# Bulk WHOIS & DNS Lookup - RDAP, SSL, SPF/DMARC, Tech (`bachiembmt/domain-intel-whois-dns-ssl`) Actor

Bulk WHOIS lookup and DNS lookup via RDAP: registrar, creation and expiry dates, nameservers, A/MX/TXT/SPF/DMARC/CAA records, SSL certificate expiry, redirects and detected tech. One item per domain. For domain monitoring, lead enrichment and email audits. No API key.

- **URL**: https://apify.com/bachiembmt/domain-intel-whois-dns-ssl.md
- **Developed by:** [Ha Phan Thanh Hai](https://apify.com/bachiembmt) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $4.00 / 1,000 domain analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk WHOIS & DNS Lookup: RDAP, SSL, SPF/DMARC and tech detection

**Bulk WHOIS/RDAP, DNS, SSL certificate and tech lookup** for lists of domains, from open protocols only: no paid APIs, no keys, no proxies. No login, no API key.

### What does Bulk WHOIS & DNS Lookup do?

- RDAP/WHOIS: registrar, creation, expiry and update dates, status, nameservers, DNSSEC.
- DNS: A, AAAA, MX, NS, TXT, SOA, CAA plus SPF, DMARC policy and DKIM selectors you list.
- TLS certificate: issuer, subject, SANs, validity and `daysToExpiry`.
- HTTP: final URL, redirects, server, HSTS, page title and detected tech (Shopify, WordPress, Cloudflare...).
- Choose which sections to run with `checks`; accepts URLs and removes duplicates.

### Why use it

- **Four lookups in one item per domain**, so one billing event covers all checks.
- **Fail-soft**: a failed section is `null` and explained in `errors`; the rest is still returned.
- **Privacy-friendly**: registrant personal data is never collected.
- **Low price**: $4 per 1,000 domains.
- **No API keys or proxy.**

### Use cases

- Domain and SSL expiry monitoring for a portfolio.
- Lead enrichment: which sites run Shopify, WordPress or Cloudflare.
- Email deliverability audits (SPF, DMARC, DKIM).
- Brand and competitor research, domain age checks.
- Due diligence on a list of vendor or acquisition domains.

### How to use

1. Open the Actor on Apify and click **Try for free** (or call it through the API).
2. Paste **domains** or URLs and choose the **checks** (`rdap`, `dns`, `tls`, `http`).
3. Click **Start**, then download the dataset as JSON, CSV, Excel or HTML, or read it through the API.

#### Input example

```json
{
  "domains": ["example.com", "https://www.github.com/", "stripe.io"],
  "checks": ["rdap", "dns", "tls", "http"],
  "dkimSelectors": ["default", "google", "selector1"],
  "concurrency": 5,
  "timeoutSecs": 10
}
```

URLs are accepted; the hostname is extracted and duplicates are removed.

### Output example

```json
{
  "domain": "shopify.com",
  "errors": {},
  "rdap": {"queried": "shopify.com", "registrar": "MarkMonitor Inc.", "registrarIanaId": "292",
           "createdAt": "2005-03-11T05:18:03Z", "expiresAt": "2027-03-11T05:18:03Z", "updatedAt": "2026-02-01T09:12:44Z",
           "status": ["client transfer prohibited"], "nameservers": ["gold.foundationdns.com"], "registrantOrg": null, "dnssec": false},
  "dns": {"exists": true,
          "records": {"A": ["23.227.38.33"], "MX": ["10 aspmx.l.google.com"], "NS": ["..."], "CAA": ["0 issue \"digicert.com\""], "SOA": ["..."]},
          "emailAuth": {"spf": "v=spf1 ...", "dmarc": "v=DMARC1; p=reject", "dmarcPolicy": "reject", "dkimSelectorsFound": ["google"]}},
  "tls": {"valid": true, "protocol": "TLSv1.3", "issuer": "Google Trust Services", "subject": "shopify.com",
          "sans": ["shopify.com", "*.shopify.com"], "notBefore": "2026-08-01T00:00:00+00:00",
          "notAfter": "2027-01-01T00:00:00+00:00", "daysToExpiry": 77},
  "http": {"finalUrl": "https://www.shopify.com/", "status": 200, "redirects": ["https://shopify.com/"], "server": "cloudflare",
           "hsts": "max-age=31536000", "title": "Shopify ...", "tech": ["Shopify", "Cloudflare"], "certVerified": true}
}
```

A section that failed is `null` and explained in `errors` (e.g. `{"tls": "gaierror: ..."}`), the rest of the item is still returned. A domain that is not registered returns `rdap.registered=false` and `dns.exists=false`.

### Pricing

Pay per event, no subscription. You pay only for what is returned:

| Event | Price per 1,000 | 1,000 | 10,000 | 100,000 |
|---|---|---|---|---|
| domain | $4.00 | $4.00 | $40.00 | $400.00 |

Example: 1,000 domains cost $4.00; 10,000 cost $40.00.

One domain costs the same whether you run one check or all four.

Platform usage (compute) is included in the event price; there is nothing else to pay for.

### Integrations & API

Run it from code with the Apify API. Replace `<APIFY_TOKEN>` with your API token.

**Python** (`pip install apify-client`)

```python
from apify_client import ApifyClient

client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("bachiembmt/domain-intel-whois-dns-ssl").call(run_input={"domains": ["example.com", "apify.com"], "checks": ["rdap", "dns", "tls", "http"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)
```

**cURL** (run synchronously and get dataset items)

```bash
curl -X POST "https://api.apify.com/v2/acts/bachiembmt~domain-intel-whois-dns-ssl/run-sync-get-dataset-items?token=<APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com", "apify.com"], "checks": ["rdap", "dns", "tls", "http"]}'
```

Works with:

- **Make** and **Zapier**: use the Apify app/module to run this Actor and pass the dataset on.
- **n8n**: use the Apify node or an HTTP Request node with the API call above.
- **Google Sheets**: export the dataset as CSV, or use the Apify integration to append rows automatically.
- **Webhooks**: trigger your own endpoint when a run finishes; combine with Apify schedules for recurring jobs.
- **AI agents**: expose the Actor as a tool through the [Apify MCP server](https://mcp.apify.com).

### FAQ

**Do all TLDs have WHOIS/RDAP data?**
No. TLDs without RDAP (e.g. `.io`) fall back to plain WHOIS; some ccTLDs publish neither (e.g. `.vn`), in which case the `rdap` section errors but DNS, TLS and HTTP still work.

**Can it find DKIM records?**
Only for the selectors you list; DKIM cannot be enumerated.

**Does it need a proxy or API key?**
No.

**Do I need an account or API key for the source?**
No. The Actor needs no login or source API key. You only need an Apify account to run it.

**Is it legal to scrape this data?**
Uses public registry (RDAP/WHOIS), DNS-over-HTTPS and TLS data. Registrant names, emails and phones are not collected. Registries rate-limit lookups, so use moderate concurrency on large lists. This is general information, not legal advice.

### Limitations

- **Registrant personal data is never collected** (names, emails, phones are ignored; GDPR-redacted anyway). Only registrar, dates, status, nameservers and registrant *organisation* when public.
- RDAP comes from the IANA bootstrap. TLDs without RDAP (e.g. `.io`) fall back to plain WHOIS (port 43) with best-effort parsing. Some ccTLDs publish neither (e.g. `.vn`): the `rdap` section errors, DNS/TLS/HTTP still work.
- RDAP uses the name as given, then strips subdomain labels down to two labels (no public-suffix list), so `a.example.co.uk` style names may resolve to `co.uk`.
- DKIM cannot be enumerated: only the selectors you list are probed.
- DNS goes through Cloudflare DNS-over-HTTPS (public resolver view, not authoritative).
- Tech detection is heuristic (headers, HTML markers, meta generator) and not exhaustive.
- Registries rate-limit RDAP/WHOIS; use moderate concurrency for large lists.

# Actor input Schema

## `domains` (type: `array`):

Domain names or URLs (https://www.example.com/page). The hostname is extracted automatically.

## `checks` (type: `array`):

Which sections to run. Allowed: rdap, dns, tls, http.

## `dkimSelectors` (type: `array`):

DKIM cannot be enumerated, so common selectors are probed. Override to test your own.

## `concurrency` (type: `integer`):

Domains processed in parallel.

## `timeoutSecs` (type: `integer`):

Timeout for each network request.

## Actor input object example

```json
{
  "domains": [
    "example.com",
    "apify.com",
    "https://www.github.com/"
  ],
  "checks": [
    "rdap",
    "dns",
    "tls",
    "http"
  ],
  "dkimSelectors": [
    "default",
    "google",
    "selector1",
    "selector2",
    "k1",
    "s1",
    "s2",
    "mail",
    "dkim"
  ],
  "concurrency": 5,
  "timeoutSecs": 10
}
```

# Actor output Schema

## `domains` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com",
        "apify.com",
        "https://www.github.com/"
    ],
    "checks": [
        "rdap",
        "dns",
        "tls",
        "http"
    ],
    "dkimSelectors": [
        "default",
        "google",
        "selector1",
        "selector2",
        "k1",
        "s1",
        "s2",
        "mail",
        "dkim"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("bachiembmt/domain-intel-whois-dns-ssl").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "example.com",
        "apify.com",
        "https://www.github.com/",
    ],
    "checks": [
        "rdap",
        "dns",
        "tls",
        "http",
    ],
    "dkimSelectors": [
        "default",
        "google",
        "selector1",
        "selector2",
        "k1",
        "s1",
        "s2",
        "mail",
        "dkim",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("bachiembmt/domain-intel-whois-dns-ssl").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com",
    "apify.com",
    "https://www.github.com/"
  ],
  "checks": [
    "rdap",
    "dns",
    "tls",
    "http"
  ],
  "dkimSelectors": [
    "default",
    "google",
    "selector1",
    "selector2",
    "k1",
    "s1",
    "s2",
    "mail",
    "dkim"
  ]
}' |
apify call bachiembmt/domain-intel-whois-dns-ssl --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bachiembmt/domain-intel-whois-dns-ssl"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/e7eBmlepnMeBIHqPI/builds/UMMsAjTSRxdaYIIre/openapi.json