Domain Intelligence: WHOIS/RDAP, DNS, SSL & Security Headers

One run, one row per domain, everything you normally collect from four different tools: registration data (registrar, creation/expiry dates, status codes, nameservers), DNS (A/AAAA/NS/MX/TXT/CAA with parsed SPF, DMARC and DKIM), HTTPS reachability with the full redirect chain and a security-header score, the TLS certificate (issuer, expiry, days left, SANs, chain verification) and an availability heuristic for unregistered names. Built for domain portfolio monitoring, lead enrichment, due diligence, security audits and expiring-domain hunting.

All data comes from public, official sources over plain HTTPS: RDAP (the successor of WHOIS, served by the registries themselves via the IANA bootstrap at rdap.org), DNS-over-HTTPS (Google DNS with Cloudflare fallback) and a direct request to the site. No login, no proxies, no third-party API keys.

What you get

group	fields
identity	domain, domain_ascii (punycode), valid, checked_at
registration (RDAP)	registered, registrar, registrar_iana_id, registrar_url, created, updated, expires, days_to_expiry, age_days, status[] (EPP codes such as client transfer prohibited), registrant, registrant_org, registrant_country (only where the registry publishes them), abuse_email, rdap_source
DNS	nameservers[], a[], aaaa[], ns[], mx[] (priority + host), mx_present, null_mx, txt[], caa[], dnssec, nxdomain
email auth	spf_present, spf_record, spf_all (-all/~all/…), dmarc_present, dmarc_policy (none/quarantine/reject), dmarc_record, dkim_present, dkim_selectors_found[] (active keys only)
SaaS hints	service_hints[] — providers revealed by verification TXT records and SPF includes (Google Workspace, Microsoft 365, SendGrid, HubSpot, Stripe, Shopify, Atlassian, Salesforce, Zendesk, Mailchimp, Amazon SES …)
HTTP	https_ok, http_status, final_url, redirect_chain[], redirects, http_to_https, server, powered_by, title, response_ms, security_headers{} (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, X-XSS-Protection), security_score (0–100), security_grade (A–F)
TLS	tls_ok, tls_verify (openssl chain result), tls_issuer, tls_subject, tls_not_before, tls_not_after, tls_days_left, tls_sans[], tls_san_count, tls_protocol
availability	available (true / false / null = unknown) + availability_note explaining the evidence
diagnostics	sections_failed[], error (only when both RDAP and DNS failed — such rows are not billed)

Availability heuristic

available: true only when the registry's RDAP server has no object for the name and DNS returns NXDOMAIN. If RDAP is not offered for the TLD (some ccTLDs) the field is null with a note. Always confirm at a registrar before relying on it.

Input

field	default	meaning
domains	—	domain names (URLs / emails accepted, host part is used, www. stripped, duplicates skipped)
includeRdap / includeDns / includeHttp / includeTls	true	switch sections off to speed up runs
dkimSelectors	15 common selectors	which <selector>._domainkey names to probe
concurrency	5	domains processed in parallel (1–10)
timeoutSecs	15	per request
maxItems	1000	cost cap

Example input:

{ "domains": ["github.com", "shopify.com", "example.com", "this-domain-should-not-exist-98765.com"] }

Example row (abridged):

{"domain":"github.com","registered":true,"registrar":"MarkMonitor Inc.","created":"2007-10-09T18:20:50Z","expires":"2026-10-09T18:20:50Z","days_to_expiry":42,
 "status":["client delete prohibited","client transfer prohibited","client update prohibited"],"nameservers":["dns1.p08.nsone.net","…"],
 "mx_present":true,"spf_all":"~all","dmarc_policy":"quarantine","dkim_selectors_found":["google","selector1","k1","s1"],
 "service_hints":["Atlassian","DocuSign","Google Workspace/Search Console","Microsoft 365","Salesforce","Stripe","Zendesk"],
 "https_ok":true,"final_url":"https://github.com/","server":"github.com","security_score":90,"security_grade":"A",
 "tls_ok":true,"tls_issuer":"Sectigo Limited — Sectigo Public Server Authentication CA DV E36","tls_days_left":34,"available":false}

Pricing

Pay per event: $0.002 per domain ($2 per 1,000). Charged only for rows successfully written to the dataset; rows whose RDAP and DNS lookups both failed are stored with an error and are free. A full four-section check takes 1–4 seconds per domain; 1,000 domains ≈ 5–8 minutes at 256 MB.

Limitations (honest list)

• RDAP coverage: all gTLDs (.com, .net, .org, .io, .app …) and most ccTLDs answer RDAP. A few ccTLDs (e.g. .de, .ch, .it) do not offer RDAP or return no registrant/date details; those rows have rdap_ok: false or partial registration data, and available becomes null when the domain is also NXDOMAIN. Registrant names are redacted by most registries since GDPR.
• Expiry date is missing for registries that do not publish it (e.g. .nl).
• DKIM can only be found for the selectors probed (defaults cover the major providers; add your own).
• Security score rates response headers of the final page only; it is not a penetration test.
• TLS is checked on port 443 only; no mail-server (SMTP) checks are performed.
• The site fetch is a plain GET without JavaScript; bot-protected sites may return 403 (recorded as such).

Not affiliated with ICANN, any registry or registrar; this actor reads public protocol data only.