Domain Security Analyzer — WHOIS, DNS, SSL & Company Contacts

Analyze any domain's WHOIS information, DNS configuration, SSL/TLS certificates, protocols, cipher suites, security vulnerabilities and public company contacts — all through a single API.

Domain Security Analyzer combines domain intelligence and SSL/TLS security assessment into structured, machine-readable results. Enter a domain and automatically retrieve WHOIS registration information, DNS records, nameservers, SSL certificate details, supported TLS protocols, cipher suites, and potential SSL/TLS security issues — plus a prioritized list of security findings, a 0–100 security score and an A+ to F grade.

Built for cybersecurity teams, developers, SOC analysts, penetration testers, MSPs, and automated security monitoring platforms.

✨ Key features

• WHOIS intelligence — registration date, expiration date, registrar, nameservers, domain status (EPP codes), DNSSEC delegation, and the public contacts (registrant, administrative, technical): organization, name, postal address, phone, fax and email. When the registry is "thin" (.com, .net), the registrar's RDAP server is queried too. Uses RDAP (the modern, structured successor of WHOIS) with an automatic fallback to classic WHOIS.
• DNS analysis — A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records, nameserver redundancy, DNSSEC validation and DNS zone transfer (AXFR) exposure.
• Email security — SPF (with recursive DNS-lookup counting against the RFC 7208 limit of 10), DMARC policy, MTA-STS, TLS-RPT and BIMI.
• SSL certificate analysis — issuer, subject, SANs, validity and days until expiry, key type and size, signature algorithm, hostname match, full chain, trust validation against Mozilla, Apple, Windows, Android and Java trust stores, OCSP stapling, Certificate Transparency (SCTs), EV.
• TLS protocol detection — SSLv2, SSLv3, TLS 1.0, 1.1, 1.2 and 1.3.
• Cipher suite analysis — every accepted cipher suite per protocol, classified as secure, weak or insecure (NULL, anonymous, export, RC4, DES, 3DES/SWEET32, MD5, no forward secrecy, CBC), plus Diffie-Hellman key sizes (Logjam) and supported elliptic curves.
• SSL/TLS vulnerability testing — Heartbleed, OpenSSL CCS injection, ROBOT, CRIME (TLS compression), insecure renegotiation, client-initiated renegotiation DoS, TLS_FALLBACK_SCSV, TLS 1.3 0-RTT.
• Company contact enrichment — company name, public emails, phone numbers (validated, international format), postal addresses, social profiles (LinkedIn, Facebook, X, Instagram, YouTube, TikTok, GitHub), schema.org organization data and legal identifiers (VAT, SIREN/SIRET, tax ID), read from the website's home, contact, legal notice and about pages. Fills the gap when WHOIS data is redacted.
• HTTP security — HSTS presence, max-age, includeSubDomains and preload.
• Security findings — 50+ distinct checks turned into actionable findings with severity, description, recommendation and evidence.
• Structured API output — one clean JSON object per domain, ready for dashboards, SIEMs and automation.

🎯 Use cases

• Attack surface monitoring — continuously monitor the external security configuration of your domains (schedule the Actor daily or weekly).
• SSL/TLS security audits — identify weak protocols, cipher suites, certificate issues and insecure configurations.
• Domain intelligence — retrieve WHOIS and DNS information for security investigations and asset discovery.
• Certificate monitoring — track certificate validity and expiration before certificates become a business risk.
• Email spoofing assessment — verify SPF, DMARC and MTA-STS posture across a portfolio of domains.
• Security automation — integrate domain and SSL/TLS assessments into cybersecurity platforms, dashboards, CI/CD pipelines or monitoring workflows.
• Lead enrichment — turn a list of domains into companies with emails, phones, addresses and LinkedIn pages, plus a security score you can use as a sales trigger.
• Supplier verification (KYB) — check that a supplier's domain, registration data, website identity, legal identifiers and security posture are consistent.
• Third-party risk assessment — analyze the public-facing domain security configuration of suppliers and external services.

🚀 How to use

1. Enter one or more domains (bare domains like example.com or full URLs — the hostname is extracted automatically).
2. Choose the modules to run (WHOIS, DNS, SSL/TLS, vulnerability tests).
3. Click Start. Results appear in the dataset, one item per domain.

Input example

{
  "domains": ["example.com", "https://www.github.com/login"],
  "checkWhois": true,
  "checkDns": true,
  "checkSsl": true,
  "checkVulnerabilities": true,
  "port": 443,
  "maxConcurrency": 5
}

Field	Default	Description
domains	—	Domains or URLs to analyze (required).
checkWhois	true	RDAP / WHOIS registration data.
checkDns	true	DNS records, SPF, DMARC, CAA, DNSSEC, zone transfer.
checkSsl	true	Certificate, protocols, cipher suites, HSTS.
checkVulnerabilities	true	Active TLS vulnerability tests (adds ~15–60 s per domain).
checkWebsiteContacts	true	Extract public company contacts from the website (adds ~1–4 s per domain).
port	443	TLS port to analyze.
maxContactPages	5	Website pages read per domain for contact extraction.
fallbackToWww	true	Analyze www.<domain> if the apex does not answer on the TLS port.
includeCipherSuites	true	Include the full list of accepted cipher suites.
includeCertificatePem	false	Include the PEM-encoded certificate chain.
includeRawWhois	false	Include the raw WHOIS text (WHOIS fallback only).
maxConcurrency	5	Domains analyzed in parallel (1–20).
timeoutSecs	10	Network timeout per operation.

📦 Output

Each domain produces one dataset item. Main fields:

Field	Description
domain	Normalized domain analyzed.
status	success, partial (some modules failed), failed, not_found (NXDOMAIN) or invalid (bad input).
securityScore	0–100 score (penalties per finding severity).
grade	A+, A, B, C, D or F. Any critical finding caps the grade at F, any high finding at C.
findingsSummary	Number of findings per severity.
findings	Sorted list of findings (id, severity, category, title, description, recommendation, evidence).
tlsProtocols, spfStatus, dmarcPolicy	Flat shortcuts for spreadsheets and table views (e.g. "TLSv1.2, TLSv1.3"; SPF present or missing; DMARC reject, quarantine, none or missing).
topIssues	One-line summary of all non-informational findings, most severe first (e.g. [MEDIUM] SPF exceeds the 10 DNS lookup limit; [LOW] No CAA record).
hsts, dnssec, domainDaysUntilExpiry	HSTS (disabled, enabled, preload), DNSSEC (secure, unsigned, misconfigured) and days before the domain registration expires.
domainOwner, domainOwnerSource	Public name of the domain holder: from WHOIS (registrant, or administrative contact when the registrant is anonymized), otherwise from the website (domainOwnerSource: "website").
contactEmails, contactPhones, linkedin, companyAddress, socialProfiles, legalIdentifiers	Flat shortcuts with the public emails, phone numbers, LinkedIn page, main postal address, one profile per social network and legal identifiers found on the website.
whois	Registrar, dates, days until expiration, status, nameservers, and contacts (registrant, administrative, technical, billing) with organization, address, phone and email when published. Redacted contacts have redacted: true and, when available, a contactUri to reach the holder.
dns	Records, nameservers, emailSecurity (SPF / DMARC / MTA-STS / TLS-RPT / BIMI), caa, dnssec, zoneTransfer.
ssl	certificate, protocols, ciphers, ellipticCurves, hsts, vulnerabilities.
website	companyName, emails, emailDomains, emailsOnOtherDomains, phones (number, E.164, country, type), addresses, socialProfiles, legalIdentifiers, organization (schema.org), pagesScanned. If the site blocks bots: reachable: false, blocked: true.
errors	Per-module errors, if any.
scannedAt	ISO 8601 timestamp.

The dataset has three ready-made views: Overview (one row per domain), Security findings (one row per finding — ideal for CSV/Excel export) and Company contacts (one row per domain with all public contact data).

Output example (truncated)

{
  "domain": "github.com",
  "status": "success",
  "securityScore": 94,
  "grade": "A",
  "findingsSummary": { "critical": 0, "high": 0, "medium": 0, "low": 2, "info": 1 },
  "findings": [
    {
      "id": "DNSSEC_DISABLED",
      "severity": "low",
      "category": "dns",
      "title": "DNSSEC is not enabled",
      "description": "DNS responses are not signed, so resolvers cannot detect forged answers (cache poisoning).",
      "recommendation": "Enable DNSSEC with your DNS provider and publish the DS record at your registrar."
    }
  ],
  "whois": {
    "source": "rdap",
    "registrar": "MarkMonitor Inc.",
    "creationDate": "2007-10-09T18:20:50+00:00",
    "expirationDate": "2028-10-09T18:20:50+00:00",
    "daysUntilExpiration": 726,
    "status": ["clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited"],
    "nameservers": ["dns1.p08.nsone.net", "ns-421.awsdns-52.com"]
  },
  "dns": {
    "ipv4": ["140.82.121.4"],
    "emailSecurity": {
      "spf": { "status": "present", "allQualifier": "softfail", "dnsLookupCount": 10, "exceedsLookupLimit": false },
      "dmarc": { "status": "present", "policy": "quarantine", "subdomainPolicy": "reject", "percentage": 100 }
    },
    "caa": { "present": true, "issuers": ["digicert.com", "globalsign.com", "letsencrypt.org", "sectigo.com"] },
    "dnssec": { "enabled": false, "status": "unsigned" },
    "zoneTransfer": { "allowed": false }
  },
  "ssl": {
    "host": "github.com",
    "certificate": {
      "commonName": "github.com",
      "issuer": "Sectigo Limited",
      "notAfter": "2026-11-29T23:59:59+00:00",
      "daysUntilExpiry": 46,
      "publicKey": { "type": "EC", "size": 256, "curve": "secp256r1" },
      "hostnameMatches": true,
      "isTrusted": true,
      "trustedBy": ["Android", "Apple", "Java", "Mozilla", "Windows"]
    },
    "protocols": { "supported": ["TLSv1.2", "TLSv1.3"], "highest": "TLSv1.3" },
    "ciphers": { "totalAccepted": 17, "insecureCount": 0, "weakCount": 8 },
    "hsts": { "enabled": true, "maxAge": 31536000, "includeSubdomains": true, "preload": true },
    "vulnerabilities": {
      "heartbleed": false,
      "opensslCcsInjection": false,
      "robot": "NOT_VULNERABLE_NO_ORACLE",
      "crimeTlsCompression": false,
      "secureRenegotiation": true,
      "fallbackScsv": true
    }
  },
  "scannedAt": "2026-10-14T15:38:27+00:00"
}

🔌 Integration

Call the Actor synchronously and get results back in a single HTTP request:

curl -X POST "https://api.apify.com/v2/acts/securas-technologies~domain-security-analyzer-whois-dns-ssl-tls/run-sync-get-dataset-items?token=<APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com"]}'

Or with the Python client:

from apify_client import ApifyClient

client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("securas-technologies/domain-security-analyzer-whois-dns-ssl-tls").call(run_input={"domains": ["example.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["domain"], item["grade"], item["findingsSummary"])

You can also schedule runs, send results to webhooks, or connect the Actor to Make, Zapier, n8n, Slack or Google Sheets through Apify integrations.

⏱️ Performance

• WHOIS + DNS: typically under 2 seconds per domain.
• SSL/TLS analysis: typically 2–10 seconds per domain.
• Vulnerability tests: add 15–60 seconds per domain, depending on the server (ROBOT is the slowest test). Disable checkVulnerabilities for fast inventory scans.

⚖️ Responsible use

The SSL/TLS tests perform standard TLS handshakes, comparable to tools such as SSL Labs, testssl.sh or sslyze. They do not exploit vulnerabilities or extract data. The website module reads at most maxContactPages public pages per domain, honors robots.txt and only collects business contact data that the company publishes itself. The DNS module performs a single zone transfer request per authoritative nameserver to check whether AXFR is exposed. Only analyze domains you own or are authorized to assess, and comply with applicable laws and the target's terms of service.

❓ FAQ

Why is some registrant information missing? Since GDPR, registrars redact the contact data of most domains, especially .com / .net domains and domains held by individuals. Redacted contacts are returned with redacted: true, the fields that are still public (often country and state), and the registrar's contactUri form when available. Some registries, such as AFNIC for .fr, still publish the contacts of companies.

Can I scan a non-HTTPS service, such as SMTPS or a custom port? Yes: set port (for example 465 for SMTPS or 8443). HSTS is only relevant for HTTPS services.

What happens if a module fails? The other modules still run. The item gets status: "partial" and the error is listed in errors.

Do subdomains work? Yes. WHOIS is resolved on the registered domain automatically, DMARC and CAA follow the standard lookup rules up the DNS tree, and the TLS analysis runs on the exact hostname.