Bulk Domain WHOIS (RDAP), DNS, SSL & Email Security Checker

Check registration data, DNS records, SSL certificate expiry and email security (SPF, DKIM, DMARC) for one domain or 10,000 domains in a single run. You get one clean JSON/CSV/Excel row per domain, ready for spreadsheets, monitoring dashboards, lead qualification or AI agents.

It uses only official, standard protocols: RDAP (the ICANN replacement for WHOIS), DNS over HTTPS and one TLS handshake. There's no scraping, no proxies and no captchas, so runs are fast and cheap. No registrant personal data is collected.

What does it check?

Check	Fields you get
Registration (RDAP / WHOIS)	registrar, registrar IANA ID, created / updated / expiry dates, domain age in days, days until expiry, EPP status codes, nameservers, DNSSEC, likely available flag
DNS records	A, AAAA, MX, NS, TXT, CAA, CNAME (apex and www), SOA, detected email provider (Google Workspace, Microsoft 365, Zoho, Proofpoint…)
SSL / TLS certificate	valid / invalid, issuer, subject, valid from / to, days until expiry, TLS version, SAN list, whether the cert covers the domain, SHA-256 fingerprint
Email security	SPF record and all qualifier, SPF lookup count (10-lookup limit), DMARC policy / pct / reporting, DKIM selectors found, MTA-STS, TLS-RPT, BIMI, 0–100 score and a plain-English issue list

Popular use cases

• Domain portfolio and expiry monitoring. Schedule a daily run and alert when daysUntilExpiry or ssl.daysUntilExpiry drops below 30.
• Email deliverability audits. Find clients or prospects with no DMARC, p=none, or broken SPF.
• Sales and lead qualification. Enrich a list of company domains with email provider (Google vs Microsoft), domain age and hosting.
• Security / IT inventory. Find expired or mismatched certificates and missing CAA records across all your domains.
• Domain availability pre-check. likelyAvailable: true when the registry has no record. Always confirm with a registrar before buying.
• AI agents and MCP. A simple, deterministic tool that an agent can call with a list of domains.

How to use it

1. Click Try for free and paste your domains (or full URLs) into Domains.
2. Leave the checks on, or switch off the ones you don't need.
3. Click Start. Most domains finish in under a second.
4. Download results as JSON, CSV, Excel or HTML, or use the API.

Input example

{
  "domains": ["apify.com", "https://www.github.com/about", "example.org"],
  "checkRdap": true,
  "checkDns": true,
  "checkSsl": true,
  "checkEmailSecurity": true
}

Output example (one item, shortened)

{
  "domain": "apify.com",
  "checkedAt": "2026-10-24T17:49:31.947Z",
  "ssl": {
    "reachable": true,
    "valid": true,
    "validationError": null,
    "protocol": "TLSv1.3",
    "issuer": "Amazon",
    "subject": "*.apify.com",
    "validFrom": "2026-07-03T00:00:00.000Z",
    "validTo": "2027-01-16T23:59:59.000Z",
    "daysUntilExpiry": 84,
    "sanCount": 4,
    "sans": [
      "*.apify.com",
      "apifier.com"
    ],
    "coversDomain": true,
    "fingerprint256": "8B:70:D5:07:BC:74:55:22:2A:23:E0:08:36:D1:D8:1B:75:F1:0B:99:99:0F:E5:B8:AE:6E:9A:9C:08:F1:F9:8C"
  },
  "dns": {
    "a": [
      "3.170.42.100",
      "3.170.42.109",
      "3.170.42.68",
      "3.170.42.76"
    ],
    "aaaa": [
      "2600:9000:2870:1000:9:a03e:6540:93a1"
    ],
    "mx": [
      {
        "priority": 1,
        "exchange": "aspmx.l.google.com"
      },
      {
        "priority": 5,
        "exchange": "alt1.aspmx.l.google.com"
      }
    ],
    "ns": [
      "ns-1225.awsdns-25.org",
      "ns-1928.awsdns-49.co.uk",
      "ns-449.awsdns-56.com",
      "ns-839.awsdns-40.net"
    ],
    "txt": [
      "tito-domain-verification=pbg2696rvzbax2t4dl7h5ynqm"
    ],
    "caa": [
      "issue amazonaws.com",
      "issue digicert.com"
    ],
    "cname": [],
    "wwwCname": [],
    "soa": {
      "primaryNs": "ns-839.awsdns-40.net",
      "hostmaster": "awsdns-hostmaster.amazon.com",
      "serial": 1
    },
    "emailProvider": "Google Workspace",
    "resolves": true
  },
  "emailSecurity": {
    "spf": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
    "spfAllQualifier": "-",
    "spfLookupMechanisms": 6,
    "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
    "dmarcPolicy": "reject",
    "dmarcSubdomainPolicy": "reject",
    "dmarcPct": 100,
    "dmarcReportingEnabled": true,
    "dkimSelectorsFound": [
      "google"
    ],
    "mtaSts": true,
    "tlsRpt": true,
    "bimi": true,
    "score": 100,
    "issues": []
  },
  "rdapStatus": "FOUND",
  "registeredDomain": "apify.com",
  "likelyAvailable": false,
  "registrar": "Amazon Registrar, Inc.",
  "registrarIanaId": "468",
  "registrarAbuseEmail": "trustandsafety@support.aws.com",
  "createdAt": "2009-06-02T17:14:10Z",
  "updatedAt": "2026-05-16T16:53:04Z",
  "expiresAt": "2035-06-02T17:14:10Z",
  "domainAgeDays": 6353,
  "daysUntilExpiry": 3142,
  "statuses": [
    "client transfer prohibited"
  ],
  "nameservers": [
    "ns-1225.awsdns-25.org",
    "ns-1928.awsdns-49.co.uk",
    "ns-449.awsdns-56.com",
    "ns-839.awsdns-40.net"
  ],
  "dnssec": true,
  "errors": [],
  "durationMs": 1356
}

Run it from the API

curl -X POST "https://api.apify.com/v2/acts/chesapeake~domain-whois-dns-ssl/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["apify.com","example.org"]}'

Pricing

This Actor uses pay-per-event pricing, so you only pay for domains that return data.

Event	Price
Domain checked (all 4 checks included)	$0.002 ($2 per 1,000 domains)
Actor start	$0.00005 (Apify default)

Domains that fail every check, and invalid entries, are not charged. Set Max cost per run to cap spending; the Actor stops cleanly when the cap is reached. Compute is included in the price.

FAQ

Is this a WHOIS lookup? Yes, in the modern form. RDAP is the official ICANN successor to port-43 WHOIS and returns structured JSON from the registry and registrar. For TLDs without RDAP (for example some ccTLDs), rdapStatus says so and the other checks still run.

Why don't I see the owner's name, email or phone? On purpose. We don't collect registrant personal data. Since GDPR it's redacted for most domains anyway. You get registrar-level business data only.

How accurate is "likelyAvailable"? It's true when the registry's RDAP server returns "not found". Premium, reserved or recently deleted names can still be unavailable, so always confirm at a registrar.

Which DKIM selectors are checked? DKIM selectors can't be listed through DNS, so we probe common ones (google, selector1, selector2, default, k1). Add your own under DKIM selectors.

Does it use proxies or scrape websites? No. It makes RDAP API calls, DNS-over-HTTPS queries (Cloudflare, falling back to Google) and one TLS handshake per domain.

Can I monitor domains on a schedule? Yes. Create a Task with your list, add an Apify Schedule (for example daily), and connect a webhook, Slack, email or Zapier integration that alerts you when a value crosses your threshold.

Something broke or you need a field? Open an issue on the Issues tab. We reply within 2 business days.

Limits and fair use

• Up to 10,000 domains per run. Split larger lists into several runs or Tasks.
• Respect registry RDAP rate limits: keep Max concurrency at its default for very large lists.
• Results are provided as-is from public registries and DNS. Don't use them for spam or abuse.