# Domain, DNS and SSL Report (bulk health check) (`steadydata/domain-dns-ssl-report`) Actor

One health report per domain, up to 500 per run: registration and expiry from the official RDAP registry, DNS records with mail and nameserver provider, SPF and DMARC policy, the TLS certificate with days remaining, and a ranked list of issues. Official protocols only.

- **URL**: https://apify.com/steadydata/domain-dns-ssl-report.md
- **Developed by:** [Steadydata Team](https://apify.com/steadydata) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $14.00 / 1,000 domain reporteds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Domain, DNS and SSL Report (bulk health check)

One health report per domain, **up to 500 domains per run**: registration and expiry from
the registry's own RDAP service, DNS records with the mail and nameserver provider named,
SPF and the DMARC policy, the TLS certificate with days remaining, and **a ranked list of
issues per domain**. Everything comes from official public protocols, so there is nothing
to scrape and nothing to block.

### Why this scraper

- **It tells you what is wrong, not just what is there.** A domain expiring in nine days,
  a certificate that expired last week, a DMARC policy on `p=none` that blocks nothing, a
  certificate that does not cover the domain: each comes back as an issue with a severity
  (critical, warning, info), a sentence and the measured value, worst first.
- **Four checks in one row.** Registration, DNS, e-mail authentication and TLS, so a
  portfolio review is one run instead of four tools.
- **Providers named, not just hostnames.** `mailProvider: Google Workspace`,
  `nameserverProvider: Cloudflare`, derived from the actual MX and NS records. That is the
  column a sales or migration team filters on.
- **Official protocols only.** RDAP is the registries' own successor to WHOIS, DNS goes
  over DNS-over-HTTPS, and the certificate is read from a normal TLS handshake. No
  website is fetched, no robots.txt question arises, no proxy is needed, and there is
  nothing that can rate-limit you into an empty dataset.
- **Registrant data is never requested.** Registries redact the registrant's name and
  e-mail by default and this actor asks only for what is public. Only the registrar, a
  company, is reported.
- **Availability included.** A domain that is not registered comes back as a full row
  with `isRegistered: false`, which answers "is this name free" for a whole list.

### Who this is for

IT and security teams watching a domain portfolio for expiries and missing e-mail
authentication. Agencies auditing client domains before they inherit the problem.
Sales teams qualifying a lead list by mail provider or hosting. Domain investors checking
availability in bulk.

### Who this is not for

**Read this before you buy.** Expiry dates depend on the registry: generic domains
(.com, .net, .org and most new endings) publish them, and a number of country registries
do not. `.nl` is one of those, so a Dutch domain comes back with a registration date, a
status and nameservers but `expiryDate: null`. That is the registry's choice, not a gap in
the data we asked for.

This actor also reports what the public record says, not who owns it: there is no
registrant name, address, phone number or e-mail in the output, and there is no way to
switch that on. If you need contact data, this is the wrong tool.

### Input example

```json
{
    "domains": ["apify.com", "nu.nl", "example-that-is-free.com"],
    "includeDns": true,
    "includeSsl": true,
    "expiryWarningDays": 30
}
```

A URL is accepted and reduced to its domain. Subdomains work for DNS and TLS; the
registration data always comes from the registrable domain.

### Output example

```json
{
    "domain": "apify.com",
    "isRegistered": true,
    "issueCount": 0,
    "issues": [],
    "registrar": "Amazon Registrar, Inc.",
    "createdDate": "2015-09-09T12:01:02",
    "updatedDate": "2026-08-01T09:00:00",
    "expiryDate": "2035-06-02T17:14:10",
    "daysUntilExpiry": 3184,
    "domainStatuses": ["client transfer prohibited"],
    "nameservers": ["ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
    "nameserverProvider": "AWS Route 53",
    "hasDnssec": false,
    "aRecords": ["3.33.152.147"],
    "aaaaRecords": [],
    "mxRecords": ["1 aspmx.l.google.com.", "5 alt1.aspmx.l.google.com."],
    "mailProvider": "Google Workspace",
    "txtRecords": ["v=spf1 include:_spf.google.com ~all"],
    "hasSpf": true,
    "spfRecord": "v=spf1 include:_spf.google.com ~all",
    "hasDmarc": true,
    "dmarcPolicy": "reject",
    "dmarcRecord": "v=DMARC1; p=reject; rua=mailto:...",
    "sslIssuer": "Amazon",
    "sslValidFrom": "2026-05-13",
    "sslValidTo": "2027-01-16",
    "sslDaysRemaining": 125,
    "sslCoversDomain": true,
    "sslNameCount": 4,
    "tlsVersion": "TLSv1.2",
    "status": "ok"
}
```

A domain with problems, shortened to its issues:

```json
{
    "domain": "example.nl",
    "issueCount": 3,
    "issues": [
        {"code": "tls-expiring", "severity": "critical", "message": "The TLS certificate expires in 6 days", "value": 6},
        {"code": "no-dmarc", "severity": "warning", "message": "No DMARC record, so spoofed mail is not rejected or reported", "value": null},
        {"code": "no-dnssec", "severity": "info", "message": "DNSSEC is not enabled for this domain", "value": null}
    ]
}
```

Error codes: `INVALID_DOMAIN`, `LOOKUP_FAILED`. `INPUT_TRUNCATED` appears once when your input is longer than this actor accepts.

### Related actors from steadydata

- [email-deliverability-report](https://apify.com/steadydata/email-deliverability-report): the deep mail check: SPF lookups, DKIM, MTA-STS
- [website-tech-stack](https://apify.com/steadydata/website-tech-stack): what the site runs on
- [technical-seo-audit](https://apify.com/steadydata/technical-seo-audit): the SEO health of its pages

### Pricing

Pay per event: one `domain-reported` event per delivered report. Invalid input is never
charged. An unregistered domain is a complete answer and is charged like any other row.
No start fee.

**Free Apify plan:** this actor delivers up to 25 rows per run for accounts on the Apify free
plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the
actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full
size, billed per delivered row, with failed rows never charged.

**Reviews:** if this actor saves you time, a short review on this page is the one thing that
helps most. Ratings are what other buyers look at first, and we have no other way to ask.

### FAQ

**Which issues can it report?**
`domain-expired`, `domain-expiring`, `no-nameservers`, `tls-expired`, `tls-expiring`,
`tls-name-mismatch`, `no-address-record`, `no-tls`, `no-spf`, `no-dmarc`,
`dmarc-policy-none`, `no-mx`, `no-dnssec` and `not-registered`.

**Why is SPF or DMARC not reported as missing on some domains?**
Because the domain has no MX record at all, so it does not receive mail and nagging about
mail authentication would be noise. `no-mx` is reported instead.

**Why would `p=none` matter?**
A DMARC policy of `none` only monitors: mail that fails the check is still delivered, so
anyone can send mail in that domain's name. Moving to `quarantine` or `reject` is the
point of having DMARC at all.

**What does `no-tls` mean?**
The domain resolves, but nothing answered a TLS handshake on port 443 within six seconds.
Usually that means the name is registered and pointed somewhere without a web server.

**How fast is it?**
About one second per domain when everything answers, a few seconds when a certificate
cannot be reached.

**Is personal data collected?**
No. Registrant data is redacted by the registries and never requested here. The registrar
is a company.

# Changelog

This Actor's version history is a separate document: https://apify.com/steadydata/domain-dns-ssl-report/changelog.md

# Actor input Schema

## `domains` (type: `array`):

Domains, one per row, up to 500 (example: apify.com). A URL is accepted and reduced to its domain. Subdomains work for DNS and TLS; registration data always comes from the registrable domain.

## `includeDns` (type: `boolean`):

Look up A, AAAA, MX, NS and TXT records over DNS-over-HTTPS, plus the SPF and DMARC policy.

## `includeSsl` (type: `boolean`):

Open a TLS connection on port 443 and read the certificate: issuer, validity, days remaining and whether it covers the domain.

## `expiryWarningDays` (type: `integer`):

A domain or certificate expiring within this many days is reported as an issue.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "nu.nl"
  ],
  "includeDns": true,
  "includeSsl": true,
  "expiryWarningDays": 30
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "nu.nl"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("steadydata/domain-dns-ssl-report").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "nu.nl",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("steadydata/domain-dns-ssl-report").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "nu.nl"
  ]
}' |
apify call steadydata/domain-dns-ssl-report --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,steadydata/domain-dns-ssl-report"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/eXoU1Y83OmVt13tJo/builds/wsgggDHgg143avOrb/openapi.json