

🔗 Related tools — Security audit toolkit

SSL Checker · DMARC Auditor · CVE Monitor · CISA KEV · Dependency Advisories · Chrome Extension Analyzer

---

A NexGenData utility actor.