SPF, DMARC, DKIM & SSL Checker – Bulk Domain Health Audit

Audit a list of domains in one run and get a structured health report per domain: DNS, email authentication (SPF incl. the 10-lookup limit, DMARC, DKIM, MTA-STS), TLS certificate expiry, HTTP security-header grade, homepage SEO basics and the technologies a site uses – plus a plain list of issue codes you can filter on.

It only uses public DNS, a TLS handshake and a few polite web requests per domain (robots.txt, one homepage request, one HTTP→HTTPS redirect check). No logins, no scraping of page content, no personal data.

SPF checker, DMARC checker, DKIM check and SSL certificate expiry checker in one bulk run. An email security audit for MSPs, agencies and anyone managing many domains.

What a full run gives you

One row per domain with stable issue codes you can filter on. Example (fixture showing the shape; see the real example.com result under Output below):

{"domain": "client-a.example", "status": "OK",
 "email": {"spf": {"policy": "SOFTFAIL", "dnsLookups": 12}, "dmarc": {"policy": "none"}},
 "tls": {"daysUntilExpiry": 9, "issuer": "..."},
 "issues": ["SPF_TOO_MANY_LOOKUPS", "DMARC_POLICY_NONE", "DMARC_NO_REPORTING", "TLS_CERT_EXPIRES_LT_14D"]}

• Price: $0.009 per audited domain + $0.00005 per run. Invalid, duplicate and non-existent domains are not charged. Set "Max cost per run" to cap spend.
• Free Apify plan: the first 25 domains of each run are audited so you can check the output on your own domains; the rest are skipped and not charged. A paid Apify plan audits the whole list (up to 10,000 domains per run) at the same price per domain.

What you get for each domain

Section	Fields
DNS	resolves, IPv4 sample, IPv6 count, nameservers, CAA present
Email	MX hosts, mail provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast …), SPF (policy, total DNS lookups across includes, +all/ptr/multiple-record problems), DMARC (policy, pct, reporting configured – addresses are never output), DKIM selectors found (common selectors, extendable), MTA-STS, null-MX
TLS	protocol version, issuer, expiry date, days until expiry, validity (expired, self-signed, hostname mismatch, untrusted issuer), SAN count
Website	final URL, status code, response time, redirect chain, HTTP→HTTPS redirect, robots.txt / sitemap declared, security-header grade A–F (HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy), title / meta description / canonical / H1 count / viewport / Open Graph / hreflang / JSON-LD types
Technologies	CMS, e-commerce, JS frameworks, analytics & ad pixels, marketing automation, chat, CDN/hosting, web server, payment, consent tools (≈70 signatures)
Issues	stable codes such as SPF_MISSING, DMARC_POLICY_NONE, SPF_TOO_MANY_LOOKUPS, TLS_CERT_EXPIRES_LT_14D, NO_HSTS, MISSING_TITLE

Typical uses

• Agencies & MSPs – monthly health report for all client domains; alert on certificates expiring in < 30 days.
• Email deliverability – find domains with no DMARC, p=none, SPF over the 10-lookup limit (a silent cause of failed mail) before Google/Yahoo/Microsoft bulk-sender rules bite.
• Sales & lead qualification – enrich a prospect list with mail provider, CMS/e-commerce platform and marketing stack; find prospects with obvious security or SEO gaps.
• Security & compliance hygiene – baseline security headers, TLS posture and email authentication across a portfolio of domains.
• Due diligence / M&A – quick technical snapshot of many acquired or target domains.

How it compares

Checked on the Apify Store on 2026-10-23 (prices change; verify before you decide):

	This Actor	Single-purpose SSL or DNS checkers	Broader "security audit" Actors
Typical price per domain	$0.009 (+ $0.00005 per run)	about $0.001 to $0.01	about $0.02 to $0.03
TLS expiry and validity	yes	usually the only thing checked	yes
SPF incl. 10-lookup count, DMARC, DKIM probe, MTA-STS	yes	rarely	varies
Security-header grade, SEO basics, detected technologies	yes	no	varies
Stable issue codes to filter on	yes	rarely	varies
Pay only for domains actually audited	yes: invalid, duplicate and non-existent domains are free	varies	varies

Choose something else if you only need a certificate-expiry list for a handful of domains (a single-purpose checker can be cheaper), or if you need vulnerability scanning, port scanning or authenticated testing, which this Actor deliberately does not do.

Automate it: monthly reports, alerts and AI agents

• Schedule the Actor (Apify Schedules) and add a webhook or integration (for example Make, Zapier, n8n, Google Sheets or Slack through Apify's integrations) to be notified of rows whose issues contain TLS_CERT_EXPIRES_LT_30D, DMARC_MISSING or SPF_TOO_MANY_LOOKUPS.
• API: start a run and read the dataset with the Apify API or the official clients (Python, JavaScript). Set Maximum cost per run to cap spend: the Actor stops exactly at your limit.
• AI agents: the Actor can be called from MCP-compatible assistants through the Apify MCP server. The input is a plain list of domains and the output is flat, documented JSON with issue codes.

Recipes: audit client domains from code, n8n or a schedule

curl (synchronous, waits up to 300 s; good for a few hundred domains):

curl -X POST "https://api.apify.com/v2/actors/shephouse~domain-health-audit-bulk/run-sync-get-dataset-items?maxTotalChargeUsd=2" \
  -H "Authorization: Bearer $APIFY_TOKEN" -H "Content-Type: application/json" \
  -d '{"domains":["your-client.com"],"checkEmail":true,"checkTls":true,"checkWebsite":false}'

maxTotalChargeUsd is a hard cap on what the call can charge. For bigger lists start a run with the API or an official client and read the dataset when it finishes.

Keep only the rows that need action (n8n Code node; the same logic works in any language):

const bad = new Set(['SPF_MISSING','SPF_ALLOWS_ALL','SPF_TOO_MANY_LOOKUPS','DMARC_MISSING','DMARC_POLICY_NONE',
  'TLS_CERT_EXPIRED','TLS_CERT_EXPIRES_LT_14D','TLS_CERT_EXPIRES_LT_30D','TLS_CERT_INVALID']);
return $input.all().filter(i => (i.json.issues || []).some(c => bad.has(c)));

Monthly audit for an MSP: save your domain list as a task, add an Apify Schedule (for example 0 7 1 * *) and a "run succeeded" webhook that calls n8n, Make, Zapier or Slack. 200 domains cost $1.80 per run; 500 cost $4.50. The free Apify plan audits at most 25 domains per run. Audit only domains you manage or have permission to assess.

Input

{
  "domains": ["example.com", "https://www.iana.org/domains", "your-client.com"],
  "maxItems": 100,
  "checkEmail": true,
  "checkTls": true,
  "checkWebsite": true,
  "dkimSelectors": ["myselector"]
}

• domains – domains or URLs, one per line. Only the host is audited; paths are ignored. IP addresses, localhost and internal names are rejected.
• maxItems – hard cap per run (default 100, max 10,000).
• Switch off sections you do not need (checkEmail, checkTls, checkWebsite).
• dkimSelectors – DKIM selector names cannot be discovered from DNS, so common ones (google, selector1, selector2, k1, s1, default …) are probed. Add your own to extend.

Output (one dataset item per domain; real result for example.com, shortened)

{
  "input": "example.com",
  "domain": "example.com",
  "status": "OK",
  "billable": true,
  "detail": null,
  "auditedAt": "2026-10-23T18:25:32+00:00",
  "dns": {
    "resolves": true,
    "ipv4": [
      "172.66.147.243",
      "104.20.23.154"
    ],
    "ipv6Count": 2,
    "nameservers": [
      "elliott.ns.cloudflare.com",
      "hera.ns.cloudflare.com"
    ],
    "hasCaa": false
  },
  "email": {
    "hasMx": false,
    "mxCount": 0,
    "mxHosts": [],
    "mailProvider": null,
    "nullMx": true,
    "spf": {
      "present": true,
      "multiple": false,
      "record": "v=spf1 -all",
      "all": "-all",
      "policy": "FAIL",
      "includes": [],
      "redirect": null,
      "lookupTerms": 0,
      "hasPtr": false,
      "dnsLookups": 0,
      "lookupCountTruncated": false,
      "includeLoop": false
    },
    "dmarc": {
      "present": true,
      "multiple": false,
      "policy": "reject",
      "subdomainPolicy": "reject",
      "pct": 100,
      "aggregateReportAddresses": 0,
      "forensicReportAddresses": 0,
      "adkim": "s",
      "aspf": "s"
    },
    "dkimSelectorsFound": [],
    "dkimNote": "best-effort: only common/provided selector names are probed",
    "mtaSts": false
  },
  "tls": {
    "checked": true,
    "protocol": "TLSv1.3",
    "verified": true,
    "notAfter": "2026-12-25T22:56:35+00:00",
    "notBefore": "2026-09-26T22:49:11+00:00",
    "daysUntilExpiry": 63,
    "issuer": "SSL Corporation",
    "subjectCommonName": "example.com",
    "sanCount": 2
  },
  "website": {
    "reachable": true,
    "finalUrl": "https://example.com/",
    "statusCode": 200,
    "responseTimeMs": 27,
    "redirectChain": [],
    "contentType": "text/html",
    "server": "cloudflare",
    "httpsUsed": true,
    "securityHeaders": {
      "score": 0,
      "maxScore": 8,
      "grade": "F",
      "present": {
        "strict-transport-security": false,
        "content-security-policy": false,
        "x-content-type-options": false,
        "x-frame-options": false,
        "referrer-policy": false,
        "permissions-policy": false
      }
    },
    "page": {
      "title": "Example Domain",
      "titleLength": 14,
      "metaDescription": null,
      "metaDescriptionLength": 0,
      "canonical": null,
      "lang": "en",
      "hasViewport": true,
      "h1Count": 0,
      "hreflangCount": 0,
      "openGraph": false,
      "twitterCard": false,
      "robotsMeta": null,
      "generator": null,
      "structuredDataTypes": []
    },
    "httpToHttpsRedirect": false
  },
  "technologies": [
    {
      "name": "Cloudflare",
      "category": "CDN"
    }
  ],
  "issues": [
    "NO_HTTPS_REDIRECT",
    "NO_HSTS",
    "NO_CSP",
    "MISSING_META_DESCRIPTION",
    "MISSING_H1",
    "NO_CANONICAL",
    "NO_OPEN_GRAPH"
  ]
}

Runs also save a SUMMARY record (delivered, billable, skipped, stop reason).

Pricing – pay per audited domain

• $0.009 per domain audited (= $9 per 1,000) – event domain-audited.
• $0.00005 per run (Apify's standard start event; charged once per GB of run memory, so once at the default 512 MB).
• No other charges. You are never charged for: invalid input, duplicates, domains that do not exist, DNS temporary failures, domains pointing to private/reserved addresses, audits that failed internally, or status rows.
• A domain counts as audited when it has DNS records (a website is not required – email-only domains are audited too).
• Your Maximum cost per run is respected exactly: the Actor stops delivering when the next domain would exceed it (the start fee counts against that cap). Example: a cap of $0.03 delivers 3 domains; a cap below $0.00905 delivers none and returns one free MAX_COST_TOO_LOW row.
• Free Apify plan runs are limited to 25 domains per run.

How it behaves (and what it does not do)

• Polite by design: per domain at most robots.txt, one homepage request (HTTPS, with an HTTP fallback only if HTTPS is unavailable; following ≤5 redirects) and one HTTP→HTTPS redirect check that does not download a page. The homepage is not requested if robots.txt disallows it for automated agents (rows then show robotsDisallowed; DNS/TLS findings are still delivered). Requests identify themselves as ShepHouseAudit.
• No personal data collected: only technical metadata. Email addresses in DMARC records or on pages are never output; only counts.
• SSRF-safe: targets resolving to private, loopback, link-local or reserved addresses are never contacted – including redirect targets.
• Not a vulnerability scanner: no probing of ports, paths or services. Header and TLS grading is a hygiene indicator, not a penetration-test result.
• Technology detection is signature-based (headers, cookies, script/link URLs, meta tags). It can miss tools loaded dynamically or behind bot protection, and can occasionally be fooled by references to third-party assets.
• Product and company names mentioned (for example Google Workspace, Microsoft 365, Cloudflare) are trademarks of their owners and appear only to describe what was detected. No affiliation is implied.
• Sites that block bots (HTTP 403/429, challenges) return partial results; the status code is reported.
• DKIM discovery is best-effort (selector names are not enumerable). Wildcard DNS answers are detected and ignored.
• SPF lookup counting follows include/redirect up to 25 DNS queries and flags when truncated.
• Results are a point-in-time snapshot from the Actor's network location.

FAQ

Is this legal / allowed? It reads public DNS records, performs a standard TLS handshake and requests a public homepage once, honouring robots.txt – what a browser or search engine does. You are responsible for auditing only domains you are entitled to assess and for complying with applicable law.

How do I find domains whose SSL/TLS certificate expires soon? Run the Actor on your domain list and filter the dataset for tls.daysUntilExpiry below your threshold, or for the issue codes TLS_CERT_EXPIRES_LT_14D / TLS_CERT_EXPIRES_LT_30D. Schedule it weekly to be warned in time.

How do I check SPF, DMARC and the SPF 10-lookup limit for many domains at once? Paste the domains. Each row reports the SPF policy and total DNS lookups across includes (flagged as SPF_TOO_MANY_LOOKUPS above 10), the DMARC policy and the issue codes SPF_MISSING, DMARC_MISSING, DMARC_POLICY_NONE.

Is a "not audited" or free row a bug? No. Rows with billable: false explain why (invalid input, domain does not exist, temporary DNS failure, blocked non-public address). You are never charged for them.

Do you check that mailboxes exist? No. This Actor does not contact mail servers.

Why was I not charged for a row? Check status and billable: only OK rows are billable.

Can I schedule it? Yes – use Apify Schedules and a webhook/integration to alert on issues such as TLS_CERT_EXPIRES_LT_14D.

Changelog

• 0.1.6 – listing and documentation: clearer title and description (SPF, DMARC, DKIM, SSL), a "what a full run gives you" section, clearer input help and free-plan message. No change to audit logic, billing or pricing.
• 0.1.5 – documentation only: recipes for curl, n8n filtering and a monthly MSP schedule, with cost examples. No change to behavior or pricing.
• 0.1.4 – documentation only: comparison table, automation and AI-agent section, more FAQ answers. No change to behavior or pricing.
• 0.1.3 – the pre-filled example input is now one domain (example.com), so a run with the minimum cost limit ($0.01) audits it completely. The output example is now a real example.com result. No pricing or behavior change.
• 0.1 – first release: DNS, email authentication (SPF with recursive lookup count, DMARC, DKIM probe, MTA-STS), TLS, homepage checks with RFC 9309 robots.txt handling, ≈70 technology signatures, issue codes, pay-per-domain pricing, per-run caps, SSRF guard.

Support

Open an issue on this Actor's page with the domain, the run ID and what you expected. Please do not post customer data publicly.