Bulk Domain Security Audit – SSL/TLS, DNS, SPF & DMARC

Audit the security posture of hundreds of domains in a single run. For every domain you get one clear report covering the SSL/TLS certificate, TLS protocol versions, SPF, DMARC, DKIM, MX, CAA and DNS records, with a 0–100 score, an A–F grade and ready-to-apply recommendations.

Everything is measured directly over the TLS and DNS protocols (a real TLS handshake and real DNS queries). No scraping, no third-party API, no login, no personal data.

Why use it

• ✅ One row per domain: certificate, TLS and email-authentication checks in the same report, instead of juggling five different tools.
• ✅ Actionable: every issue comes with a concrete fix (for example "Publish _dmarc TXT v=DMARC1; p=quarantine…").
• ✅ Built for lists: paste 10 or 10,000 domains or URLs. Duplicates are removed, and invalid entries are skipped and never billed.
• ✅ Lightweight and polite: at most 2 requests per second to any given domain, comparable to a browser visit.
• ✅ Pay only for results: one charge per audited domain, nothing for failed or invalid inputs.

Use cases

1. Agencies and MSPs: audit every client domain each month and catch expiring certificates, missing DMARC or permissive SPF before they cause an outage or a spoofing incident.
2. Security and compliance teams: inventory the domains you own (or your suppliers' domains) and track TLS and email-authentication hygiene over time.
3. Email deliverability: check SPF, DMARC and DKIM before a campaign, since Gmail and Yahoo now require authenticated senders.
4. Sales and due diligence: screen a list of prospects or acquisition targets and rank them by security score.

How to use it

1. Click Try for free, paste your domains (or full URLs) into Domains.
2. Optionally add the DKIM selectors used by your mail providers (for example google, selector1, selector2).
3. Click Start. When the run finishes, export the results as JSON, CSV, Excel or HTML, or fetch them through the Apify API.

Tip: create a Schedule to re-run the audit every week or month and get alerted when a score drops.

What is checked

Area	Details
TLS certificate	Validity dates, days remaining, expiry, issuer, SANs, hostname match, trust chain, self-signed, key type and size, chain length, SHA-256 fingerprint
TLS protocols	Negotiated protocol and cipher, acceptance of deprecated TLS 1.0 and 1.1
SPF	Record, all policy (strict, soft, neutral, open), recursive DNS lookup count against the RFC 7208 limit of 10, duplicate records
DMARC	Policy (p, sp), pct, presence of aggregate and forensic report addresses (the addresses themselves are never returned)
DKIM	Active keys for the selectors you supply (revoked keys with an empty p= are ignored)
DNS	A, AAAA, NS, MX (null MX handled), CAA

Score and grade

Each domain starts at 100 points; every issue removes points according to its severity (for example an expired certificate, missing DMARC on a domain that receives mail, or TLS 1.0 still enabled).

Grade	Score
A	90–100
B	75–89
C	60–74
D	40–59
F	0–39

Email checks are weighted by context: a missing SPF or DMARC record costs more on a domain that has MX records (it receives mail) than on a domain that does not.

Input

{
  "items": ["example.com", "github.com", "https://expired.badssl.com/"],
  "port": 443,
  "timeoutSecs": 8,
  "dkimSelectors": ["default", "google", "selector1", "selector2"]
}

Field	Description	Default
items	Domains or URLs (only the hostname is used)	required
port	Port used for the TLS handshake	443
timeoutSecs	Network timeout per TLS connection and DNS lookup	8
dkimSelectors	DKIM selectors to look for; leave empty to skip DKIM	[]

Output

One dataset item per domain (abridged):

{
  "target": "expired.badssl.com",
  "domain": "expired.badssl.com",
  "checkedAt": "2026-09-18T10:00:00.000Z",
  "score": 47,
  "grade": "D",
  "tls": {
    "reachable": true,
    "protocol": "TLSv1.2",
    "trusted": false,
    "trustError": "CERT_HAS_EXPIRED",
    "hostnameMatches": true,
    "issuer": "COMODO CA Limited",
    "validTo": "2015-04-12T23:59:59.000Z",
    "daysRemaining": -4178,
    "expired": true,
    "keyType": "rsa",
    "keyBits": 2048,
    "chainLength": 2,
    "legacyProtocols": ["TLSv1", "TLSv1.1"]
  },
  "dns": {
    "a": ["104.154.89.105"],
    "mx": [],
    "caa": [],
    "dkimSelectorsFound": [],
    "spf": { "present": false, "policy": "none" },
    "dmarc": { "present": false }
  },
  "issues": [
    "Certificate expired",
    "Deprecated protocols accepted: TLSv1, TLSv1.1",
    "No SPF record",
    "No DMARC record"
  ],
  "recommendations": [
    "Renew the certificate immediately.",
    "Disable TLS 1.0 and 1.1 (RFC 8996).",
    "Publish a TXT record \"v=spf1 ... -all\".",
    "Publish _dmarc TXT \"v=DMARC1; p=quarantine; rua=...\" then move to p=reject."
  ]
}

issues and recommendations are aligned: the recommendation at index n fixes the issue at index n.

Pricing

Pay per event: $0.004 per audited domain, which is $4 per 1,000 domains. Invalid and duplicate entries are not charged. You can cap your spending with the maximum charge setting of each run.

Integrations

• API: start runs and download results from any language with the Apify API or clients.
• Schedules and webhooks: run the audit periodically and trigger a webhook when it finishes.
• Make, Zapier, n8n: send results to Google Sheets, Slack or your ticketing tool.
• AI agents: callable as a tool through the Apify MCP server.

FAQ

Is this intrusive or legal to run on third-party domains? The Actor only performs what any visitor does: a TLS handshake on the public port and public DNS lookups. It does not scan ports, test vulnerabilities or send email. Still, only audit domains you own or have a legitimate reason to assess.

Why is DKIM "not found" for my domain? DKIM keys live under a selector chosen by your mail provider and cannot be listed from DNS. Add your selectors in DKIM selectors (for example google for Google Workspace, selector1 and selector2 for Microsoft 365).

What happens if a domain does not answer? The report is still produced, with tls.reachable: false and the error message, and the score reflects it.

How fast is it? Several domains are audited in parallel; a typical domain takes a few seconds, depending on its DNS and TLS response times.

Limitations

• Only the port you specify is tested (443 by default); other services (SMTP, IMAP) are not audited.
• Detection of TLS 1.0 and 1.1 depends on the TLS library of the runtime and is best effort.
• DKIM can only be verified for the selectors you provide.