Domain Health Check: SSL expiry, security headers, SPF and DMARC

Audit a list of domains in one run and get a grade (A–F) and a plain-language issue list per domain:

• TLS certificate: days until expiry, trusted or not (expired, self-signed, wrong host name), issuer, TLS version
• HTTPS: does http:// redirect to https://, final URL and status
• Security headers: HSTS, CSP / X-Frame-Options, X-Content-Type-Options, Referrer-Policy, exposed X-Powered-By
• Email authentication (DNS): MX, SPF (and its all mechanism), DMARC policy, CAA

Typical uses: agencies checking all client domains every morning · IT teams watching certificate expiry across dozens of domains · sales teams qualifying leads by email security · pre-launch checks.

Example (real run, 21.10.2026)

6 domains in one run: cloudflare.com A, github.com A, python.org A (90), example.com B (no HTTPS redirect, no HSTS), expired.badssl.com F (certificate expired 4,210 days ago), wrong.host.badssl.com F (certificate does not cover the host name).

{
 "domain": "python.org",
 "grade": "A",
 "score": 90,
 "issues": [
  "low: No X-Content-Type-Options: nosniff",
  "medium: DMARC policy is p=none (monitoring only)",
  "info: No CAA record (any CA may issue certificates)"
 ],
 "certValidTo": "2027-02-14T13:03:45.000Z",
 "certDaysLeft": 116,
 "certIssuer": "GlobalSign nv-sa",
 "certTrusted": true,
 "tlsProtocol": "TLSv1.3",
 "httpsRedirect": true,
 "hsts": "max-age=63072000; includeSubDomains; preload",
 "spfAll": "~",
 "dmarcPolicy": "none",
 "dmarcReporting": true,
 "mx": [
  "mail.python.org"
 ],
 "caa": [],
 "newIssues": [],
 "resolvedIssues": []
}

Monitoring mode

onlyWhenChanged: true reports a domain only when an issue appeared or was resolved since the last run (newIssues, resolvedIssues). Unchanged domains are not charged. reportMinSeverity: "high" reports only domains with high or critical issues (e.g. a certificate expiring within warnDaysBeforeExpiry, default 21 days).

Pricing

Pay per event: $0.004 per domain reported on the free plan, −10/−20/−30 % on higher Apify plans. Domains skipped by monitoring mode or the severity filter are never charged.

How it checks, and limits

• Sources are only the domain itself (one TLS handshake, the homepage headers) and public DNS. No third-party API, no login.
• robots.txt is honoured for the homepage request: if / is disallowed for all user agents, header checks are skipped (TLS and DNS still run) and the row says so.
• No personal data: DMARC report addresses are not output, only whether reporting is configured (dmarcReporting).
• The grade is a transparent sum of the listed issues (critical −40, high −15, medium −7, low −3); it is a checklist, not a penetration test. DKIM cannot be checked without knowing the selector.