DNS Intelligence & SSL Inspection Actor

A robust and comprehensive DNS intelligence Actor for the Apify platform that performs multi-record DNS queries, bulk domain processing, global propagation checks, reverse DNS lookups, SSL/TLS inspection, and advanced enrichment with email-security and metadata analysis — all with automatic retries and structured output.

Highlights

• Multi-record DNS lookup (A, AAAA, MX, TXT, NS, etc.)
• Global propagation and consistency check
• Reverse DNS and PTR record analysis
• SSL/TLS certificate fetch and expiry alert
• SPF/DMARC/DKIM parsing and email-security scoring
• JSON-structured output for easy integration

Features

Core Capabilities

• Comprehensive DNS Record Support: Query all major DNS record types including A, AAAA, MX, CNAME, TXT, NS, PTR, SOA, CAA, and SRV records
• Reverse DNS Lookup: Automatic IP → hostname resolution using PTR records for network reconnaissance and validation
• Bulk DNS Lookup Processing: Handle multiple domains simultaneously, saving time and computational resources
• Real-time DNS Propagation Checking: Verify DNS changes across multiple global DNS servers (Google DNS, Cloudflare, OpenDNS, Quad9, etc.)
• Automatic Retry Mechanisms: Built-in retry logic with exponential backoff for failed queries
• Rich Metadata: Include TTL values, response times, and detailed error information
• Structured JSON Output: Easy integration with existing workflows and data pipelines

Advanced Features

• DNS Enrichment & Email Security: Intelligent SPF/DMARC/DKIM parsing, MX provider detection, email security scoring (0-100), and actionable recommendations
• TLS/SSL Certificate Insights: Fetches live certificate metadata (issuer, SANs, expiry, cipher/protocol) and highlights risky configurations
• Quick Access Fields: Top-level convenience fields (mx_provider, spf_valid, dmarc_policy, has_dkim, etc.) for easy data access
• Configurable timeout settings
• Customizable retry attempts and delays
• Support for both domain names and IP addresses (including PTR lookups)
• Parallel processing for improved performance
• Detailed logging and error handling
• Propagation consistency analysis
• TTL categorization and analysis

Use Cases

This Actor is designed for:

• Cybersecurity Professionals: Conducting domain reconnaissance and security assessments
• Web Developers: Validating DNS configurations and troubleshooting connectivity issues
• IT Administrators: Monitoring network infrastructure and DNS health
• Digital Marketers: Researching competitor domains and infrastructure
• Data Analysts: Gathering DNS intelligence for various data analysis projects
• DevOps Teams: Automating DNS verification in CI/CD pipelines

Input Parameters

Required Parameters

• domains (array of strings): List of domain names or IP addresses to perform DNS lookups on. Minimum 1 domain required.

Optional Parameters

• recordTypes (array): DNS record types to query. Default: ["A", "AAAA", "MX", "CNAME", "TXT", "NS"]

  • Available types: A, AAAA, MX, CNAME, TXT, NS, PTR, SOA, CAA, SRV

• checkPropagation (boolean): Enable real-time DNS propagation checking across multiple global DNS servers. Default: false

• propagationServers (array of strings): List of DNS servers for propagation checking. Default: Google DNS, Cloudflare, OpenDNS, Quad9

  • Default servers: ["8.8.8.8", "1.1.1.1", "208.67.222.222", "9.9.9.9", "8.8.4.4"]

• performReverseLookup (boolean): Automatically perform reverse DNS lookup (IP → hostname) for IP addresses. Default: true

• enableEnrichment (boolean): Enable intelligent analysis of DNS records including SPF/DMARC/DKIM parsing, MX provider detection, TTL categorization, and email security scoring. Default: true

• enableSslInspection (boolean): Toggle the TLS/SSL certificate fetch step independently from the rest of the enrichment pipeline. Default: true

• timeout (integer): Query timeout in milliseconds. Range: 1000-30000. Default: 5000

• maxRetries (integer): Maximum retry attempts for failed queries. Range: 0-10. Default: 3

• retryDelay (integer): Delay between retry attempts in milliseconds. Range: 100-10000. Default: 1000

Input Examples

Basic DNS Lookup

{
  "domains": ["example.com", "google.com"],
  "recordTypes": ["A", "AAAA", "MX"]
}

Reverse DNS Lookup (IP → Hostname)

{
  "domains": ["8.8.8.8", "1.1.1.1", "142.250.184.206"],
  "performReverseLookup": true,
  "recordTypes": ["A"]
}

DNS Propagation Check

{
  "domains": ["newdomain.com"],
  "recordTypes": ["A", "AAAA", "CNAME"],
  "checkPropagation": true,
  "propagationServers": [
    "8.8.8.8",
    "1.1.1.1",
    "208.67.222.222",
    "9.9.9.9"
  ]
}

Comprehensive Lookup with All Options

{
  "domains": [
    "example.com",
    "test.org",
    "8.8.8.8"
  ],
  "recordTypes": ["A", "AAAA", "MX", "CNAME", "TXT", "NS", "SOA"],
  "checkPropagation": true,
  "timeout": 10000,
  "maxRetries": 5,
  "retryDelay": 2000
}

Bulk Domain Research

{
  "domains": [
    "competitor1.com",
    "competitor2.com",
    "competitor3.com",
    "competitor4.com",
    "competitor5.com"
  ],
  "recordTypes": ["A", "MX", "TXT", "NS"]
}

DNS Enrichment with Email & SSL Analysis

{
  "domains": ["example.com", "company.org"],
  "recordTypes": ["A", "MX", "TXT", "NS"],
  "enableEnrichment": true,
  "enableSslInspection": true
}

Output Format

The Actor outputs structured JSON data for each domain:

Standard Lookup Result

{
  "domain": "example.com",
  "lookupResult": {
    "domain": "example.com",
    "timestamp": "2024-01-15T10:30:00.000Z",
    "records": {
      "A": [
        {
          "type": "A",
          "address": "93.184.216.34",
          "ttl": 3600
        }
      ],
      "AAAA": [
        {
          "type": "AAAA",
          "address": "2606:2800:220:1:248:1893:25c8:1946",
          "ttl": 3600
        }
      ],
      "MX": [
        {
          "type": "MX",
          "exchange": "mail.example.com",
          "priority": 10
        }
      ],
      "TXT": [
        {
          "type": "TXT",
          "entries": ["v=spf1 include:_spf.example.com ~all"]
        }
      ]
    },
    "mx_provider": "Example Mail",
    "spf_valid": true,
    "ssl_certificate_expires_at": "2024-06-01T12:00:00.000Z",
    "ssl_days_until_expiry": 120,
    "metadata": {
      "queryTime": 125,
      "totalRecords": 4
    }
  }
}

Reverse DNS Lookup Result

{
  "domain": "8.8.8.8",
  "lookupResult": {
    "domain": "8.8.8.8",
    "timestamp": "2024-01-15T10:30:00.000Z",
    "records": {},
    "reverseLookup": {
      "hostnames": ["dns.google"],
      "responseTime": 45
    },
    "metadata": {
      "queryTime": 50,
      "totalRecords": 0
    }
  }
}

TLS/SSL Enrichment Block

When TLS inspection is enabled (via enableSslInspection) and the domain serves HTTPS traffic, the Actor augments the output with a structured TLS report under lookupResult.enrichment.ssl:

{
  "lookupResult": {
    "enrichment": {
      "ssl": {
        "certificate": {
          "subject": {
            "commonName": "example.com"
          },
          "issuer": {
            "commonName": "Example CA"
          },
          "validFrom": "2024-03-01T00:00:00.000Z",
          "validTo": "2024-06-01T12:00:00.000Z",
          "daysUntilExpiry": 120,
          "subjectAlternativeNames": [
            "example.com",
            "www.example.com"
          ],
          "isSelfSigned": false
        },
        "protocol": "TLSv1.3",
        "cipher": "TLS_AES_256_GCM_SHA384",
        "warnings": []
      }
    }
  }
}

Propagation Check Result

{
  "domain": "example.com",
  "lookupResult": { ... },
  "propagationResults": [
    {
      "domain": "example.com",
      "recordType": "A",
      "timestamp": "2024-01-15T10:30:00.000Z",
      "servers": {
        "8.8.8.8": {
          "records": [
            {
              "type": "A",
              "address": "93.184.216.34"
            }
          ],
          "responseTime": 45
        },
        "1.1.1.1": {
          "records": [
            {
              "type": "A",
              "address": "93.184.216.34"
            }
          ],
          "responseTime": 38
        }
      },
      "isPropagated": true,
      "consistencyPercentage": 100
    }
  ]
}

DNS Enrichment Result

When enrichment is enabled, the output includes quick-access fields at the top level and detailed analysis in the enrichment object:

{
  "domain": "example.com",
  "lookupResult": {
    "domain": "example.com",
    "timestamp": "2024-01-15T10:30:00.000Z",
    "records": {
      "A": [{ "type": "A", "address": "93.184.216.34", "ttl": 3600 }],
      "MX": [
        {
          "type": "MX",
          "exchange": "aspmx.l.google.com",
          "priority": 1,
          "ttl": 3600
        }
      ],
      "TXT": [
        {
          "type": "TXT",
          "entries": ["v=spf1 include:_spf.google.com ~all"],
          "ttl": 3600
        }
      ]
    },
    "mx_provider": "Google Workspace",
    "spf_valid": true,
    "spf_strict": false,
    "dmarc_policy": "quarantine",
    "has_dkim": true,
    "email_security_score": 85,
    "enrichment": {
      "emailSecurity": {
        "spf": {
          "version": "v=spf1",
          "mechanisms": [
            { "type": "include", "qualifier": "+", "value": "_spf.google.com" },
            { "type": "all", "qualifier": "~" }
          ],
          "isValid": true,
          "warnings": [],
          "lookupCount": 1
        },
        "dmarc": {
          "version": "DMARC1",
          "policy": "quarantine",
          "reportingEmails": {
            "aggregate": ["dmarc@example.com"]
          },
          "isValid": true,
          "warnings": []
        },
        "dkim": [
          { "selector": "google", "exists": true, "record": "v=DKIM1; k=rsa; p=..." }
        ],
        "mx": {
          "totalServers": 1,
          "primaryServer": "aspmx.l.google.com",
          "provider": { "name": "Google Workspace", "confidence": "high" },
          "hasBackup": false,
          "priorities": [1],
          "servers": [
            {
              "hostname": "aspmx.l.google.com",
              "priority": 1,
              "isBackup": false
            }
          ]
        },
        "score": 85,
        "recommendations": [
          "Consider upgrading DMARC policy to \"reject\" for maximum protection",
          "Add backup MX records for email redundancy"
        ]
      },
      "ttlAnalysis": {
        "A": {
          "value": 3600,
          "category": "normal",
          "description": "Normal TTL - standard configuration"
        }
      }
    },
    "metadata": {
      "queryTime": 450,
      "totalRecords": 3
    }
  }
}

Quick Access Fields (available at top level when enrichment is enabled):

• mx_provider: Email provider name (e.g., "Google Workspace", "Microsoft 365")
• spf_valid: SPF record validation status (true/false)
• spf_strict: Whether SPF has strict policy with -all (true/false)
• dmarc_policy: DMARC policy level ("none", "quarantine", or "reject")
• has_dkim: DKIM configuration presence (true/false)
• email_security_score: Overall email security score (0-100)

Detailed Enrichment Data (available in enrichment object):

• emailSecurity: Comprehensive email security analysis including SPF mechanisms, DMARC policies, DKIM selectors, MX analysis, scoring, and recommendations
• ttlAnalysis: TTL categorization for each record type (very-short, short, normal, long, very-long)

Performance Considerations

• Bulk Processing: The Actor processes domains sequentially to avoid overwhelming DNS servers
• Timeout Settings: Adjust timeout based on your network conditions (higher for unreliable networks)
• Retry Logic: Uses exponential backoff to handle transient failures gracefully
• Parallel Queries: Multiple record types are queried in parallel for each domain

Error Handling

The Actor includes robust error handling:

• Invalid domains are logged but don't stop execution
• Failed queries are retried automatically based on configuration
• Errors are captured and included in the output for debugging
• Each domain's results are independent (one failure doesn't affect others)

Best Practices

1. Start Small: Test with a few domains before running bulk lookups
2. Use Propagation Checking Wisely: Enable only when needed (e.g., after DNS changes)
3. Adjust Timeouts: Increase timeout for domains with slow DNS servers
4. Monitor Costs: Bulk lookups consume more compute units
5. Filter Record Types: Only query needed record types to improve performance

DNS Record Types Reference

• A: IPv4 address records
• AAAA: IPv6 address records
• MX: Mail exchange servers
• CNAME: Canonical name (alias) records
• TXT: Text records (often used for verification, SPF, DKIM)
• NS: Nameserver records
• PTR: Pointer records (reverse DNS)
• SOA: Start of Authority records
• CAA: Certification Authority Authorization
• SRV: Service location records

Limitations

• Maximum 10 retry attempts per query
• Timeout range: 1-30 seconds
• Some DNS servers may rate-limit queries
• Propagation checking increases execution time

Note: This Actor respects DNS server rate limits and implements responsible querying practices. For high-volume DNS lookups, consider implementing additional delays between requests.