Domain & Email Security Check

One run, many domains, a clear security hygiene report for each. Built for IT service providers, agencies and companies preparing for NIS2, cyber insurance questionnaires or customer security audits.

What is checked

Email: SPF (syntax, multiple records, +all/?all/~all/-all, 10-lookup limit), DMARC (policy, reports), DKIM (common selectors), MTA-STS (mode), TLS-RPT, BIMI, MX and null MX

DNS: DNSSEC validation, CAA records, name servers

Web: HTTPS reachability, http to https redirect, TLS certificate issuer and days until expiry, negotiated TLS version, HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, server version disclosure, /.well-known/security.txt

Output

• score and grade (A to E), plus separate emailScore, webScore, dnsScore
• topIssues: the five most important fixes as plain sentences
• findings: every check with status pass, warn, fail or info
• facts: the raw records found

Pricing

$0.01 per checked domain.

FAQ

What am I charged for? One event per checked domain. A domain whose check fails comes back as an item with an error field and is not charged.

Where does the data come from? DNS records are read over DNS over HTTPS (Google, with Cloudflare as fallback). Web checks use normal HTTP requests and one TLS handshake on port 443. No port scanning, no intrusive tests.

My DKIM selector was not found. Why? Only about 40 common selectors are tried. Add your own selectors in the dkimSelectors input and they are checked as well.

Do I need a proxy or a login? No. There is no login and no proxy setting; only public data is used.

How many domains can one run handle? Up to maxDomains (default 2000, at most 50000), with up to 10 domains checked at the same time. Duplicates and invalid entries are removed first.

Notes

Only public DNS records, HTTP headers and the TLS handshake are used. No port scanning, no intrusive tests. DKIM can only be checked for common selectors; a custom selector may exist. NIS2 does not prescribe these exact controls; the checks reflect widely recommended baseline practices. Not legal advice.

Use with AI agents (MCP)

This Actor works as a tool for Claude, ChatGPT, Cursor and other MCP clients through the Apify MCP server. Add only this Actor:

https://mcp.apify.com?tools=webify-lab/domain-security-check

On first use the server signs you in with OAuth. Alternatively send the header Authorization: Bearer <APIFY_TOKEN>. Agents on the default Apify MCP setup can also find this Actor with search-actors and run it with call-actor. Pricing is the same as in Apify Console: you pay per result.