# Domain Analyzer: DNS, Email Auth & WHOIS (`pontio/analyze-domain`) Actor

One report per domain: DNS and MX records, SPF/DMARC/DKIM grading, DNSSEC, and RDAP registration data.

- **URL**: https://apify.com/pontio/analyze-domain.md
- **Developed by:** [Gabor Molnar](https://apify.com/pontio) (community)
- **Categories:** Developer tools, SEO tools, Marketing
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 domain analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Domain Analyzer: DNS, Email Auth and WHOIS

One run, up to 1,000 domains, one report each: DNS records, mail routing, graded SPF/DMARC/DKIM, registration data from the registry, and whether the name is taken. Ask for all four facets or only the ones you need.

### What you get

One dataset item per domain you send. Here is one of them, for input `example.com` with all facets:

```json
{
  "domain": "example.com",
  "checks": ["dns", "email-auth", "registration", "availability"],
  "dns": {
    "a": ["104.20.23.154", "172.66.147.243"],
    "aaaa": ["2606:4700:10::ac42:93f3", "2606:4700:10::6814:179a"],
    "ns": ["hera.ns.cloudflare.com", "elliott.ns.cloudflare.com"],
    "txt": ["v=spf1 -all", "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"],
    "cname": [],
    "soa": "elliott.ns.cloudflare.com. dns.cloudflare.com. 2413856909 10000 2400 604800 1800",
    "caa": [],
    "mx": { "found": true, "nullMx": true, "implicit": false, "hosts": [] },
    "dnssec": true,
    "nxdomain": false
  },
  "emailAuth": {
    "spf": {
      "found": true,
      "record": "v=spf1 -all",
      "all": "-all",
      "grade": "strict",
      "lookupCount": 0,
      "overflow": false,
      "multipleRecords": false
    },
    "dmarc": {
      "found": true,
      "policy": "reject",
      "pct": 100,
      "rua": [],
      "grade": "enforced",
      "multipleRecords": false,
      "inheritedFrom": null
    },
    "dkim": {
      "checked": ["google", "selector1", "selector2", "k1", "default", "dkim"],
      "found": [],
      "confidence": "selector-guess"
    }
  },
  "registration": {
    "source": "rdap",
    "inconclusiveReason": null,
    "registrar": "RESERVED-Internet Assigned Numbers Authority",
    "createdAt": "1995-08-14T04:00:00Z",
    "expiresAt": "2027-08-13T04:00:00Z",
    "statuses": [
      "client delete prohibited",
      "client transfer prohibited",
      "client update prohibited"
    ],
    "nameservers": ["ELLIOTT.NS.CLOUDFLARE.COM", "HERA.NS.CLOUDFLARE.COM"],
    "registrantRedacted": true
  },
  "availability": { "registered": true, "indicator": "rdap-200" },
  "reasonCode": "ok"
}
```

### Use it when

- You are auditing email authentication across the domains you own or sell to, and need SPF and DMARC graded rather than dumped.
- You are qualifying inbound signups or leads, where mail setup and domain age say a lot about who you are dealing with.
- You are checking mail routing before a send: whether a domain accepts mail at all, which hosts take it, and at what priority.
- You are migrating DNS and want the before and after state of a domain in one structured record.
- An agent is enriching a list of domains and would otherwise fire eight DNS queries plus an RDAP call per row.

### Input

| Field | Type | Required | What it does |
| --- | --- | --- | --- |
| `domains` | array of strings | yes | The domains to analyze, up to 1,000 per run. A URL or an email address is reduced to its host name (a leading `www.` is dropped, other subdomains are kept), and internationalized names are converted to punycode. Each distinct name gets one dataset item and one charge: inputs that normalize to the same name count once. |
| `checks` | array | no | Any of `dns`, `email-auth`, `registration`, `availability`. Defaults to all four. The price is the same per report whichever facets you ask for; asking for fewer only skips work you don't need. |
| `dkimSelectors` | array | no | Up to 10 DKIM selectors to probe. Without this, a common-selector guess list is used and the result is marked as a guess. |

`checks` and `dkimSelectors` are run-wide settings: they apply to every domain in the batch, not to one of them. If different domains need different facets or different selectors, split them across runs.

`email-auth` reads SPF from the domain's root TXT records, so it runs the DNS lookup whether or not you asked for the `dns` facet. `availability` is derived from the same RDAP call as `registration`.

### What each facet answers

**dns** returns A, AAAA, NS, TXT, CNAME, SOA and CAA records, plus DNSSEC presence and an `nxdomain` flag when the name has no DNS presence at all. Mail routing is classified, not listed raw. `nullMx` marks an RFC 7505 `0 .` record, which means the domain refuses all mail, and `implicit` marks a domain with no MX record but an A record, which under RFC 5321 still receives mail at its own address. Hosts come back sorted by priority.

**email-auth** grades what it finds. SPF is `strict` for `-all`, `moderate` for `~all`, `weak` for `?all` or `+all`, and `none` when there is no usable policy. Terms are tokenized, so a hostname like `include:spf.mailall.com` is not mistaken for `+all`, and `lookupCount` counts the DNS-lookup terms in the domain's own SPF record, with `overflow` set when that alone exceeds RFC 7208's 10-lookup limit. Nested `include:` records are not followed, so the count is a lower bound: `overflow: true` means the record will fail at receivers, `false` does not prove it stays under the limit. DMARC is `enforced` for `p=reject`, `partial` for `p=quarantine`, `unprotected` for `p=none`. Publishing two SPF or two DMARC records makes both RFCs discard the whole set, so that case comes back as no policy with `multipleRecords: true` rather than a grade the domain does not actually have. A subdomain with no `_dmarc` record of its own is covered by its organizational domain's policy (RFC 7489 §6.6.3), so it is graded on that policy. The grade uses the parent's `sp=` tag when it has one, and its `p=` tag otherwise. `inheritedFrom` names the domain the policy came from. `inheritedFrom: null` means the record is published at the name you asked about. DKIM has no discovery mechanism, so `found` is only ever a statement about the selectors in `checked`.

**registration** returns registrar, creation and expiry dates, EPP statuses and registry nameservers from RDAP. Registrant contact data is redacted at the registries, and `registrantRedacted` says so rather than implying the field is empty for some other reason.

**availability** gives a registered flag backed by the RDAP response, and appears only when the registry answered conclusively. `registered: false` means the registry has no registration record, not that the name can be bought: reserved, blocked and premium names often have none.

### Pricing

Pay per event, $5.00 per 1,000 domains reported ($0.005 each), charged once on the `domain-analyzed` event.

A report is charged when at least one requested facet answered and none failed. A conclusive negative counts as an answer: `domain_not_found` means the checks came back and the domain is not there, which is what you asked. What you do not pay for is a report that our side of the transaction failed to produce.

The price is per report, not per facet. Some registries, `.de` among them, publish no public registration data. A report for such a domain still carries its DNS and email-authentication results, so it comes back `partial` and is charged like any other report, without the `registration` facet. If registration data is the only thing you need, use `domain-whois`, which charges nothing when no registry can answer.

| `reasonCode` | Meaning | Charged |
| --- | --- | --- |
| `ok` | Every requested facet answered. | yes |
| `partial` | Something answered, and a facet came back with "no registry can answer this". | yes |
| `domain_not_found` | The lookups succeeded and the domain does not exist. | yes |
| `inconclusive` | Everything resolved, nothing conclusive came back. | no |
| `unsupported_tld` | The TLD publishes no RDAP service. | no |
| `resolve_error` | An upstream lookup failed. | no |
| `rate_limited` | We were throttled upstream, which is our problem, not yours. | no |
| `invalid_domain` | Not a registrable name: an IP, a bare TLD, `localhost`, a malformed label. | no |

If you set a maximum total charge for a run, the Actor stops as soon as that limit is reached instead of working for free. Items after that point are left out of the dataset and not charged, and the run log says how many; submit them in a new run.

### What this does not do

It does not send mail or connect to any MX host, so it reports how a domain is configured to receive mail, not whether a given address exists.

DKIM absence at the probed selectors is not proof that a domain has no DKIM. Supply your own selectors when you know them, and `confidence` switches to `caller-provided`.

Registrant names, emails and addresses are not available from RDAP and are not returned.

### How it works

DNS runs over DNS-over-HTTPS against Cloudflare's 1.1.1.1 JSON API, and answers are filtered to the record type actually asked for, so a CNAME in the chain does not contaminate the A or MX results. Registration data comes from RDAP over HTTPS. Both retry on 429, 5xx and transport failures with exponential backoff, honor `Retry-After`, and enforce a per-attempt deadline. Availability is checked against IANA's RFC 9224 list of TLDs that publish RDAP, so an ambiguous 404 is never read as "this name is free". Subdomains are caught against the public suffix list before any RDAP call is made.

### One report per domain

Domains are analyzed in the order you send them, each written as its own dataset item. There is no start fee, so a list of 1,000 domains pays one container start for the whole run instead of one per name:

```js
const run = await client.actor('pontio/analyze-domain').call({
  domains: ['example.com', 'example.org'],
  checks: ['dns', 'email-auth'],
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
```

If you set a maximum charge for the run and the batch reaches it, the run stops there rather than carrying on with work it cannot charge for. A run that reaches its timeout stops the same way. Either way the items already written stay in the dataset, and each names what it answers, so you can re-run the remainder.

Only need registrar and expiry? Domain WHOIS / RDAP Lookup does that one lookup on its own.

# Actor input Schema

## `checks` (type: `array`):

Which facets to run; defaults to all of dns, email-auth, registration, availability

## `dkimSelectors` (type: `array`):

DKIM selectors to probe (max 10); defaults to a common-selector guess list

## `domains` (type: `array`):

Domains to analyze, e.g. example.com (max 1000 per run; a URL or email is reduced to its host name). One report and one charge per distinct name; inputs that normalize to the same name count once.

## Actor input object example

```json
{}
```

# Actor output Schema

## `results` (type: `string`):

One item per input, in this run's default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("pontio/analyze-domain").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("pontio/analyze-domain").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call pontio/analyze-domain --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,pontio/analyze-domain"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/YU6xRqI3bRDcWNrU4/builds/UnPy5GQ73OjJFKlo6/openapi.json