Monitor domain expiry and registration changes with RDAP Domain & Expiry Monitor

Check a domain portfolio for expiration dates, registrar changes, transfer locks, nameservers and DNSSEC registration state. RDAP Domain & Expiry Monitor queries official public registry RDAP services discovered through the IANA bootstrap. Domain portfolio managers, DevOps and SRE teams, brand protection teams and MSPs can export consistent rows or schedule change alerts without collecting personal contact data.

Domain registration and expiry data you can get

Fields	Meaning
domain, unicodeDomain, tld	Normalized ASCII domain, Unicode display name and TLD
rdapServer, sourceUrl, attribution	Registry bootstrap base, exact response URL and source credit
lookupStatus, handle	Registered or optional not-found result, published registry handle
registrarName, registrarIanaId	Public registrar business identity only
registeredAt, expiresAt, lastChangedAt	Published registration, registry expiry and change timestamps
daysUntilExpiry	Whole days remaining, rounded down; negative after expiry
statusCodes, nameservers	Sorted RDAP statuses and lowercase nameserver hostnames
dnssecSigned, dnssecDsRecords	Published delegation signature state and DS key tags, algorithms and digest types
signals, changes, checkedAt	Alert flags, monitored field changes and UTC observation time

Missing values are null or empty arrays. Registrant, administrative, technical, billing and abuse contacts are excluded. Notices, remarks, phone numbers, emails, addresses and full DS digests are omitted.

How to use the domain expiry monitor

1. Enter domain names or website URLs in domains.
2. Set an expiry threshold and maximum result count.
3. Run the Actor and review the dataset table or export JSON, CSV or spreadsheet data.
4. Open RUN_SUMMARY for blocked, unsupported, rate-limited or unavailable targets.
5. Enable monitorMode and schedule future runs with the same monitorKey for change alerts.

{
  "domains": ["openai.com", "cloudflare.com", "iana.org"],
  "expiringWithinDays": 30,
  "onlyFlagged": false,
  "includeNotFound": false,
  "maxResults": 25,
  "monitorMode": false,
  "monitorKey": "default",
  "requestDelayMs": 750
}

Empty API input uses these three domains and a default maxResults of 100. The editor prefill uses 25. Domain URLs and subdomains normalize to the registrable domain using the public suffix list, so a hostname under example.co.uk becomes example.co.uk. Unknown suffixes retain the exact hostname. Duplicate normalized domains are queried once. Credentials, IP literals and malformed domains are rejected or recorded as invalid individual targets.

Sample domain registration output

Real local snapshot on 2026-10-25, shortened to useful columns:

Domain	Registrar	Registry expiry UTC	DNSSEC signed
openai.com	MarkMonitor Inc.	2029-01-19 19:28:24	false
cloudflare.com	Cloudflare, Inc.	2033-02-17 22:07:54	true
iana.org	CSC Corporate Domains, Inc.	2027-12-08 17:00:53	true

A shortened row:

{
  "domain": "iana.org",
  "unicodeDomain": "iana.org",
  "tld": "org",
  "lookupStatus": "registered",
  "registrarName": "CSC Corporate Domains, Inc.",
  "registrarIanaId": "299",
  "expiresAt": "2027-12-08T17:00:53.000Z",
  "daysUntilExpiry": 408,
  "statusCodes": [
    "server delete prohibited",
    "server transfer prohibited",
    "server update prohibited"
  ],
  "dnssecSigned": true,
  "dnssecDsRecords": [{ "keyTag": 2234, "algorithm": 13, "digestType": 2 }],
  "signals": [],
  "changes": []
}

Expiration, transfer lock and DNSSEC alerts

expiring_soon means 0 <= daysUntilExpiry <= expiringWithinDays. expired means the published registry expiry timestamp is in the past. transfer_unlocked means neither client nor server transfer-prohibited status was published. It does not establish transfer eligibility. dnssec_unsigned is emitted only for an explicit false signature state; unknown DNSSEC state stays null.

Other flags are client_hold, server_hold, pending_delete and redemption_period. Both spaced RDAP status strings and equivalent EPP camelCase forms are recognized. onlyFlagged requires at least one flag, so unsigned domains may qualify even when their expiry date is far away.

Incremental runs and portfolio monitoring

The first successful observation of a domain emits changes: ["initial"]. Later runs emit only when expiry, registrar name or ID, status codes, nameservers, DNSSEC state or DS metadata, lookup status, or signals change. A domain newly entering the expiry threshold is emitted because its signals change. A daily countdown alone does not create another row. Snapshot mode always uses changes: [].

Baselines persist in the named rdap-domain-monitor-state store. Use the same monitorKey and threshold for the same watch. Changing either starts a separate baseline. Failed lookups and filtered-out rows do not overwrite the last delivered baseline. Not-found observations participate only with includeNotFound: true.

Run one schedule at a time per watch. Delivery reservations reduce duplicate billing from overlapping runs, but there is no transaction across the dataset, charging, queue and state. A process crash between reservation and delivery can leave a transition reserved. Use a new monitor key to recover that watch. Large portfolios may need separate runs because each run collects for at most 45 seconds. Domains are processed in input order, so rotate or partition portfolios when the time budget prevents full coverage.

Pricing

Price: about US$1.50 per 1,000 emitted domain results, plus the Actor start event. The Store page shows the final price.

One emitted dataset row is one domain event. Only registered domains are emitted by default. With includeNotFound: true, emitted 404 observations are also billed. Unchanged observations in monitor mode, filtered rows, duplicates, unsupported TLDs and upstream errors are not billed. The Actor respects maxResults and stops gracefully when the event spending allowance is reached. This Actor is intended for pay-per-event pricing without additional platform usage charges.

Scheduling and integrations

Use Apify schedules for recurring checks, webhooks for run completion and the Apify API for exports. Connect datasets to Make, Zapier or n8n, or let AI agents access them through MCP. A completed run can have zero rows, so integrations should inspect RUN_SUMMARY as well as the dataset.

Is it legal?

The Actor uses official public HTTPS endpoints without login, cookies, browser automation or proxies. It checks robots rules, limits requests and respects retry instructions. Registry terms still apply and may restrict automated or high-volume access and redistribution. Public access is not permission for unrestricted reuse. Use it for a legitimate portfolio-management purpose and review the terms applicable to your domains. This is not legal advice; users are responsible for their use of the data.

Limitations

• Some TLDs have no HTTPS IANA bootstrap entry. A built-in common-TLD fallback is used only when IANA is unreachable; fallback coverage is best effort.
• Robots denial, 429, 5xx, redirects or HTML on HTTP 200 prevents lookup. Other 4xx responses mean no policy under RFC 9309. Verisign returns HTTP 400 for robots; all three default domains succeeded in local verification.
• Registry expiration can differ from a registrar's customer renewal deadline. Auto-renew and redemption periods affect interpretation. Verify critical renewals with your registrar.
• DNSSEC metadata does not prove that the live DNS chain validates. Nameservers are registry records, not live DNS checks.
• A 404 is not proof that a domain is available to buy. Reserved, premium and restricted names can return incomplete information.
• The bootstrap is cached for 24 hours. Requests have a 10-second timeout and at most one retry with a wait capped at 10 seconds, subject to the run's overall time budget. There is no RDAP search or pagination.

FAQ

Does this replace WHOIS contact lookup? No. It deliberately omits personal contact records and uses RDAP only.

Why is a domain missing from my dataset? Check RUN_SUMMARY. It may be unchanged, filtered, unsupported, blocked, rate-limited or unavailable, or the run may have reached its result or time limit.

Does an all-upstream-failure run fail? No. It finishes successfully with zero rows and summary status upstream_unavailable. Invalid overall input and dataset or persistent-state errors fail the run.

Can I monitor internationalized domains? Yes. ASCII punycode is queried and a Unicode display form is returned.

Can I reset monitoring? Use a new monitorKey. Deleting the persistent stores also removes saved baselines and reservations.

Support

Use the Issues tab on this Actor's Apify Store page. Include the run ID and a short description of the affected domain or input setting.

Apify, OpenAI, Cloudflare, IANA, ICANN, Verisign, Public Interest Registry, CSC Corporate Domains, MarkMonitor, Make, Zapier and n8n are trademarks or names of their respective owners. This Actor is not affiliated with, endorsed or sponsored by those organizations. Other registry and registrar names remain the property of their owners.