# Domain Security Analyzer — WHOIS, DNS, SSL & Company Contacts (`securas-technologies/domain-security-analyzer-whois-dns-ssl-tls`) Actor

Analyze any domain's WHOIS, DNS, email security, SSL/TLS certificates, protocols, ciphers and vulnerabilities, plus public company contacts (emails, phones, address, LinkedIn, VAT). Security score and grade in one API.

- **URL**: https://apify.com/securas-technologies/domain-security-analyzer-whois-dns-ssl-tls.md
- **Developed by:** [Securas Technologies](https://apify.com/securas-technologies) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $12.00 / 1,000 domain analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Domain Security Analyzer — WHOIS, DNS, SSL & Company Contacts

Analyze any domain's **WHOIS information, DNS configuration, SSL/TLS certificates, protocols, cipher suites, security vulnerabilities and public company contacts** — all through a single API.

Domain Security Analyzer combines domain intelligence and SSL/TLS security assessment into structured, machine-readable results. Enter a domain and automatically retrieve WHOIS registration information, DNS records, nameservers, SSL certificate details, supported TLS protocols, cipher suites, and potential SSL/TLS security issues — plus a **prioritized list of security findings, a 0–100 security score and an A+ to F grade**.

Built for cybersecurity teams, developers, SOC analysts, penetration testers, MSPs, and automated security monitoring platforms.

### ✨ Key features

- **WHOIS intelligence** — registration date, expiration date, registrar, nameservers, domain status (EPP codes), DNSSEC delegation, and the **public contacts** (registrant, administrative, technical): organization, name, postal address, phone, fax and email. When the registry is "thin" (.com, .net), the registrar's RDAP server is queried too. Uses **RDAP** (the modern, structured successor of WHOIS) with an automatic fallback to classic WHOIS.
- **DNS analysis** — A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records, nameserver redundancy, DNSSEC validation and **DNS zone transfer (AXFR) exposure**.
- **Email security** — SPF (with recursive DNS-lookup counting against the RFC 7208 limit of 10), DMARC policy, MTA-STS, TLS-RPT and BIMI.
- **SSL certificate analysis** — issuer, subject, SANs, validity and days until expiry, key type and size, signature algorithm, hostname match, full chain, trust validation against **Mozilla, Apple, Windows, Android and Java** trust stores, OCSP stapling, Certificate Transparency (SCTs), EV.
- **TLS protocol detection** — SSLv2, SSLv3, TLS 1.0, 1.1, 1.2 and 1.3.
- **Cipher suite analysis** — every accepted cipher suite per protocol, classified as `secure`, `weak` or `insecure` (NULL, anonymous, export, RC4, DES, 3DES/SWEET32, MD5, no forward secrecy, CBC), plus Diffie-Hellman key sizes (Logjam) and supported elliptic curves.
- **SSL/TLS vulnerability testing** — Heartbleed, OpenSSL CCS injection, ROBOT, CRIME (TLS compression), insecure renegotiation, client-initiated renegotiation DoS, TLS_FALLBACK_SCSV, TLS 1.3 0-RTT.
- **Company contact enrichment** — company name, public emails, phone numbers (validated, international format), postal addresses, social profiles (LinkedIn, Facebook, X, Instagram, YouTube, TikTok, GitHub), schema.org organization data and legal identifiers (VAT, SIREN/SIRET, tax ID), read from the website's home, contact, legal notice and about pages. Fills the gap when WHOIS data is redacted.
- **HTTP security** — HSTS presence, max-age, includeSubDomains and preload.
- **Security findings** — 50+ distinct checks turned into actionable findings with severity, description, recommendation and evidence.
- **Structured API output** — one clean JSON object per domain, ready for dashboards, SIEMs and automation.

### 🎯 Use cases

- **Attack surface monitoring** — continuously monitor the external security configuration of your domains (schedule the Actor daily or weekly).
- **SSL/TLS security audits** — identify weak protocols, cipher suites, certificate issues and insecure configurations.
- **Domain intelligence** — retrieve WHOIS and DNS information for security investigations and asset discovery.
- **Certificate monitoring** — track certificate validity and expiration before certificates become a business risk.
- **Email spoofing assessment** — verify SPF, DMARC and MTA-STS posture across a portfolio of domains.
- **Security automation** — integrate domain and SSL/TLS assessments into cybersecurity platforms, dashboards, CI/CD pipelines or monitoring workflows.
- **Lead enrichment** — turn a list of domains into companies with emails, phones, addresses and LinkedIn pages, plus a security score you can use as a sales trigger.
- **Supplier verification (KYB)** — check that a supplier's domain, registration data, website identity, legal identifiers and security posture are consistent.
- **Third-party risk assessment** — analyze the public-facing domain security configuration of suppliers and external services.

### 🚀 How to use

1. Enter one or more domains (bare domains like `example.com` or full URLs — the hostname is extracted automatically).
2. Choose the modules to run (WHOIS, DNS, SSL/TLS, vulnerability tests).
3. Click **Start**. Results appear in the dataset, one item per domain.

#### Input example

```json
{
  "domains": ["example.com", "https://www.github.com/login"],
  "checkWhois": true,
  "checkDns": true,
  "checkSsl": true,
  "checkVulnerabilities": true,
  "port": 443,
  "maxConcurrency": 5
}
```

| Field | Default | Description |
|---|---|---|
| `domains` | — | Domains or URLs to analyze (required). |
| `checkWhois` | `true` | RDAP / WHOIS registration data. |
| `checkDns` | `true` | DNS records, SPF, DMARC, CAA, DNSSEC, zone transfer. |
| `checkSsl` | `true` | Certificate, protocols, cipher suites, HSTS. |
| `checkVulnerabilities` | `true` | Active TLS vulnerability tests (adds ~15–60 s per domain). |
| `checkWebsiteContacts` | `true` | Extract public company contacts from the website (adds ~1–4 s per domain). |
| `port` | `443` | TLS port to analyze. |
| `maxContactPages` | `5` | Website pages read per domain for contact extraction. |
| `fallbackToWww` | `true` | Analyze `www.<domain>` if the apex does not answer on the TLS port. |
| `includeCipherSuites` | `true` | Include the full list of accepted cipher suites. |
| `includeCertificatePem` | `false` | Include the PEM-encoded certificate chain. |
| `includeRawWhois` | `false` | Include the raw WHOIS text (WHOIS fallback only). |
| `maxConcurrency` | `5` | Domains analyzed in parallel (1–20). |
| `timeoutSecs` | `10` | Network timeout per operation. |

### 📦 Output

Each domain produces one dataset item. Main fields:

| Field | Description |
|---|---|
| `domain` | Normalized domain analyzed. |
| `status` | `success`, `partial` (some modules failed), `failed`, `not_found` (NXDOMAIN) or `invalid` (bad input). |
| `securityScore` | 0–100 score (penalties per finding severity). |
| `grade` | `A+`, `A`, `B`, `C`, `D` or `F`. Any critical finding caps the grade at F, any high finding at C. |
| `findingsSummary` | Number of findings per severity. |
| `findings` | Sorted list of findings (`id`, `severity`, `category`, `title`, `description`, `recommendation`, `evidence`). |
| `tlsProtocols`, `spfStatus`, `dmarcPolicy` | Flat shortcuts for spreadsheets and table views (e.g. `"TLSv1.2, TLSv1.3"`; SPF `present` or `missing`; DMARC `reject`, `quarantine`, `none` or `missing`). |
| `topIssues` | One-line summary of all non-informational findings, most severe first (e.g. `[MEDIUM] SPF exceeds the 10 DNS lookup limit; [LOW] No CAA record`). |
| `hsts`, `dnssec`, `domainDaysUntilExpiry` | HSTS (`disabled`, `enabled`, `preload`), DNSSEC (`secure`, `unsigned`, `misconfigured`) and days before the domain registration expires. |
| `domainOwner`, `domainOwnerSource` | Public name of the domain holder: from WHOIS (registrant, or administrative contact when the registrant is anonymized), otherwise from the website (`domainOwnerSource: "website"`). |
| `contactEmails`, `contactPhones`, `linkedin`, `companyAddress`, `socialProfiles`, `legalIdentifiers` | Flat shortcuts with the public emails, phone numbers, LinkedIn page, main postal address, one profile per social network and legal identifiers found on the website. |
| `whois` | Registrar, dates, days until expiration, status, nameservers, and `contacts` (`registrant`, `administrative`, `technical`, `billing`) with organization, address, phone and email when published. Redacted contacts have `redacted: true` and, when available, a `contactUri` to reach the holder. |
| `dns` | Records, nameservers, `emailSecurity` (SPF / DMARC / MTA-STS / TLS-RPT / BIMI), `caa`, `dnssec`, `zoneTransfer`. |
| `ssl` | `certificate`, `protocols`, `ciphers`, `ellipticCurves`, `hsts`, `vulnerabilities`. |
| `website` | `companyName`, `emails`, `emailDomains`, `emailsOnOtherDomains`, `phones` (number, E.164, country, type), `addresses`, `socialProfiles`, `legalIdentifiers`, `organization` (schema.org), `pagesScanned`. If the site blocks bots: `reachable: false, blocked: true`. |
| `errors` | Per-module errors, if any. |
| `scannedAt` | ISO 8601 timestamp. |

The dataset has three ready-made views: **Overview** (one row per domain), **Security findings** (one row per finding — ideal for CSV/Excel export) and **Company contacts** (one row per domain with all public contact data).

#### Output example (truncated)

```json
{
  "domain": "github.com",
  "status": "success",
  "securityScore": 94,
  "grade": "A",
  "findingsSummary": { "critical": 0, "high": 0, "medium": 0, "low": 2, "info": 1 },
  "findings": [
    {
      "id": "DNSSEC_DISABLED",
      "severity": "low",
      "category": "dns",
      "title": "DNSSEC is not enabled",
      "description": "DNS responses are not signed, so resolvers cannot detect forged answers (cache poisoning).",
      "recommendation": "Enable DNSSEC with your DNS provider and publish the DS record at your registrar."
    }
  ],
  "whois": {
    "source": "rdap",
    "registrar": "MarkMonitor Inc.",
    "creationDate": "2007-10-09T18:20:50+00:00",
    "expirationDate": "2028-10-09T18:20:50+00:00",
    "daysUntilExpiration": 726,
    "status": ["clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited"],
    "nameservers": ["dns1.p08.nsone.net", "ns-421.awsdns-52.com"]
  },
  "dns": {
    "ipv4": ["140.82.121.4"],
    "emailSecurity": {
      "spf": { "status": "present", "allQualifier": "softfail", "dnsLookupCount": 10, "exceedsLookupLimit": false },
      "dmarc": { "status": "present", "policy": "quarantine", "subdomainPolicy": "reject", "percentage": 100 }
    },
    "caa": { "present": true, "issuers": ["digicert.com", "globalsign.com", "letsencrypt.org", "sectigo.com"] },
    "dnssec": { "enabled": false, "status": "unsigned" },
    "zoneTransfer": { "allowed": false }
  },
  "ssl": {
    "host": "github.com",
    "certificate": {
      "commonName": "github.com",
      "issuer": "Sectigo Limited",
      "notAfter": "2026-11-29T23:59:59+00:00",
      "daysUntilExpiry": 46,
      "publicKey": { "type": "EC", "size": 256, "curve": "secp256r1" },
      "hostnameMatches": true,
      "isTrusted": true,
      "trustedBy": ["Android", "Apple", "Java", "Mozilla", "Windows"]
    },
    "protocols": { "supported": ["TLSv1.2", "TLSv1.3"], "highest": "TLSv1.3" },
    "ciphers": { "totalAccepted": 17, "insecureCount": 0, "weakCount": 8 },
    "hsts": { "enabled": true, "maxAge": 31536000, "includeSubdomains": true, "preload": true },
    "vulnerabilities": {
      "heartbleed": false,
      "opensslCcsInjection": false,
      "robot": "NOT_VULNERABLE_NO_ORACLE",
      "crimeTlsCompression": false,
      "secureRenegotiation": true,
      "fallbackScsv": true
    }
  },
  "scannedAt": "2026-10-14T15:38:27+00:00"
}
```

### 🔌 Integration

Call the Actor synchronously and get results back in a single HTTP request:

```bash
curl -X POST "https://api.apify.com/v2/acts/securas-technologies~domain-security-analyzer-whois-dns-ssl-tls/run-sync-get-dataset-items?token=<APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com"]}'
```

Or with the Python client:

```python
from apify_client import ApifyClient

client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("securas-technologies/domain-security-analyzer-whois-dns-ssl-tls").call(run_input={"domains": ["example.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["domain"], item["grade"], item["findingsSummary"])
```

You can also schedule runs, send results to webhooks, or connect the Actor to Make, Zapier, n8n, Slack or Google Sheets through Apify integrations.

### ⏱️ Performance

- WHOIS + DNS: typically under 2 seconds per domain.
- SSL/TLS analysis: typically 2–10 seconds per domain.
- Vulnerability tests: add 15–60 seconds per domain, depending on the server (ROBOT is the slowest test). Disable `checkVulnerabilities` for fast inventory scans.

### ⚖️ Responsible use

The SSL/TLS tests perform standard TLS handshakes, comparable to tools such as SSL Labs, testssl.sh or sslyze. They do not exploit vulnerabilities or extract data. The website module reads at most `maxContactPages` public pages per domain, honors robots.txt and only collects business contact data that the company publishes itself. The DNS module performs a single zone transfer request per authoritative nameserver to check whether AXFR is exposed. Only analyze domains you own or are authorized to assess, and comply with applicable laws and the target's terms of service.

### ❓ FAQ

**Why is some registrant information missing?**
Since GDPR, registrars redact the contact data of most domains, especially .com / .net domains and domains held by individuals. Redacted contacts are returned with `redacted: true`, the fields that are still public (often country and state), and the registrar's `contactUri` form when available. Some registries, such as AFNIC for .fr, still publish the contacts of companies.

**Can I scan a non-HTTPS service, such as SMTPS or a custom port?**
Yes: set `port` (for example `465` for SMTPS or `8443`). HSTS is only relevant for HTTPS services.

**What happens if a module fails?**
The other modules still run. The item gets `status: "partial"` and the error is listed in `errors`.

**Do subdomains work?**
Yes. WHOIS is resolved on the registered domain automatically, DMARC and CAA follow the standard lookup rules up the DNS tree, and the TLS analysis runs on the exact hostname.

# Actor input Schema

## `domains` (type: `array`):

Domains to analyze. You can paste bare domains (example.com) or full URLs (https://www.example.com/path) — the hostname is extracted automatically.

## `checkWhois` (type: `boolean`):

Retrieve registration data: registrar, creation and expiration dates, nameservers, domain status, and public registrant information. Uses RDAP first, with a WHOIS (port 43) fallback.

## `checkDns` (type: `boolean`):

Resolve A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records, and evaluate email security (SPF, DMARC) and DNSSEC.

## `checkSsl` (type: `boolean`):

Analyze the certificate chain, supported SSL/TLS protocols, cipher suites, HSTS and key exchange.

## `checkVulnerabilities` (type: `boolean`):

Actively test for Heartbleed, OpenSSL CCS injection, ROBOT, CRIME (TLS compression), insecure renegotiation and TLS_FALLBACK_SCSV. Adds roughly 15–60 seconds per domain.

## `checkWebsiteContacts` (type: `boolean`):

Read the public website (home, contact, legal notice and about pages) to extract the company name, emails, phone numbers, postal address, social profiles, schema.org organization data and legal identifiers (VAT, SIREN/SIRET, tax ID). Useful for lead enrichment and supplier verification when WHOIS data is redacted. robots.txt is respected.

## `port` (type: `integer`):

Port used for the SSL/TLS analysis.

## `fallbackToWww` (type: `boolean`):

If the apex domain does not answer on the TLS port, analyze www.<domain> instead.

## `maxContactPages` (type: `integer`):

Maximum number of website pages read per domain for contact extraction (home page included).

## `includeCipherSuites` (type: `boolean`):

Include every accepted cipher suite (name, key size, key exchange) per protocol. When disabled, only counts and weak ciphers are returned.

## `includeCertificatePem` (type: `boolean`):

Include the PEM-encoded certificate chain in the output.

## `includeRawWhois` (type: `boolean`):

Include the raw WHOIS response when the WHOIS fallback is used.

## `maxConcurrency` (type: `integer`):

How many domains are analyzed in parallel.

## `timeoutSecs` (type: `integer`):

Timeout for individual network operations (DNS queries, RDAP/WHOIS requests, TLS connections).

## Actor input object example

```json
{
  "domains": [
    "example.com"
  ],
  "checkWhois": true,
  "checkDns": true,
  "checkSsl": true,
  "checkVulnerabilities": true,
  "checkWebsiteContacts": true,
  "port": 443,
  "fallbackToWww": true,
  "maxContactPages": 5,
  "includeCipherSuites": true,
  "includeCertificatePem": false,
  "includeRawWhois": false,
  "maxConcurrency": 5,
  "timeoutSecs": 10
}
```

# Actor output Schema

## `overview` (type: `string`):

One row per domain: status, security score, grade, findings count, registrar, domain and certificate expiry, TLS protocols, SPF and DMARC. Each full item also contains the complete whois, dns and ssl objects.

## `findings` (type: `string`):

One row per security finding (id, severity, category, title, description, recommendation), sorted by severity for each domain. Ideal for CSV or Excel export.

## `contacts` (type: `string`):

One row per domain with the company name, public emails, phone numbers, postal addresses, social profiles, legal identifiers and WHOIS contacts. Ideal for lead enrichment and supplier verification.

## `fullResults` (type: `string`):

Complete JSON item per domain, including certificate chain, cipher suites per protocol, DNS records, email security and vulnerability test results.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("securas-technologies/domain-security-analyzer-whois-dns-ssl-tls").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": ["example.com"] }

# Run the Actor and wait for it to finish
run = client.actor("securas-technologies/domain-security-analyzer-whois-dns-ssl-tls").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ]
}' |
apify call securas-technologies/domain-security-analyzer-whois-dns-ssl-tls --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,securas-technologies/domain-security-analyzer-whois-dns-ssl-tls"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/RA1CnHGcYur6XvZTr/builds/6bxM8ncL0nrREz2iX/openapi.json