Domain Intelligence: WHOIS/RDAP, DNS, SSL, Email & Tech

Analyze a list of domains in bulk and get one clean JSON record per domain: registration data (WHOIS/RDAP), DNS records, email security (SPF, DMARC, DKIM, MTA-STS), the TLS/SSL certificate, HTTP security headers and technology hints. Every module can be switched on or off, so you only wait for (and pay for) what you need.

Only free public sources are used: the official RDAP servers (the modern, JSON-based replacement for WHOIS), public DNS-over-HTTPS resolvers, a TLS handshake with the domain on port 443 and a single HTTP request to its home page. No API keys, no logins, no proxies, no scraping of search engines.

What you can do with it

• Security & IT: audit SPF/DMARC across hundreds of client or portfolio domains, find certificates about to expire, spot domains without HSTS/CSP.
• Sales & lead enrichment: see which CMS, e-commerce platform, CDN, analytics, chat widget and mail provider (Google Workspace, Microsoft 365...) a prospect uses.
• Domain investors & brand protection: registrar, creation date, expiry date and status codes for a watch list; detect unregistered names.
• SEO & agencies: redirect target, status code, title and meta description, server and hosting hints for a batch of sites.
• Due diligence: domain age, nameservers, DNSSEC and certificate details.

Input

Field	Type	Default	Description
domains	array of strings	required	Domains or URLs, e.g. example.com or https://www.apify.com/store. Protocol, path, port and credentials are removed, IDNs are converted to punycode, duplicates are dropped.
includeRdap	boolean	true	WHOIS/RDAP: registrar, dates, domain age, status, nameservers, DNSSEC
includeDns	boolean	true	A, AAAA, CNAME, NS, MX, TXT, CAA
includeEmailSecurity	boolean	true	SPF, DMARC, MTA-STS, TLS-RPT, mail provider, findings
checkDkim	boolean	false	Probe common DKIM selectors (adds a few DNS queries per domain)
dkimSelectors	array	built-in list	Your own DKIM selectors to probe
includeTls	boolean	true	TLS certificate: issuer, validity, SANs, protocol, key
includeHttp	boolean	true	Final URL, status, redirects, server, title, security headers
includeTech	boolean	true	Technology hints from headers, HTML, DNS and email provider
timeoutSecs	integer	10	Timeout for each network lookup (3-60)
maxConcurrency	integer	5	Domains analyzed in parallel (1-20)

Example inputs

1. Everything for a few domains (minimal)

{ "domains": ["example.com", "apify.com", "wikipedia.org"] }

2. Email-security audit only (fast and cheap)

{
  "domains": ["client1.com", "client2.io", "client3.org"],
  "includeRdap": false,
  "includeTls": false,
  "includeHttp": false,
  "includeTech": false,
  "includeDns": false,
  "includeEmailSecurity": true,
  "checkDkim": true,
  "dkimSelectors": ["default", "google", "selector1", "selector2", "mailchimp"]
}

3. Certificate and registration expiry watch

{
  "domains": ["mycompany.com", "https://shop.mycompany.com/cart"],
  "includeRdap": true,
  "includeTls": true,
  "includeDns": false,
  "includeEmailSecurity": false,
  "includeHttp": false,
  "includeTech": false
}

Schedule it daily or weekly and filter on daysToExpiry and tls.daysRemaining to get expiry alerts through Apify integrations (Slack, email, webhooks, Google Sheets).

Output

One dataset item per domain. Fields appear only when the module is enabled. Example (shortened; the full record is in sample_output.json):

{
  "domain": "apify.com",
  "input": "apify.com",
  "status": "ok",
  "registered": true,
  "registrar": "Amazon Registrar, Inc.",
  "createdAt": "2009-06-02T17:14:10Z",
  "expiresAt": "2035-06-02T17:14:10Z",
  "daysToExpiry": 3141,
  "nameservers": ["ns-1225.awsdns-25.org", "..."],
  "dns": { "a": ["..."], "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }], "txt": ["..."], "nxdomain": false },
  "emailSecurity": {
    "spf": { "record": "v=spf1 ...", "policy": "softfail" },
    "dmarc": { "policy": "reject", "rua": ["mailto:..."] },
    "mailProvider": "Google Workspace",
    "findings": []
  },
  "tls": { "issuerOrganization": "Amazon", "validTo": "2027-01-16T23:59:59.000Z", "daysRemaining": 82, "sans": ["apify.com", "..."], "protocol": "TLSv1.3" },
  "http": { "finalUrl": "https://apify.com/", "statusCode": 200, "title": "...", "securityHeadersScore": 5 },
  "technologies": [{ "name": "Amazon CloudFront", "category": "CDN" }, { "name": "Next.js", "category": "JavaScript framework" }],
  "notes": [],
  "errors": {}
}

Field reference

Group	Fields
Core	domain (normalized, ASCII), input (as given), unicodeDomain (IDNs only), scrapedAt, status (ok, partial, failed)
Registration (top level)	registered, registeredDomain, registrar, createdAt, expiresAt, daysToExpiry, nameservers
rdap	registrarIanaId, updatedAt, domainAgeDays, status (EPP codes), dnssecSigned, rdapServer
dns	a, aaaa, cname, ns, mx (priority + exchange), txt, caa, nxdomain
emailSecurity	spf (record, policy, includes, lookupMechanisms, multipleRecords), dmarc (policy, subdomainPolicy, pct, rua, ruf, adkim, aspf), dkim (selectorsFound, wildcardRecord), mtaSts, tlsRpt, mailProvider, findings
tls	subjectCommonName, issuerOrganization, issuerCommonName, validFrom, validTo, daysRemaining, sans, protocol, cipher, authorized, authorizationError, serialNumber, fingerprint256, keyType, keyBits
http	requestedUrl, finalUrl, statusCode, redirects, httpsRedirect, server, poweredBy, contentType, title, metaDescription, securityHeaders (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), securityHeadersScore (0-6)
technologies	list of { name, category }
Diagnostics	notes (informational, e.g. "domain does not resolve"), errors (per-module error messages)

The dataset has ready-made views: Overview, Registration, Email security, TLS & HTTP and Technologies.

Error handling

Each module runs independently with its own timeout. If one fails (for example a site that blocks the HTTP request), the others still return data and the failure is listed in errors, with status: "partial". A domain that does not exist returns registered: false, dns.nxdomain: true and a note; TLS and HTTP are skipped for domains without an A/AAAA/CNAME record. If every enabled module fails (for example a network problem), the item is stored with status: "failed" and is not charged.

Pricing (pay per event)

The Actor uses pay-per-event pricing: a small platform start fee per run plus a charge per domain analyzed (domain-result). Failed domains are not charged and the run stops early if your maximum run cost is reached. See the pricing section on this page for the current price. Compute use is very low, 256 MB is enough.

FAQ

Is this legal / allowed? Yes for its intended use: it only reads data that registries, DNS servers and websites make publicly available (RDAP, DNS, a standard TLS handshake and one request to the home page). See the legal note below.

Why RDAP and not classic WHOIS? RDAP is the official, structured successor of WHOIS, free and JSON-based. Registrant personal data is usually redacted for privacy (GDPR), so this Actor does not return registrant names, emails or phone numbers.

A country-code domain returned errors.rdap. Some TLDs (for example .de and .io) do not publish an RDAP service in the IANA registry yet. Other modules still work and status is partial.

Does it work with subdomains? Yes. blog.example.com gets its own DNS, TLS and HTTP data, and RDAP falls back to the parent registered domain.

How accurate is technology detection? It is based on response headers, the HTML of the home page and DNS/email providers. It finds the common CMS, frameworks, CDN, analytics and chat tools but is not a complete fingerprint of a site's stack. Sites protected by bot-blocking may return limited data.

What does DKIM probing do? DKIM selectors are not listed in DNS, so the Actor queries <selector>._domainkey.<domain> for a list of common selectors (or yours). A selector that is not found does not mean DKIM is absent. If the domain has a wildcard DKIM record, probing is skipped and wildcardRecord is true.

Do I need proxies? No. DNS goes through public DNS-over-HTTPS (Cloudflare, then Google) with the system resolver as fallback.

Why is TLS or HTTP skipped? When a domain has no A/AAAA/CNAME record there is nothing to connect to, so those checks are skipped and a note explains it.

Can I export to CSV, Excel or Google Sheets? Yes. Download JSON, CSV, Excel, XML or HTML, or use Apify integrations (Slack, email, webhooks, Google Sheets).

How many domains can I run at once? Thousands per run. Keep maxConcurrency at 5-10 for very large lists to stay polite to public RDAP servers; the Actor retries once on HTTP 429.

Legal note

This Actor only uses publicly available information from RDAP registry servers, public DNS resolvers and the domain's own public web server (a TLS handshake and a request to the home page, like any browser). It does not log in, bypass access controls, collect registrant personal data or scan ports. Use it responsibly and only for lawful purposes, comply with applicable laws (including data protection rules) and with the terms of the services you query. This Actor is independent and not affiliated with or endorsed by any registry, registrar, DNS provider or technology vendor named in its output.

Notes

• Only public, no-authentication sources are used.
• Home page body reads are capped at 300 KB.
• Results reflect the moment of the run; DNS answers from public resolvers may be cached for their TTL.