Bulk WHOIS, DNS & SSL Expiry Checker: Domain Health

Who it's for: IT admins, agencies managing client domains, email deliverability teams, domain investors and lead-enrichment workflows.

The problem it solves: Expired SSL certificates and domains take sites offline, and missing SPF/DMARC hurts email delivery. Checking WHOIS, DNS and SSL separately for many domains is tedious. This Actor checks all four in one run and lists the problems in plain language.

Use cases:

• Scheduled SSL and domain expiry monitoring (only pay for domains with issues)
• Agency and IT audits of a whole domain portfolio
• Email security: find domains missing SPF/DMARC or using p=none
• Lead enrichment: domain age, registrar and email provider

Quick example: {"domains":["example.com","mycompany.com"],"expiryWarnDays":21} → one row per domain: registrar, domainAgeDays, domainDaysUntilExpiry, hasSpf, hasDmarc, dmarcPolicy, sslValid, sslDaysUntilExpiry, httpsRedirect, plain-language issues.

Price: $3.00 per 1,000 domains with WHOIS, DNS, SSL and HTTP checks all included, lower on paid plans. Many Store tools cover only one of these checks per run.

Check hundreds of domains in one run and get a clear health report for each one:

• WHOIS / RDAP: registrar, creation date, domain age, expiry date and days left, status codes, nameservers, DNSSEC
• DNS: A, AAAA, MX, NS, TXT, CAA, plus SPF and DMARC (with the DMARC policy) for email deliverability and anti-spoofing
• SSL certificate: valid or invalid (expired, self-signed, wrong host…), issuer, expiry date and days left, TLS version, SAN coverage
• HTTP → HTTPS: redirect chain, final URL and status, HSTS, server header
• Plain-language issues: "SSL certificate expires in 12 days", "Has MX records but no DMARC record", "HTTP does not redirect to HTTPS"…

There's no browser and no proxies. It uses the official RDAP protocol (the modern, structured successor to WHOIS), DNS-over-HTTPS (Cloudflare, with Google as fallback) and direct TLS handshakes. A typical domain takes 1–3 seconds, and domains are checked in parallel.

Use cases

• Expiry monitoring: schedule a daily or weekly run with onlyWithIssues: true and get only the domains whose SSL certificate or registration is about to expire, or is broken. You only pay for those.
• Agency and IT audits: check a client's whole domain portfolio in one run.
• Email deliverability: find domains with missing SPF or DMARC, or p=none.
• Lead qualification and enrichment: domain age, registrar and email provider (from MX) for a list of company websites.
• Due diligence: domain age and history checks before buying or partnering.

Input

Field	Default	Description
domains	apify.com, crawlee.dev, example.com	Domains or URLs (www. and paths are ignored)
checks	all	whois, dns, ssl, http
expiryWarnDays	30	Domain or SSL expiry closer than this is reported as an issue
onlyWithIssues	false	Output and charge only for domains with issues (good for monitoring)
maxConcurrency	10	Domains checked in parallel

{ "domains": ["example.com", "https://www.mycompany.com/about", "shop.example.co.uk"], "expiryWarnDays": 21, "onlyWithIssues": true }

Output

This is a real item from a test run on 10 Oct 2026 (apify.com; a few long lists are shortened here):

{
  "domain": "apify.com",
  "inputValue": "apify.com",
  "checkedAt": "2026-10-10T17:37:23.163Z",
  "issueCount": 0,
  "issues": [],
  "registrar": "Amazon Registrar, Inc.",
  "domainCreatedAt": "2009-06-02T17:14:10Z",
  "domainAgeDays": 6339,
  "domainExpiresAt": "2035-06-02T17:14:10Z",
  "domainDaysUntilExpiry": 3156,
  "sslValid": true,
  "sslIssuer": "Amazon",
  "sslExpiresAt": "2027-01-16T23:59:59.000Z",
  "sslDaysUntilExpiry": 98,
  "hasSpf": true,
  "hasDmarc": true,
  "dmarcPolicy": "reject",
  "mxProvider": "aspmx.l.google.com",
  "httpsRedirect": null,
  "finalUrl": null,
  "finalStatus": null
}

The item also contains full detail objects, shown here for the same run:

"whois": {
  "source": "https://rdap.verisign.com/com/v1/",
  "registered": true,
  "domainName": "apify.com",
  "registrar": "Amazon Registrar, Inc.",
  "registrarIanaId": "468",
  "registrarAbuseEmail": "trustandsafety@support.aws.com",
  "createdAt": "2009-06-02T17:14:10Z",
  "updatedAt": "2026-05-16T16:53:04Z",
  "expiresAt": "2035-06-02T17:14:10Z",
  "domainAgeDays": 6339,
  "daysUntilExpiry": 3156,
  "status": [
    "client transfer prohibited"
  ],
  "nameservers": [
    "ns-1225.awsdns-25.org",
    "ns-1928.awsdns-49.co.uk",
    "ns-449.awsdns-56.com",
    "ns-839.awsdns-40.net"
  ],
  "dnssec": true
},
"ssl": {
  "host": "apify.com",
  "valid": true,
  "error": null,
  "protocol": "TLSv1.3",
  "subject": "*.apify.com",
  "issuer": "Amazon",
  "validFrom": "2026-07-03T00:00:00.000Z",
  "validTo": "2027-01-16T23:59:59.000Z",
  "daysUntilExpiry": 98,
  "sanCount": 4,
  "coversHost": true,
  "serialNumber": "033947021329345FC779537CD9A338FD"
},
"dns": {
  "a": [
    "143.204.1.39",
    "143.204.1.44",
    "143.204.1.110",
    "143.204.1.19"
  ],
  "aaaa": [
    "2600:9000:234d:2000:9:a03e:6540:93a1",
    "2600:9000:234d:5000:9:a03e:6540:93a1",
    "…"
  ],
  "mx": [
    {
      "priority": 1,
      "host": "aspmx.l.google.com"
    },
    {
      "priority": 5,
      "host": "alt1.aspmx.l.google.com"
    }
  ],
  "ns": [
    "ns-449.awsdns-56.com",
    "ns-839.awsdns-40.net",
    "ns-1225.awsdns-25.org",
    "ns-1928.awsdns-49.co.uk"
  ],
  "txtCount": 11,
  "spf": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
  "hasSpf": true,
  "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
  "hasDmarc": true,
  "dmarcPolicy": "reject",
  "caa": [
    "0 issue \"amazonaws.com\"",
    "0 issue \"digicert.com\""
  ],
  "resolves": true,
  "errors": []
}

These are real issues from the same run:

{ "domain": "expired.badssl.com", "issues": ["SSL problem: CERT_HAS_EXPIRED"], "sslDaysUntilExpiry": -4199 }
{ "domain": "apify.io", "issues": ["Has MX records but no DMARC record"] }

This is the real http object for apify.com from a cloud run on 10 Oct 2026:

"http": {
  "finalUrl": "https://apify.com/",
  "finalStatus": 200,
  "redirectCount": 1,
  "redirectChain": [
    {
      "url": "http://apify.com/",
      "status": 301
    },
    {
      "url": "https://apify.com/",
      "status": 200
    }
  ],
  "hsts": "max-age=15768000",
  "server": null,
  "responseTimeMs": 411,
  "error": null,
  "httpPortReachable": true,
  "httpsRedirect": true,
  "servesHttps": true
}

And these are real issues from the same cloud run:

{ "domain": "example.com", "issues": ["HTTP does not redirect to HTTPS"], "finalUrl": "http://example.com/" }
{ "domain": "expired.badssl.com", "issues": ["SSL problem: CERT_HAS_EXPIRED", "Website unreachable: CERT_HAS_EXPIRED"] }
{ "domain": "this-domain-surely-does-not-exist-9876.com", "issues": ["Domain appears unregistered", "Domain does not resolve (no A/AAAA records)", "Website unreachable: ENOTFOUND"] }

Pricing

Pay per result: from $3.00 per 1,000 domains ($0.003 per domain), all four checks included, lower on paid Apify plans:

Apify plan	Price per 1,000 domains
Free	$3.00
Starter (Bronze)	$2.60
Scale (Silver)	$2.20
Business (Gold) and above	$1.80

With onlyWithIssues, you only pay for domains that have issues, which makes daily monitoring of a large portfolio very cheap. Invalid inputs and unexpected errors are free. Set a maximum cost per run and the Actor stops cleanly when it reaches that limit.

Related Actors

More no-login, pay-per-result tools from the same developer:

• Sitemap URL Extractor: every URL from a website's sitemaps (indexes, gzip, RSS), with lastmod and priority.
• Bulk PageSpeed Insights & Lighthouse Audit: Lighthouse scores and Core Web Vitals for a list of URLs.
• Whole-Site PageSpeed Audit (Sitemap → Lighthouse): enter a homepage and get PageSpeed audits of its pages plus a site summary.
• SEO Meta Tags & Structured Data Auditor: titles, descriptions, canonical, noindex, Open Graph and Schema.org rich-result checks per URL.
• Wayback Machine Snapshot Finder: archived snapshots, first/last capture and every archived URL of a domain.
• ATS Jobs Scraper: open jobs from Greenhouse, Lever, Ashby, Workable, SmartRecruiters, Recruitee and Personio.

FAQ

Why is WHOIS empty for some domains (e.g. .io, .co, .de)? This Actor uses RDAP, the official structured replacement for WHOIS that ICANN requires for all generic TLDs (.com, .net, .org, .dev, .app, .xyz…) and that many country TLDs (.uk, .fr, .nl, .ai…) also support. Some country registries don't offer RDAP yet. For those, whois.error explains this, and DNS, SSL and HTTP checks still run.

Does it return owner or registrant details? No, on purpose. The output includes only non-personal registration facts (registrar, dates, status, nameservers). Registrant contact details are mostly redacted anyway, and leaving them out keeps the output free of personal data.

What counts as an SSL problem? Anything a browser would reject: expired, not yet valid, self-signed, untrusted chain, or a hostname mismatch. ssl.error shows the exact reason (for example CERT_HAS_EXPIRED).

Which host is checked for SSL? The host the website actually ends up on after redirects (for example www.example.com), falling back to the bare domain and then www..

Can I check subdomains? Yes. DNS, SSL and HTTP checks use the exact host, and WHOIS looks up the registrable domain automatically.

More tools from the same developer

• Sitemap URL Extractor: Get All URLs From Any Website: SEO specialists, agencies, developers and data/AI teams
• Bulk PageSpeed Insights Checker: Lighthouse & Core Web Vitals: SEO agencies, web developers, site owners and performance teams
• Whole-Site PageSpeed & Core Web Vitals Audit (via Sitemap): SEO consultants, agencies and site owners
• Greenhouse, Lever, Ashby & Workable Jobs Scraper (7 ATS): Job boards and aggregators, recruiters, sales teams prospecting on hiring signals, and market researchers