Domain Intel: WHOIS (RDAP) + DNS + SSL + Domain Age, in bulk

Paste a list of domains, URLs or email addresses and get one clean row per domain. Each row has the registrar, creation and expiry dates, domain age, nameservers, MX and email provider, SPF and DMARC, CAA, and the live SSL certificate (issuer, expiry, validity). Lookups use official RDAP (the modern, structured WHOIS) through the IANA bootstrap, DNS over Cloudflare DoH with a system-resolver fallback, and a direct TLS handshake on port 443. No browser and no proxies, so runs are fast.

You pay only for domains that return real data. Invalid inputs, unregistered domains and domains with no data are written free.

Use cases

• Lead enrichment: add domain age, email provider (Google Workspace, Microsoft 365, Proofpoint…), registrar and company country to a lead list. Enter emails (ceo@company.com) directly.
• Portfolio and expiry monitoring: track expiry dates, registrar lock statuses and nameservers across hundreds of domains. expiringSoon flags anything expiring within 30 days (configurable).
• Email deliverability audit: check hasMx, hasSpf, the SPF all qualifier, hasDmarc and dmarcPolicy (none/quarantine/reject) for every domain you send to or own.
• SSL expiry checks: get the certificate issuer, sslValidTo, sslDaysUntilExpiry and sslValid. Expired, self-signed, wrong-host and untrusted certificates are reported with the reason.
• Fraud and new-domain screening: domainAgeDays flags domains registered in the last few weeks.

Input

Field	Default	Notes
domains	–	Domains, URLs or emails. Each is normalized to its registrable domain (https://www.bbc.co.uk/news → bbc.co.uk, ceo@stripe.com → stripe.com). Duplicates are skipped.
includeWhois / includeDns / includeSsl	true	Turn sections off for speed.
followRegistrarRdap	true	Also query the registrar's RDAP server to fill in gaps (abuse contact, registrant org/country).
expiringSoonDays	30	Threshold for expiringSoon (domain or certificate).
maxConcurrency	10	Up to 50. RDAP is paced per registry/registrar either way.
maxChargedDomains	0 (no limit)	Stop after this many charged domains.
includeFailedDomains	true	Write free rows for invalid/unregistered/no-data inputs.

{ "domains": ["google.com", "https://www.bbc.co.uk/news", "ceo@stripe.com"] }

Output (one row per domain, abridged)

{
  "domain": "google.com", "status": "OK", "isRegistered": true,
  "registrar": "MarkMonitor Inc.", "registrarIanaId": "292",
  "createdAt": "1997-09-15T04:00:00Z", "expiresAt": "2028-09-14T04:00:00Z",
  "domainAgeDays": 10632, "domainAgeYears": 29.1, "daysUntilExpiry": 691,
  "statusCodes": ["client delete prohibited", "server transfer prohibited", "..."],
  "nameservers": ["ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com"],
  "registrantRedacted": true, "registrantCountry": "US", "abuseEmail": "abusecomplaints@markmonitor.com",
  "hasMx": true, "emailProvider": "Google Workspace", "hasSpf": true, "spfAllQualifier": "~all",
  "hasDmarc": true, "dmarcPolicy": "reject", "caaIssuers": ["pki.goog"],
  "sslValid": true, "sslIssuer": "Google Trust Services", "sslValidTo": "2026-12-21T...",
  "sslDaysUntilExpiry": 58, "expiringSoon": false, "expiringSoonReasons": [],
  "whois": { "...": "full parsed RDAP" }, "dns": { "a": [], "mx": [], "txt": [], "...": "" }, "ssl": { "sans": [], "protocol": "TLSv1.3", "...": "" },
  "charged": true
}

status is OK (charged), NOT_REGISTERED, NO_DATA or INVALID_INPUT (all free). A run summary is saved to the key-value store as RUN_SUMMARY.

Pricing (pay per event)

One event, domain-analyzed. It is charged once per unique domain when WHOIS, DNS or SSL returned real data for a registered domain.

Tier	Per domain	Per 1,000 domains
FREE	$0.004	$4.00
BRONZE	$0.0035	$3.50
SILVER	$0.003	$3.00
GOLD	$0.0025	$2.50

Free: invalid inputs (not a domain, IPs, localhost, unknown TLDs), duplicates, unregistered domains and domains where every lookup failed. Apify's standard actor-start event ($0.00005) applies. Set a max total charge or maxChargedDomains to cap spend. The run stops cleanly at your limit.

Limitations

• GDPR / privacy redaction: most gTLD registrars redact registrant names, emails and addresses. We output only what is public (organization, country, state when given) and flag registrantRedacted. Personal names are never output.
• ccTLDs without RDAP: some registries (for example .ru, .jp, .eu, .it, .cn) have no public RDAP. These domains still get DNS and SSL data and are charged only if that data exists. whois.errorCode is NO_RDAP_SERVER. Some registries publish only minimal RDAP, e.g. DENIC (.de) gives status, nameservers and last-changed date but no registrar or dates.
• Registrar rate limits: registry lookups are paced and retried with backoff on 429. The registrar follow-up is best effort. Some registrars (e.g. GoDaddy) rate-limit cloud IPs, and then the registry data alone is returned.
• SSL is checked on port 443 only, on the host you entered (or the bare domain, then www). Port 80/HTTP is not checked.
• emailProvider is based on MX hostnames. Self-hosted means the MX points at the domain's own infrastructure and Other means an unrecognized provider.