# Changelog of SiteVerdict — Domain & Email Health Checker (`siteverdict/siteverdict-domain-email-health`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-domain-email-health/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-domain-email-health.md

## Changelog

### Unreleased (prepared 2026-10-15, NOT pushed) — Private-network (SSRF) protection

- `domainsListUrl` and every redirect hop of it are checked against private, loopback, link-local, cloud-metadata and internal addresses in every encoding (decimal/octal/hex IPv4, IPv4-mapped/NAT64/6to4 IPv6, unicode dots, single-label names) with a DNS-pinned client (the checked address is the connected address). A refused list URL loads nothing and is reported in `SUMMARY.domainsListUrl`.
- A domain whose name is internal or whose address is private is refused before any check runs: the row carries `error: "refused: private-network protection; not charged. ..."` and is not charged (`SUMMARY.domainsRefused`).
- HTTP probes (redirect chain, HSTS, security headers), TLS probes (apex and www) and the SMTP EHLO probe use the same pinned lookup, so a redirect or an MX record pointing at a private address is never connected to.
- No change to checks, scoring, pricing or the input schema; two additive SUMMARY fields (`domainsRefused`, `domainsListUrl`).

### 1.0.5 (2026-10-15)

- Runtime upgraded from Node.js 20 to Node.js 22 (Apify base image apify/actor-node:22). No change to checks, scoring, output fields or pricing.

### 1.0.0 (2026-10-11)

First release.

- Email checks: MX with provider detection, SPF with recursive lookup counting and void-lookup limits, DMARC with external report authorisation, DKIM probing of about 45 common selectors with key-length analysis, BIMI, MTA-STS with policy fetch and MX coverage, TLS-RPT.
- Web checks: SSL/TLS for apex and www (expiry, chain, hostname, key size, protocol, legacy TLS 1.0/1.1), HTTP→HTTPS redirect chain, HSTS with preload eligibility, security headers with CSP analysis.
- DNS checks: DNSSEC (including bogus detection), CAA (including whether the current CA can renew), nameservers.
- Optional checks, off by default: DNS blocklists for MX IPs and a polite SMTP STARTTLS EHLO probe.
- 0–100 score, A+ to F grade, email and web sub-scores, deliverability risk, Gmail/Yahoo bulk-sender readiness, top 5 fixes with ready-to-paste DNS records.
- Combined HTML report plus one HTML report per domain. Four dataset views.
- Bulk mode: domain list URL, concurrency, per-worker delay, shared DNS cache, resume without double-charging after migration.
- Pay-per-event `domain-checked`, charged only for successfully checked domains.