How to check DNS, SSL and domain health in bulk

The short answer

For one domain, use a command line tool or one of the many free web checkers. For a list of domains, and especially for a list you plan to check again next month, you want one call that returns one row per domain with every check already done.

What people usually stitch together

A full picture of a domain is not one lookup, it is roughly eight: the registration and expiry date, the nameservers, the A and MX records, the SPF and DMARC policy, the TLS certificate with its issuer and expiry, and whether the site actually answers. Each of those has a free tool. None of those tools talks to the others.

dig and openssl. Free, precise, installed already. Perfect for one domain and miserable for five hundred, because you end up writing the very parsing layer you were trying to avoid.

Free web checkers. Excellent for a single domain and a human reader. They rate limit hard, they have no API worth the name, and copying results into a sheet is the sort of work that quietly eats an afternoon.

Registry data. Registration details now come from RDAP, the structured successor to WHOIS. It is official, free and machine readable, which is why it is the right source. It is also per-registry, so the shape of the answer varies and you need to normalise it before it is a column in your table.

The mistake that produces a wrong table

Checking SPF by fetching one TXT record. SPF resolves: an include points at another domain whose record points at another, and the specification caps the chain at ten DNS lookups. Plenty of real domains are over that limit, which means their SPF silently fails for some receivers. You cannot see that from the raw record, only by resolving the chain and counting. A deliverability table built on the raw record looks complete and is not.

The second one is the certificate. A certificate that is valid today but expires in nine days is the thing you actually wanted to know, and a boolean valid or invalid column hides exactly that.

What a useful row contains

• Registration and expiry from the registry, not from a guess.
• Nameservers and mail provider, so you can group a portfolio by who runs what.
• SPF and DMARC policy as text plus a verdict, including the lookup count.
• The TLS certificate issuer and the days remaining, not just valid or not.
• A ranked list of problems, so the row is sortable by how bad it is.

What we charge for it

One health report per domain, billed per domain reported at $20.00 per 1,000, which is two cents a domain. That covers all of the above in one row, up to 500 domains per run. Domains that fail to resolve come back as an error record and are not charged.

Two cents sounds like a lot next to a free dig command until you count what you are actually buying: eight lookups, the SPF chain resolved, the certificate parsed, and a normalised row you can put straight into a sheet. For a portfolio of 300 domains checked monthly that is six dollars a month, against an afternoon of your own time.