Domain, DNS and SSL Report (bulk health check)

One health report per domain, up to 500 domains per run: registration and expiry from the registry's own RDAP service, DNS records with the mail and nameserver provider named, SPF and the DMARC policy, the TLS certificate with days remaining, and a ranked list of issues per domain. Everything comes from official public protocols, so there is nothing to scrape and nothing to block.

Why this scraper

• It tells you what is wrong, not just what is there. A domain expiring in nine days, a certificate that expired last week, a DMARC policy on p=none that blocks nothing, a certificate that does not cover the domain: each comes back as an issue with a severity (critical, warning, info), a sentence and the measured value, worst first.
• Four checks in one row. Registration, DNS, e-mail authentication and TLS, so a portfolio review is one run instead of four tools.
• Providers named, not just hostnames. mailProvider: Google Workspace, nameserverProvider: Cloudflare, derived from the actual MX and NS records. That is the column a sales or migration team filters on.
• Official protocols only. RDAP is the registries' own successor to WHOIS, DNS goes over DNS-over-HTTPS, and the certificate is read from a normal TLS handshake. No website is fetched, no robots.txt question arises, no proxy is needed, and there is nothing that can rate-limit you into an empty dataset.
• Registrant data is never requested. Registries redact the registrant's name and e-mail by default and this actor asks only for what is public. Only the registrar, a company, is reported.
• Availability included. A domain that is not registered comes back as a full row with isRegistered: false, which answers "is this name free" for a whole list.

Who this is for

IT and security teams watching a domain portfolio for expiries and missing e-mail authentication. Agencies auditing client domains before they inherit the problem. Sales teams qualifying a lead list by mail provider or hosting. Domain investors checking availability in bulk.

Who this is not for

Read this before you buy. Expiry dates depend on the registry: generic domains (.com, .net, .org and most new endings) publish them, and a number of country registries do not. .nl is one of those, so a Dutch domain comes back with a registration date, a status and nameservers but expiryDate: null. That is the registry's choice, not a gap in the data we asked for.

This actor also reports what the public record says, not who owns it: there is no registrant name, address, phone number or e-mail in the output, and there is no way to switch that on. If you need contact data, this is the wrong tool.

Input fields

Field	Type	Required or default	What it does
domains	list of text	required	Domains, one per row, up to 500 (example: apify.com). A URL is accepted and reduced to its domain. Subdomains work for DNS and TLS; registration data always comes from the registrable domain.
includeDns	true/false	true	Look up A, AAAA, MX, NS and TXT records over DNS-over-HTTPS, plus the SPF and DMARC policy.
includeSsl	true/false	true	Open a TLS connection on port 443 and read the certificate: issuer, validity, days remaining and whether it covers the domain.
expiryWarningDays	number	30	A domain or certificate expiring within this many days is reported as an issue.

Input example

{
    "domains": ["apify.com", "nu.nl", "example-that-is-free.com"],
    "includeDns": true,
    "includeSsl": true,
    "expiryWarningDays": 30
}

A URL is accepted and reduced to its domain. Subdomains work for DNS and TLS; the registration data always comes from the registrable domain.

Output example

Field	Type	What it holds	Example
domain	text	The domain this row is about.	apify.com
isRegistered	true/false	True when the domain is registered; an unregistered domain has nothing further to report.	True
issueCount	number	How many findings this row holds; zero means nothing went wrong.	0
issues	list	The findings themselves, each with what is wrong and how serious it is.
registrar	text	Filled from the domain registry; empty when the domain is not registered.	Amazon Registrar, Inc.
createdDate	text	Filled from the domain registry; empty when the domain is not registered.	2009-06-02T17:14:10
updatedDate	text	Filled from the domain registry; empty when the registry publishes no change date.	2026-05-16T16:53:04
expiryDate	text	Filled from the domain registry; empty when the domain is not registered.	2035-06-02T17:14:10
daysUntilExpiry	number	Counted from expiryDate; empty when the registry gives no expiry date.	3167
domainStatuses	list	Filled from the domain registry; empty when the domain is not registered.	["client transfer prohibited"]
nameservers	list	Filled from the domain registry; empty when the domain is not registered.	["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk"]
nameserverProvider	text	Filled when includeDns is on and the nameserver is a provider we recognise.	AWS Route 53
hasDnssec	true/false	Filled from the domain registry; empty when the domain is not registered.	True
aRecords	list	Filled when includeDns is on; empty otherwise.	["3.170.42.68", "3.170.42.76"]
aaaaRecords	list	Filled when includeDns is on; empty otherwise, and for a domain without IPv6.	["2600:9000:2870:3a00:9:a03e:6540:93a1", "2600:9000:2870:...
mxRecords	list	Filled when includeDns is on; empty otherwise, and for a domain that receives no mail.	["1 aspmx.l.google.com.", "5 alt1.aspmx.l.google.com."]
mailProvider	text	Filled when includeDns is on and the MX record points at a provider we recognise.
txtRecords	list	Filled when includeDns is on; empty otherwise.	["tito-domain-verification=pbg2696rvzbax2t4dl7h5ynqm", "o...
hasSpf	true/false	Filled when includeDns is on; empty otherwise.	True
spfRecord	text	Filled when includeDns is on and the domain publishes an SPF record.	v=spf1 a mx include:_spf.google.com include:mailgun.org i...
hasDmarc	true/false	Filled when includeDns is on; empty otherwise.	True
dmarcPolicy	text	Filled when includeDns is on and the domain publishes a DMARC record.	reject
dmarcRecord	text	Filled when includeDns is on and the domain publishes a DMARC record.
sslIssuer	text	Filled when includeSsl is on and the host completes a TLS connection on port 443.	Amazon
sslValidFrom	text	Filled when includeSsl is on and the host completes a TLS connection on port 443.	2026-07-03
sslValidTo	text	Filled when includeSsl is on and the host completes a TLS connection on port 443.	2027-01-16
sslDaysRemaining	number	Counted from sslValidTo; empty when no certificate was read.	108
sslCoversDomain	true/false	Filled when a certificate was read and it lists at least one name.	True
sslNameCount	number	Filled when a certificate was read and it lists at least one name.	4
tlsVersion	text	Filled when includeSsl is on and the host completes a TLS connection on port 443.	TLSv1.3

{
    "domain": "apify.com",
    "isRegistered": true,
    "issueCount": 0,
    "issues": [],
    "registrar": "Amazon Registrar, Inc.",
    "createdDate": "2015-09-09T12:01:02",
    "updatedDate": "2026-08-01T09:00:00",
    "expiryDate": "2035-06-02T17:14:10",
    "daysUntilExpiry": 3184,
    "domainStatuses": ["client transfer prohibited"],
    "nameservers": ["ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
    "nameserverProvider": "AWS Route 53",
    "hasDnssec": false,
    "aRecords": ["3.33.152.147"],
    "aaaaRecords": [],
    "mxRecords": ["1 aspmx.l.google.com.", "5 alt1.aspmx.l.google.com."],
    "mailProvider": "Google Workspace",
    "txtRecords": ["v=spf1 include:_spf.google.com ~all"],
    "hasSpf": true,
    "spfRecord": "v=spf1 include:_spf.google.com ~all",
    "hasDmarc": true,
    "dmarcPolicy": "reject",
    "dmarcRecord": "v=DMARC1; p=reject; rua=mailto:...",
    "sslIssuer": "Amazon",
    "sslValidFrom": "2026-05-13",
    "sslValidTo": "2027-01-16",
    "sslDaysRemaining": 125,
    "sslCoversDomain": true,
    "sslNameCount": 4,
    "tlsVersion": "TLSv1.2",
    "status": "ok"
}

A domain with problems, shortened to its issues:

{
    "domain": "example.nl",
    "issueCount": 3,
    "issues": [
        {"code": "tls-expiring", "severity": "critical", "message": "The TLS certificate expires in 6 days", "value": 6},
        {"code": "no-dmarc", "severity": "warning", "message": "No DMARC record, so spoofed mail is not rejected or reported", "value": null},
        {"code": "no-dnssec", "severity": "info", "message": "DNSSEC is not enabled for this domain", "value": null}
    ]
}

Error codes: INVALID_DOMAIN, LOOKUP_FAILED. INPUT_TRUNCATED appears once when your input is longer than this actor accepts.

Related actors from steadydata

• email-deliverability-report: the deep mail check: SPF lookups, DKIM, MTA-STS
• website-tech-stack: what the site runs on
• technical-seo-audit: the SEO health of its pages
• Used together with email-deliverability-report in a recipe: Check a list of domains for DNS, SPF and SSL problems.

Pricing

Pay per event: one domain-reported event per delivered report. Invalid input is never charged. An unregistered domain is a complete answer and is charged like any other row. No start fee.

Free Apify plan: this actor delivers up to 25 rows per run for accounts on the Apify free plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full size, billed per delivered row, with failed rows never charged.

Reviews: if this actor saves you time, a short review on this page is the one thing that helps most. Ratings are what other buyers look at first, and we have no other way to ask.

FAQ

Which issues can it report? domain-expired, domain-expiring, no-nameservers, tls-expired, tls-expiring, tls-name-mismatch, no-address-record, no-tls, no-spf, no-dmarc, dmarc-policy-none, no-mx, no-dnssec and not-registered.

Why is SPF or DMARC not reported as missing on some domains? Because the domain has no MX record at all, so it does not receive mail and nagging about mail authentication would be noise. no-mx is reported instead.

Why would p=none matter? A DMARC policy of none only monitors: mail that fails the check is still delivered, so anyone can send mail in that domain's name. Moving to quarantine or reject is the point of having DMARC at all.

What does no-tls mean? The domain resolves, but nothing answered a TLS handshake on port 443 within six seconds. Usually that means the name is registered and pointed somewhere without a web server.

How fast is it? About one second per domain when everything answers, a few seconds when a certificate cannot be reached.

Is personal data collected? No. Registrant data is redacted by the registries and never requested here. The registrar is a company.

Can I call it from my own code, like an API? Yes. Every run is available through the Apify API: start it with one HTTP request, then read the results as JSON, CSV or Excel from the dataset endpoint, or use the official Python and JavaScript clients. The input is the same JSON as in the input example above, so a scheduled script, a Make or Zapier step or an AI agent can call it without any changes.