Domain Intelligence API – WHOIS/RDAP, DNS, SSL, SPF, DMARC in one row

Give it domain names, URLs or email addresses. Get one row per domain with everything a registry, a name server and a TLS handshake will tell you: who the registrar is, when the domain was created and when it expires, which name servers and mail provider it uses, whether SPF, DMARC and DKIM are set up properly, what certificate the site presents and how many days it has left, and whether the website answers.

No scraping, no browser, no proxies, no API keys. Every fact comes from the protocol that owns it: RDAP for registration (the successor of WHOIS), DNS for records, a direct TLS handshake for the certificate, one HTTPS request for the site.

Domain data per row

• Registration – registrar, registrarIanaId, createdAt, updatedAt, expiresAt, ageDays, expiresInDays, status (EPP codes such as client transfer prohibited), dnssec, nameservers, registrant and admin where the registry or registrar publishes them, abuseEmail
• DNS – dns.a, dns.aaaa, dns.mx, dns.ns, dns.cname, dns.soa, dns.caa; derived dnsProvider (Cloudflare, Route 53, GoDaddy, …) and mailProvider (Google Workspace, Microsoft 365, Zoho, Proton, …)
• Email security – email.spf (record, all qualifier, includes, lookup count, problems), email.dmarc (policy, pct, rua/ruf, problems), email.dkim (selectors found), mtaSts, bimi, receivesMail, spoofable, emailGrade A–F; flat dmarcPolicy and spfAll for filtering
• TLS – tls.issuer, validFrom, validTo, daysLeft, sans, wildcard, trusted, hostnameMatch, selfSigned, protocol; flat certIssuer, certDaysLeft
• Website – web.status, finalUrl, server, title; flat httpStatus
• flags – unregistered, new-domain, domain-expires-soon, domain-expired, on-hold, dnssec, no-spf, no-dmarc, dmarc-none, spoofable, no-mail, cert-expires-soon, cert-expired, cert-untrusted, cert-hostname-mismatch, no-tls, site-error, site-down, no-dns
• notes – anything that could not be checked, in plain words (no RDAP service for .de, tls: timeout)

Use cases

• Qualify a lead list: company age, real mail provider, whether the site is up.
• Audit a portfolio: certificates and domains that expire in the next 30 days.
• Security review: which domains can be spoofed because DMARC is missing or set to none.
• Enrich domains for an AI agent that needs registration and DNS facts as JSON.
• Check a list of domains for availability before buying.

Input

Field	Default	Meaning
domains	–	Domain names, URLs or email addresses, one per line. Different spellings of one domain are checked once and delivered once.
registration	true	RDAP registration facts.
dns	true	DNS records and providers.
emailSecurity	true	SPF, DMARC, DKIM, MTA-STS, BIMI.
tls	true	Certificate via TLS handshake on port 443.
web	true	One HTTPS request: status, final URL, title.
dkimSelectors	16 common	Selector names to try under _domainkey.
includeRaw	false	Attach the raw RDAP document and all TXT records.
timeoutSecs	20	Time budget per domain across all lookups.
concurrency	10	Domains checked in parallel.

Output example

{ "domain": "shopify.com", "ok": true, "registered": true,
  "registrar": "MarkMonitor Inc.", "createdAt": "2005-03-11T05:18:03Z", "expiresAt": "2027-03-11T05:18:03Z", "ageDays": 7861, "expiresInDays": 174,
  "status": ["client transfer prohibited", "server delete prohibited"], "dnssec": false, "nameservers": ["gold.foundationdns.com", "gold.foundationdns.net"],
  "dnsProvider": "Foundation DNS", "mailProvider": "Google Workspace",
  "dns": { "a": ["23.227.38.33"], "mx": [{ "host": "aspmx.l.google.com", "priority": 1 }], "ns": ["gold.foundationdns.com"], "caa": [] },
  "email": { "spf": { "present": true, "all": "~all", "includes": ["_spf.google.com", "sendgrid.net"], "lookups": 3, "problems": [] },
             "dmarc": { "present": true, "policy": "reject", "pct": 100, "rua": ["dmarc-aggregate@shopify.com"], "problems": [] },
             "dkim": { "found": ["google", "mail"] }, "receivesMail": true, "spoofable": false, "grade": "A" },
  "dmarcPolicy": "reject", "spfAll": "~all", "emailGrade": "A",
  "tls": { "ok": true, "issuer": "Google Trust Services", "validTo": "2026-11-08T19:37:54.000Z", "daysLeft": 51, "trusted": true, "hostnameMatch": true, "protocol": "TLSv1.3" },
  "certIssuer": "Google Trust Services", "certDaysLeft": 51,
  "web": { "ok": true, "status": 200, "finalUrl": "https://www.shopify.com/", "server": "cloudflare", "title": "Shopify: The All-in-One Commerce Platform" },
  "httpStatus": 200, "flags": [], "notes": [], "durationMs": 3187 }

How to use

1. Paste your domains, one per line. The example input is ready to run as is.
2. Click Start. Rows appear in the Output tab as they are found.
3. Filter on flags, expiresInDays, certDaysLeft, dmarcPolicy or mailProvider, then download as CSV, JSON or Excel.
4. For monitoring, create a Schedule with your portfolio and watch the domain-expires-soon and cert-expires-soon flags.

Pricing

Pay per event: domain $0.003 per domain that returned registration facts or DNS records. A 1,000-domain list costs $3. Domains that are not registered, do not resolve, or could not be reached are delivered with a plain reason and not charged.

Good to know

• Registrant details are usually redacted. Since 2018 most registries publish REDACTED FOR PRIVACY for names and emails. The registrar, dates, status and name servers are always there.
• Some registries have no RDAP service (.de, .io, .ch, .lk and others). Those rows still get DNS, email, TLS and website facts, and notes says no RDAP service for .de.
• Country-code second levels are handled: shop.example.co.uk is checked as example.co.uk; www.gov.uk is its own registered name.
• DKIM can only be confirmed for selectors that are tried. The default 16 cover Google, Microsoft, Amazon SES, Zoho, Mailchimp, SendGrid and Postmark; add your own in dkimSelectors.
• spoofable means the domain receives mail but has no enforcing DMARC policy (quarantine or reject).
• Errors are in plain words: not registered, timeout, rdap: rate limited (429), tls: ECONNREFUSED (connection refused).

Use from code or an AI agent

Every run can be started and read through the Apify API, the JavaScript and Python clients, or an AI agent with tool access. Open the API tab on this page for ready-made snippets. Pricing is per domain delivered, so an agent pays only for what it receives.

FAQ

Is this WHOIS? It is RDAP, the structured successor that registries now serve instead of WHOIS text. Same facts, machine-readable, with the registrar's own record fetched when it adds the registrant.

Why does a domain show registered: true but no registrar? Its registry has no RDAP service, so registration facts are not available; registered was concluded from DNS. notes says so.

Can I check availability for buying? Yes. Unregistered domains come back with registered: false and the unregistered flag, free of charge.

Which TLS certificate is read? The one the host presents on port 443 with SNI for the exact hostname you gave (www.example.com if that is what you pasted, otherwise the domain).

How is the email grade computed? One point each for a valid SPF without +all, a valid DMARC record, an enforcing DMARC policy, and at least one DKIM selector found. A = 4 points, F = 0.