# Bulk Domain WHOIS (RDAP), DNS, SSL & Email Security Checker (`chesapeake/domain-whois-dns-ssl`) Actor

Check thousands of domains in one run: registrar, creation & expiry dates (RDAP/WHOIS), DNS records (A, MX, NS, TXT, CAA), SSL certificate expiry, and SPF/DKIM/DMARC email security score. No personal data, no proxies.

- **URL**: https://apify.com/chesapeake/domain-whois-dns-ssl.md
- **Developed by:** [Chesapeake Commerce](https://apify.com/chesapeake) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$2.00 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk Domain WHOIS (RDAP), DNS, SSL & Email Security Checker

Check **registration data, DNS records, SSL certificate expiry and email security (SPF, DKIM, DMARC)** for one domain or 10,000 domains in a single run. You get one clean JSON/CSV/Excel row per domain, ready for spreadsheets, monitoring dashboards, lead qualification or AI agents.

It uses only official, standard protocols: **RDAP** (the ICANN replacement for WHOIS), **DNS over HTTPS** and one **TLS handshake**. There's no scraping, no proxies and no captchas, so runs are fast and cheap. **No registrant personal data is collected.**

### What does it check?

| Check | Fields you get |
|---|---|
| **Registration (RDAP / WHOIS)** | registrar, registrar IANA ID, created / updated / expiry dates, domain age in days, days until expiry, EPP status codes, nameservers, DNSSEC, *likely available* flag |
| **DNS records** | A, AAAA, MX, NS, TXT, CAA, CNAME (apex and www), SOA, detected email provider (Google Workspace, Microsoft 365, Zoho, Proofpoint…) |
| **SSL / TLS certificate** | valid / invalid, issuer, subject, valid from / to, **days until expiry**, TLS version, SAN list, whether the cert covers the domain, SHA-256 fingerprint |
| **Email security** | SPF record and `all` qualifier, SPF lookup count (10-lookup limit), DMARC policy / pct / reporting, DKIM selectors found, MTA-STS, TLS-RPT, BIMI, **0–100 score** and a plain-English issue list |

### Popular use cases

- **Domain portfolio and expiry monitoring.** Schedule a daily run and alert when `daysUntilExpiry` or `ssl.daysUntilExpiry` drops below 30.
- **Email deliverability audits.** Find clients or prospects with no DMARC, `p=none`, or broken SPF.
- **Sales and lead qualification.** Enrich a list of company domains with email provider (Google vs Microsoft), domain age and hosting.
- **Security / IT inventory.** Find expired or mismatched certificates and missing CAA records across all your domains.
- **Domain availability pre-check.** `likelyAvailable: true` when the registry has no record. Always confirm with a registrar before buying.
- **AI agents and MCP.** A simple, deterministic tool that an agent can call with a list of domains.

### How to use it

1. Click **Try for free** and paste your domains (or full URLs) into **Domains**.
2. Leave the checks on, or switch off the ones you don't need.
3. Click **Start**. Most domains finish in under a second.
4. Download results as JSON, CSV, Excel or HTML, or use the API.

#### Input example

```json
{
  "domains": ["apify.com", "https://www.github.com/about", "example.org"],
  "checkRdap": true,
  "checkDns": true,
  "checkSsl": true,
  "checkEmailSecurity": true
}
```

#### Output example (one item, shortened)

```json
{
  "domain": "apify.com",
  "checkedAt": "2026-10-24T17:49:31.947Z",
  "ssl": {
    "reachable": true,
    "valid": true,
    "validationError": null,
    "protocol": "TLSv1.3",
    "issuer": "Amazon",
    "subject": "*.apify.com",
    "validFrom": "2026-07-03T00:00:00.000Z",
    "validTo": "2027-01-16T23:59:59.000Z",
    "daysUntilExpiry": 84,
    "sanCount": 4,
    "sans": [
      "*.apify.com",
      "apifier.com"
    ],
    "coversDomain": true,
    "fingerprint256": "8B:70:D5:07:BC:74:55:22:2A:23:E0:08:36:D1:D8:1B:75:F1:0B:99:99:0F:E5:B8:AE:6E:9A:9C:08:F1:F9:8C"
  },
  "dns": {
    "a": [
      "3.170.42.100",
      "3.170.42.109",
      "3.170.42.68",
      "3.170.42.76"
    ],
    "aaaa": [
      "2600:9000:2870:1000:9:a03e:6540:93a1"
    ],
    "mx": [
      {
        "priority": 1,
        "exchange": "aspmx.l.google.com"
      },
      {
        "priority": 5,
        "exchange": "alt1.aspmx.l.google.com"
      }
    ],
    "ns": [
      "ns-1225.awsdns-25.org",
      "ns-1928.awsdns-49.co.uk",
      "ns-449.awsdns-56.com",
      "ns-839.awsdns-40.net"
    ],
    "txt": [
      "tito-domain-verification=pbg2696rvzbax2t4dl7h5ynqm"
    ],
    "caa": [
      "issue amazonaws.com",
      "issue digicert.com"
    ],
    "cname": [],
    "wwwCname": [],
    "soa": {
      "primaryNs": "ns-839.awsdns-40.net",
      "hostmaster": "awsdns-hostmaster.amazon.com",
      "serial": 1
    },
    "emailProvider": "Google Workspace",
    "resolves": true
  },
  "emailSecurity": {
    "spf": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
    "spfAllQualifier": "-",
    "spfLookupMechanisms": 6,
    "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
    "dmarcPolicy": "reject",
    "dmarcSubdomainPolicy": "reject",
    "dmarcPct": 100,
    "dmarcReportingEnabled": true,
    "dkimSelectorsFound": [
      "google"
    ],
    "mtaSts": true,
    "tlsRpt": true,
    "bimi": true,
    "score": 100,
    "issues": []
  },
  "rdapStatus": "FOUND",
  "registeredDomain": "apify.com",
  "likelyAvailable": false,
  "registrar": "Amazon Registrar, Inc.",
  "registrarIanaId": "468",
  "registrarAbuseEmail": "trustandsafety@support.aws.com",
  "createdAt": "2009-06-02T17:14:10Z",
  "updatedAt": "2026-05-16T16:53:04Z",
  "expiresAt": "2035-06-02T17:14:10Z",
  "domainAgeDays": 6353,
  "daysUntilExpiry": 3142,
  "statuses": [
    "client transfer prohibited"
  ],
  "nameservers": [
    "ns-1225.awsdns-25.org",
    "ns-1928.awsdns-49.co.uk",
    "ns-449.awsdns-56.com",
    "ns-839.awsdns-40.net"
  ],
  "dnssec": true,
  "errors": [],
  "durationMs": 1356
}
```

#### Run it from the API

```bash
curl -X POST "https://api.apify.com/v2/acts/chesapeake~domain-whois-dns-ssl/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["apify.com","example.org"]}'
```

### Pricing

This Actor uses **pay-per-event** pricing, so you only pay for domains that return data.

| Event | Price |
|---|---|
| Domain checked (all 4 checks included) | **$0.002** ($2 per 1,000 domains) |
| Actor start | $0.00005 (Apify default) |

Domains that fail every check, and invalid entries, are **not charged**. Set **Max cost per run** to cap spending; the Actor stops cleanly when the cap is reached. Compute is included in the price.

### FAQ

**Is this a WHOIS lookup?** Yes, in the modern form. RDAP is the official ICANN successor to port-43 WHOIS and returns structured JSON from the registry and registrar. For TLDs without RDAP (for example some ccTLDs), `rdapStatus` says so and the other checks still run.

**Why don't I see the owner's name, email or phone?** On purpose. We don't collect registrant personal data. Since GDPR it's redacted for most domains anyway. You get registrar-level business data only.

**How accurate is "likelyAvailable"?** It's true when the registry's RDAP server returns "not found". Premium, reserved or recently deleted names can still be unavailable, so always confirm at a registrar.

**Which DKIM selectors are checked?** DKIM selectors can't be listed through DNS, so we probe common ones (`google`, `selector1`, `selector2`, `default`, `k1`). Add your own under **DKIM selectors**.

**Does it use proxies or scrape websites?** No. It makes RDAP API calls, DNS-over-HTTPS queries (Cloudflare, falling back to Google) and one TLS handshake per domain.

**Can I monitor domains on a schedule?** Yes. Create a Task with your list, add an Apify Schedule (for example daily), and connect a webhook, Slack, email or Zapier integration that alerts you when a value crosses your threshold.

**Something broke or you need a field?** Open an issue on the Issues tab. We reply within 2 business days.

### Limits and fair use

- Up to 10,000 domains per run. Split larger lists into several runs or Tasks.
- Respect registry RDAP rate limits: keep **Max concurrency** at its default for very large lists.
- Results are provided as-is from public registries and DNS. Don't use them for spam or abuse.

# Actor input Schema

## `domains` (type: `array`):

Domains or URLs to check. URLs are reduced to their hostname (https://www.apify.com/store → apify.com). Max 10,000 per run.

## `checkRdap` (type: `boolean`):

Registrar, creation, update & expiry dates, domain age, status codes, nameservers, DNSSEC. Registrant contact data is never collected.

## `checkDns` (type: `boolean`):

A, AAAA, MX, NS, TXT, CAA, CNAME and SOA records, plus detected email provider.

## `checkSsl` (type: `boolean`):

Issuer, validity, days until expiry, TLS version, SAN list (one TLS handshake on port 443).

## `checkEmailSecurity` (type: `boolean`):

Parses SPF and DMARC, probes common DKIM selectors and returns a 0–100 email-security score with a list of issues.

## `dkimSelectors` (type: `array`):

DKIM selectors to look up (max 10). Defaults cover Google Workspace, Microsoft 365 and common providers.

## `maxConcurrency` (type: `integer`):

How many domains to check in parallel.

## `timeoutSecs` (type: `integer`):

Timeout for each network lookup.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "example.com",
    "github.com"
  ],
  "checkRdap": true,
  "checkDns": true,
  "checkSsl": true,
  "checkEmailSecurity": true,
  "dkimSelectors": [
    "google",
    "selector1",
    "selector2",
    "default",
    "k1"
  ],
  "maxConcurrency": 10,
  "timeoutSecs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

All checked domains (one item per domain) in the default dataset, Overview view selected.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "example.com",
        "github.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("chesapeake/domain-whois-dns-ssl").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "example.com",
        "github.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("chesapeake/domain-whois-dns-ssl").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "example.com",
    "github.com"
  ]
}' |
apify call chesapeake/domain-whois-dns-ssl --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,chesapeake/domain-whois-dns-ssl"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/U3Wxtyo1AC3mZMbAZ/builds/OmVVuC7RQSiDr8szx/openapi.json