Domain & Email Infrastructure Analyzer

Bulk DNS, SPF, direct DMARC, supplied DKIM, RDAP and TLS evidence. Designed for operations teams and developers combining customer-supplied data with Apify workflows. Processing uses local rules and standard protocols, with no required paid API or browser.

Use cases

• Audit a domain portfolio
• Investigate email configuration
• Prepare MSP monitoring baselines

Features and input

Inline records, an Apify Dataset ID, CSV/TSV/JSON arrays/JSONL, uploaded KVS files, and public HTTPS files. Choose exactly one source. File format is inferred from the extension when omitted; UTF8 BOM is supported, UTF16/Latin1 require explicit encoding. Files stream or parse in bounded passes; datasets page500 items. At most1,000 fresh domain analyses per run. Set maxRecords (default10,000, hard100,000), maxFileBytes (default25MB, hard100MB). Exceeding a limit fails with retained partial results.

Focused defaults and optional controls are described in the Console input form. The Console and automatic-test input prefills example.com and bücher.de with optional RDAP/TLS disabled. An explicit empty API input still produces a successful empty run; supplying another source does not inject sample domains. CLI-only localFile accepts a file path; it is blocked in cloud runs and deliberately omitted from the public schema. File uploads use keyValueStoreId plus fileKey; request no more than one source.

{
  "domains": [
    "example.com",
    "bücher.de"
  ],
  "rdap": false,
  "tls": false
}

Outputs

Default Dataset has one result for every examined row, including invalid rows and duplicates. Each has schemaVersion, runId, processedAt, sourceRecordId (1-based input ordinal), valid and diagnostics. Diagnostics expose severity/code/field/message/suggestedFix/autoFixed/reference; raw values are intentionally omitted. Cleaner results contain cleaned and duplicate survivor linkage. Domain results contain protocol evidence and score reasons. SUMMARY in KVS reports totals, rule/field counts, duplicate counts, duration and fatalError. CLEANED contains valid first survivors only, as canonical JSONL or CSV (outputFields required). Invalid rows remain available for audit in the Dataset. PII output never contains original records.

Illustrative abbreviated output:

{
  "schemaVersion": "1",
  "runId": "local-example",
  "processedAt": "2026-10-04T00:00:00Z",
  "sourceRecordId": "1",
  "valid": true,
  "diagnostics": [],
  "normalizedDomain": "example.com",
  "dns": {
    "MX": {
      "records": [
        "0 ."
      ],
      "ttl": 23,
      "status": "OK",
      "attempts": 1
    }
  }
}

API and schedules

Call the Actor API using its ID; JSON body is the same input as Console. Replace placeholders and keep your token private:

curl -X POST "https://api.apify.com/v2/acts/NdXIEunchevh1tJet/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" -H "Content-Type: application/json" \
  --data-binary @example-input.json

Python SDK callers can use await Actor.call('vincesoft/domain-analyzer', run_input=input) from another Actor. Console tasks/schedules use the same saved input; retrieve the returned defaultDatasetId/defaultKeyValueStoreId. Upstream scrapers may supply a Dataset ID to this Actor; send cleaned exports to downstream analytics. Combine Domain Analyzer with Lead Cleaner, Product Cleaner with Feed Doctor, and PII Redactor before external AI workflows. No webhooks or email messages are sent by this code.

Local usage

From monorepo root: python -m pip install -e ".[dev]", set APIFY_LOCAL_STORAGE_DIR to a new absolute directory, put example input in key_value_stores/default/INPUT.json, then python -m hermes.runtime domain. This uses the real Apify SDK local lifecycle and storages. Local development requires the Hermes source repository. This Actor is available on Apify Store as vincesoft/domain-analyzer.

Pricing and performance

Pay per event: $2.00/1,000 domain analysis results plus $0.005 per run start. Each examined input row delivered to the Dataset is billable, including cached duplicates and invalid-input diagnostics. No free per-run allowance, per-file fee or paid integration. Platform usage is included. The minimum run spending limit is $0.007 (start plus one result). The Actor stops before further network work when the remaining budget cannot cover another result; SUMMARY reports chargedResults and chargeLimitReached. Remove duplicate input domains before running to reduce charges. Private cloud validation on October 5, 2026 covered DNS, optional RDAP/TLS, mixed input and billing limits. Costs and margin depend on batch size, network latency and output size. Startup, storage writes and protocol waits dominate small batches. Memory is fixed at512MB; hard caps protect the deployment; cleaned upload is bounded100MB and total scratch disk250MB. No claim of processing millions of rows. Runs are restart-from-input, without migration resume guarantees.

Privacy and security

Public downloads use HTTPS443, checked public IPv4/IPv6 and pinned connection addresses, revalidated redirects, identity encoding, bounded bytes/time and MIME allowlist. XML entities/DTD disabled; nesting, record length and concurrency capped. CSV exports escape formula-like cells. Logs contain counts and safe error codes only. Records stay in customer-controlled Apify storage; this project sends no analytics. Cleaner input/output may contain PII unless explicitly redacted. Hash action requires secret minimum16-character HMAC key; it produces pseudonyms, not guaranteed anonymization. Delete input and output storages under your retention policy. No universal compliance or safety certification.

Limitations

No mailbox existence, SMTP probing, reputation/safety claims, recursive SPF budget evaluation or DMARC inheritance. DKIM requires supplied selectors. Provider inference is heuristic. RDAP is exact-name, registry availability varies. Invalid TLS certificates return unknown/error rather than unverified metadata. No disposable/parked datasets bundled.

All Actors omit arbitrary regex rules, XLSX, paid integrations, automatic ambiguity repair and migration checkpointing. Records that fail validation continue in permissive mode; strict stops at first invalid row. Source corruption, unsafe URLs and resource limits always fail. Output timestamps vary across runs; deterministic cleaned fields and diagnostic rules do not.

Troubleshooting and FAQ

• Why did my run fail? Read KVS ERROR.code and SUMMARY.fatalError. Configuration failures can have only ERROR. Fix source format/limits rather than retrying blindly.
• Why are rows missing from CLEANED? Invalid and duplicate rows are retained in the Dataset but excluded from export. Check diagnostics and survivorSourceRecordId.
• Can this verify real-world facts? Only the documented static/protocol checks. It does not verify mailboxes, delivery addresses or Merchant Center approval.
• Can I process a private URL? No. Upload a file to Apify KVS or supply a Dataset instead.
• Can I merge duplicate values? No; first survivor wins. Review linked duplicate rows before manual merging.
• Can I monitor changes? Schedule runs in Apify; compare datasets in your own workflow. Built-in historical diff/alerts are future work.