Bulk WHOIS & DNS Lookup: RDAP, SSL, SPF/DMARC and tech detection

Bulk WHOIS/RDAP, DNS, SSL certificate and tech lookup for lists of domains, from open protocols only: no paid APIs, no keys, no proxies. No login, no API key.

What does Bulk WHOIS & DNS Lookup do?

• RDAP/WHOIS: registrar, creation, expiry and update dates, status, nameservers, DNSSEC.
• DNS: A, AAAA, MX, NS, TXT, SOA, CAA plus SPF, DMARC policy and DKIM selectors you list.
• TLS certificate: issuer, subject, SANs, validity and daysToExpiry.
• HTTP: final URL, redirects, server, HSTS, page title and detected tech (Shopify, WordPress, Cloudflare...).
• Choose which sections to run with checks; accepts URLs and removes duplicates.

Why use it

• Four lookups in one item per domain, so one billing event covers all checks.
• Fail-soft: a failed section is null and explained in errors; the rest is still returned.
• Privacy-friendly: registrant personal data is never collected.
• Low price: $4 per 1,000 domains.
• No API keys or proxy.

Use cases

• Domain and SSL expiry monitoring for a portfolio.
• Lead enrichment: which sites run Shopify, WordPress or Cloudflare.
• Email deliverability audits (SPF, DMARC, DKIM).
• Brand and competitor research, domain age checks.
• Due diligence on a list of vendor or acquisition domains.

How to use

1. Open the Actor on Apify and click Try for free (or call it through the API).
2. Paste domains or URLs and choose the checks (rdap, dns, tls, http).
3. Click Start, then download the dataset as JSON, CSV, Excel or HTML, or read it through the API.

Input example

{
  "domains": ["example.com", "https://www.github.com/", "stripe.io"],
  "checks": ["rdap", "dns", "tls", "http"],
  "dkimSelectors": ["default", "google", "selector1"],
  "concurrency": 5,
  "timeoutSecs": 10
}

URLs are accepted; the hostname is extracted and duplicates are removed.

Output example

{
  "domain": "shopify.com",
  "errors": {},
  "rdap": {"queried": "shopify.com", "registrar": "MarkMonitor Inc.", "registrarIanaId": "292",
           "createdAt": "2005-03-11T05:18:03Z", "expiresAt": "2027-03-11T05:18:03Z", "updatedAt": "2026-02-01T09:12:44Z",
           "status": ["client transfer prohibited"], "nameservers": ["gold.foundationdns.com"], "registrantOrg": null, "dnssec": false},
  "dns": {"exists": true,
          "records": {"A": ["23.227.38.33"], "MX": ["10 aspmx.l.google.com"], "NS": ["..."], "CAA": ["0 issue \"digicert.com\""], "SOA": ["..."]},
          "emailAuth": {"spf": "v=spf1 ...", "dmarc": "v=DMARC1; p=reject", "dmarcPolicy": "reject", "dkimSelectorsFound": ["google"]}},
  "tls": {"valid": true, "protocol": "TLSv1.3", "issuer": "Google Trust Services", "subject": "shopify.com",
          "sans": ["shopify.com", "*.shopify.com"], "notBefore": "2026-08-01T00:00:00+00:00",
          "notAfter": "2027-01-01T00:00:00+00:00", "daysToExpiry": 77},
  "http": {"finalUrl": "https://www.shopify.com/", "status": 200, "redirects": ["https://shopify.com/"], "server": "cloudflare",
           "hsts": "max-age=31536000", "title": "Shopify ...", "tech": ["Shopify", "Cloudflare"], "certVerified": true}
}

A section that failed is null and explained in errors (e.g. {"tls": "gaierror: ..."}), the rest of the item is still returned. A domain that is not registered returns rdap.registered=false and dns.exists=false.

Pricing

Pay per event, no subscription. You pay only for what is returned:

Event	Price per 1,000	1,000	10,000	100,000
domain	$4.00	$4.00	$40.00	$400.00

Example: 1,000 domains cost $4.00; 10,000 cost $40.00.

One domain costs the same whether you run one check or all four.

Platform usage (compute) is included in the event price; there is nothing else to pay for.

Integrations & API

Run it from code with the Apify API. Replace <APIFY_TOKEN> with your API token.

Python (pip install apify-client)

from apify_client import ApifyClient

client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("bachiembmt/domain-intel-whois-dns-ssl").call(run_input={"domains": ["example.com", "apify.com"], "checks": ["rdap", "dns", "tls", "http"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

cURL (run synchronously and get dataset items)

curl -X POST "https://api.apify.com/v2/acts/bachiembmt~domain-intel-whois-dns-ssl/run-sync-get-dataset-items?token=<APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com", "apify.com"], "checks": ["rdap", "dns", "tls", "http"]}'

Works with:

• Make and Zapier: use the Apify app/module to run this Actor and pass the dataset on.
• n8n: use the Apify node or an HTTP Request node with the API call above.
• Google Sheets: export the dataset as CSV, or use the Apify integration to append rows automatically.
• Webhooks: trigger your own endpoint when a run finishes; combine with Apify schedules for recurring jobs.
• AI agents: expose the Actor as a tool through the Apify MCP server.

FAQ

Do all TLDs have WHOIS/RDAP data? No. TLDs without RDAP (e.g. .io) fall back to plain WHOIS; some ccTLDs publish neither (e.g. .vn), in which case the rdap section errors but DNS, TLS and HTTP still work.

Can it find DKIM records? Only for the selectors you list; DKIM cannot be enumerated.

Does it need a proxy or API key? No.

Do I need an account or API key for the source? No. The Actor needs no login or source API key. You only need an Apify account to run it.

Is it legal to scrape this data? Uses public registry (RDAP/WHOIS), DNS-over-HTTPS and TLS data. Registrant names, emails and phones are not collected. Registries rate-limit lookups, so use moderate concurrency on large lists. This is general information, not legal advice.

Limitations

• Registrant personal data is never collected (names, emails, phones are ignored; GDPR-redacted anyway). Only registrar, dates, status, nameservers and registrant organisation when public.
• RDAP comes from the IANA bootstrap. TLDs without RDAP (e.g. .io) fall back to plain WHOIS (port 43) with best-effort parsing. Some ccTLDs publish neither (e.g. .vn): the rdap section errors, DNS/TLS/HTTP still work.
• RDAP uses the name as given, then strips subdomain labels down to two labels (no public-suffix list), so a.example.co.uk style names may resolve to co.uk.
• DKIM cannot be enumerated: only the selectors you list are probed.
• DNS goes through Cloudflare DNS-over-HTTPS (public resolver view, not authoritative).
• Tech detection is heuristic (headers, HTML markers, meta generator) and not exhaustive.
• Registries rate-limit RDAP/WHOIS; use moderate concurrency for large lists.