Domain, DNS and SSL Report (bulk health check)

One health report per domain, up to 500 domains per run: registration and expiry from the registry's own RDAP service, DNS records with the mail and nameserver provider named, SPF and the DMARC policy, the TLS certificate with days remaining, and a ranked list of issues per domain. Everything comes from official public protocols, so there is nothing to scrape and nothing to block.

Why this scraper

• It tells you what is wrong, not just what is there. A domain expiring in nine days, a certificate that expired last week, a DMARC policy on p=none that blocks nothing, a certificate that does not cover the domain: each comes back as an issue with a severity (critical, warning, info), a sentence and the measured value, worst first.
• Four checks in one row. Registration, DNS, e-mail authentication and TLS, so a portfolio review is one run instead of four tools.
• Providers named, not just hostnames. mailProvider: Google Workspace, nameserverProvider: Cloudflare, derived from the actual MX and NS records. That is the column a sales or migration team filters on.
• Official protocols only. RDAP is the registries' own successor to WHOIS, DNS goes over DNS-over-HTTPS, and the certificate is read from a normal TLS handshake. No website is fetched, no robots.txt question arises, no proxy is needed, and there is nothing that can rate-limit you into an empty dataset.
• Registrant data is never requested. Registries redact the registrant's name and e-mail by default and this actor asks only for what is public. Only the registrar, a company, is reported.
• Availability included. A domain that is not registered comes back as a full row with isRegistered: false, which answers "is this name free" for a whole list.

Who this is for

IT and security teams watching a domain portfolio for expiries and missing e-mail authentication. Agencies auditing client domains before they inherit the problem. Sales teams qualifying a lead list by mail provider or hosting. Domain investors checking availability in bulk.

Who this is not for

Read this before you buy. Expiry dates depend on the registry: generic domains (.com, .net, .org and most new endings) publish them, and a number of country registries do not. .nl is one of those, so a Dutch domain comes back with a registration date, a status and nameservers but expiryDate: null. That is the registry's choice, not a gap in the data we asked for.

This actor also reports what the public record says, not who owns it: there is no registrant name, address, phone number or e-mail in the output, and there is no way to switch that on. If you need contact data, this is the wrong tool.

Input example

{
    "domains": ["apify.com", "nu.nl", "example-that-is-free.com"],
    "includeDns": true,
    "includeSsl": true,
    "expiryWarningDays": 30
}

A URL is accepted and reduced to its domain. Subdomains work for DNS and TLS; the registration data always comes from the registrable domain.

Output example

{
    "domain": "apify.com",
    "isRegistered": true,
    "issueCount": 0,
    "issues": [],
    "registrar": "Amazon Registrar, Inc.",
    "createdDate": "2015-09-09T12:01:02",
    "updatedDate": "2026-08-01T09:00:00",
    "expiryDate": "2035-06-02T17:14:10",
    "daysUntilExpiry": 3184,
    "domainStatuses": ["client transfer prohibited"],
    "nameservers": ["ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
    "nameserverProvider": "AWS Route 53",
    "hasDnssec": false,
    "aRecords": ["3.33.152.147"],
    "aaaaRecords": [],
    "mxRecords": ["1 aspmx.l.google.com.", "5 alt1.aspmx.l.google.com."],
    "mailProvider": "Google Workspace",
    "txtRecords": ["v=spf1 include:_spf.google.com ~all"],
    "hasSpf": true,
    "spfRecord": "v=spf1 include:_spf.google.com ~all",
    "hasDmarc": true,
    "dmarcPolicy": "reject",
    "dmarcRecord": "v=DMARC1; p=reject; rua=mailto:...",
    "sslIssuer": "Amazon",
    "sslValidFrom": "2026-05-13",
    "sslValidTo": "2027-01-16",
    "sslDaysRemaining": 125,
    "sslCoversDomain": true,
    "sslNameCount": 4,
    "tlsVersion": "TLSv1.2",
    "status": "ok"
}

A domain with problems, shortened to its issues:

{
    "domain": "example.nl",
    "issueCount": 3,
    "issues": [
        {"code": "tls-expiring", "severity": "critical", "message": "The TLS certificate expires in 6 days", "value": 6},
        {"code": "no-dmarc", "severity": "warning", "message": "No DMARC record, so spoofed mail is not rejected or reported", "value": null},
        {"code": "no-dnssec", "severity": "info", "message": "DNSSEC is not enabled for this domain", "value": null}
    ]
}

Error codes: INVALID_DOMAIN, LOOKUP_FAILED. INPUT_TRUNCATED appears once when your input is longer than this actor accepts.

Related actors from steadydata

• email-deliverability-report: the deep mail check: SPF lookups, DKIM, MTA-STS
• website-tech-stack: what the site runs on
• technical-seo-audit: the SEO health of its pages

Pricing

Pay per event: one domain-reported event per delivered report. Invalid input is never charged. An unregistered domain is a complete answer and is charged like any other row. No start fee.

Free Apify plan: this actor delivers up to 25 rows per run for accounts on the Apify free plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full size, billed per delivered row, with failed rows never charged.

FAQ

Which issues can it report? domain-expired, domain-expiring, no-nameservers, tls-expired, tls-expiring, tls-name-mismatch, no-address-record, no-tls, no-spf, no-dmarc, dmarc-policy-none, no-mx, no-dnssec and not-registered.

Why is SPF or DMARC not reported as missing on some domains? Because the domain has no MX record at all, so it does not receive mail and nagging about mail authentication would be noise. no-mx is reported instead.

Why would p=none matter? A DMARC policy of none only monitors: mail that fails the check is still delivered, so anyone can send mail in that domain's name. Moving to quarantine or reject is the point of having DMARC at all.

What does no-tls mean? The domain resolves, but nothing answered a TLS handshake on port 443 within six seconds. Usually that means the name is registered and pointed somewhere without a web server.

How fast is it? About one second per domain when everything answers, a few seconds when a certificate cannot be reached.

Is personal data collected? No. Registrant data is redacted by the registries and never requested here. The registrar is a company.