WHOIS & RDAP Domain Expiry Monitor

Bulk WHOIS lookup, domain expiry monitoring, email security checks and availability checks, straight from the official registries of 1,200+ TLDs. Give it a list of domains (or URLs, or e-mail addresses) and get back, per domain:

• who owns it: registrant organisation and country, or whether it is hidden by GDPR redaction or a privacy/proxy service;
• when it expires: expiry date, days until expiry, auto-renew grace and pending-delete status;
• how it is set up: registrar, EPP status codes, transfer lock, nameservers, DNS provider (Cloudflare, Route 53, ...), DNSSEC and domain age;
• how its email is secured: MX records and mail provider (Google Workspace, Microsoft 365, Proofpoint, ...), SPF, DMARC, DKIM, MTA-STS/TLS-RPT/BIMI, and a 0-100 authentication score with plain-language findings;
• what changed since the last run: renewals, registrar or owner changes, nameserver switches, a removed transfer lock, domains that dropped or were just registered, and mail configuration changes such as a weakened DMARC policy, a swapped MX host or a removed SPF record.

The data comes from RDAP, the official JSON successor of WHOIS that ICANN requires for all generic TLDs. For registries that keep owner data at the registrar (.com, .net and most gTLDs), the Actor follows the registry's link to the registrar's own RDAP server, which is where the owner organisation lives. Country-code TLDs without RDAP (.de, .eu, .io, .co, .it, .se, .dk, .jp and many more), or whose RDAP server is down, are answered through that registry's official port-43 WHOIS, with a parser tested on 30+ registry formats. Mail configuration is read from Google's public DNS-over-HTTPS endpoint. It uses no scraping, no proxies and no third-party WHOIS resellers: about 60 domains in 25 seconds.

When should an AI agent use this?

Use this Actor when a question needs authoritative domain registration data for one or many domains:

• "When does acme.com expire, and who is the registrar?"
• "Who owns stripe.io? Is the owner hidden behind a privacy service?"
• "Which of these 200 company domains expire in the next 60 days?"
• "Is 'lumora' still free as .com, .io or .ai?" (use names + tlds)
• "Did any of our domains change registrar, owner or nameservers since last week?" (scheduled, trackChanges)
• "Was this domain registered less than 30 days ago, and which registrar abuse address handles it?"
• "Which of our domains have no DMARC record, or a DMARC policy of none?"
• "Does example.com send through Microsoft 365, and which senders does its SPF allow?"
• "Did any domain weaken its DMARC policy since last week?" (scheduled, trackChanges + alerts_only)

It returns one structured JSON record per domain, so an agent can answer directly from fields such as expiresAt, daysUntilExpiry, registrar, registrantOrganization, isRegistered, domainAgeDays, dnsProvider, riskFlags and the emailSecurity block (mailProvider, dmarcPolicy, spfAll, dkimSelectors, score, grade, findings). It does not return website content or traffic estimates.

What this Actor does

• Accepts messy input. https://www.bbc.co.uk/news is checked as bbc.co.uk, info@acme.io as acme.io, bücher.de as its punycode form (domainUnicode keeps the readable name). Lists such as "a.com, b.io; c.nl" in one entry are split. Duplicates are checked once. The Actor knows the Public Suffix List, so co.uk, com.au and similar suffixes are handled correctly.
• Finds the right registry through the IANA RDAP bootstrap registry and queries the authoritative server directly: Verisign for .com/.net, PIR for .org, Nominet for .uk, SIDN for .nl, AFNIC for .fr, CIRA for .ca, Google Registry for .app/.dev, and so on.
• Finds the owner at the registrar's RDAP server for gTLDs (for example google.com → Google LLC, US; booking.com → Booking.com B.V., NL). It tells apart public, redacted (GDPR) and proxy (Domains By Proxy, Withheld for Privacy, ...).
• Falls back to WHOIS for ccTLDs without RDAP, and for registries whose RDAP server is unreachable. An unreachable server is detected once per run and skipped from then on, so it does not slow the run down.
• Computes what you actually need: daysUntilExpiry, expiryStatus (ok, expiring_soon, expired, unknown), domainAgeDays, transferLocked, onHold, pendingDelete, dnsProvider.
• Reads the mail configuration from DNS. For registered domains it resolves MX, SPF, DMARC, DKIM and (in full mode) MTA-STS, TLS-RPT and BIMI, then reports mailProvider, mxHosts, spfAll, spfThirdPartySenders, dmarcPolicy, dkimSelectors, a 0-100 score with a letter grade, and findings in plain English. It only reads the domain's own mail records: no subdomain enumeration and no dangling-CNAME hunting.
• Grades email authentication honestly. SPF with -all/~all scores higher than +all (which lets anyone spoof the domain); DMARC reject beats quarantine beats none; more than 10 SPF DNS lookups is a finding, since that is the RFC limit. DKIM is probed on 7 common selectors (full: 22) and the output says how many were tried, because "not found" is not the same as "absent". A failed DNS lookup never becomes a security finding.
• Detects mail changes between runs and treats a downgrade as an alert: mx_changed, mail_provider_changed, spf_removed, dmarc_policy_changed, dmarc_weakened (reject → quarantine → none) and dkim_removed. A run where DNS was unreachable keeps the previous baseline instead of reporting everything as removed: a read that failed is stored as "unknown", never as "gone".
• Raises risk flags: expiring_soon, expired, auto_renew_grace, pending_delete, transfer_pending, on_hold, no_transfer_lock, dnssec_unsigned, no_nameservers, parked, newly_registered. no_transfer_lock is only raised where the registry supports lock statuses (all gTLDs, and ccTLDs that use them); ccTLDs such as .it, .dk or .nl protect transfers with auth codes, so there transferLocked stays null. On scheduled runs it adds renewed, registrar_changed, owner_changed, nameservers_changed, status_changed, transfer_lock_removed, dropped and newly_taken. Mail findings add spf_missing, spf_all_all, spf_softfail, spf_too_many_lookups, dmarc_missing, dmarc_none, dmarc_quarantine, dkim_unknown, no_mx. Only the mail changes above become alerts; a soft SPF policy is a finding, not an alert.
• Keeps change alerts meaningful. Short grace-period statuses after a normal renewal, "MarkMonitor Inc." versus "MarkMonitor, Inc.", or an owner lookup that failed once never trigger a false alert. A dropped domain reports one change (dropped), not a list of fields that became empty.
• Three output modes. all, alerts_only (you only get, and pay for, domains that need attention) and available_only (for availability sweeps). Errors, unsupported TLDs and invalid entries are always included, and free, so a monitoring run never silently skips a domain. The SUMMARY record always holds the complete overview.

Input

Field	Type	Default	Description
domains	array of strings	–	Domains, subdomains, URLs or e-mail addresses.
names	array of strings	–	Brand names to check across tlds (availability sweep).
tlds	array of strings	com, net, org, io, ai, co, app, dev	TLDs used for names.
expiryWarningDays	integer	30	Domains that expire within this many days get expiryStatus: expiring_soon.
emailSecurity	off / basic / full	basic	Email checks from DNS. off = no DNS at all. basic = MX + SPF + DMARC + 7 DKIM selectors (~10 lookups per domain). full = 22 selectors + MTA-STS/TLS-RPT/BIMI (~20 lookups per domain). Only registered domains are checked.
outputFilter	all / alerts_only / available_only	all	Which results to deliver.
trackChanges	boolean	true	Stores a snapshot per domain and reports changes on the next run. The first run creates the baseline.
registrarLookup	boolean	true	Query the registrar's RDAP for owner organisation/country (gTLDs).
whoisFallback	boolean	true	Use port-43 WHOIS when a TLD has no RDAP or its RDAP server is down.
maxDomains	integer	1000	Safety cap per run.

Monitoring example:

{
  "domains": ["google.com", "https://www.bbc.co.uk/news", "info@claude.ai", "nic.it", "denic.de"],
  "expiryWarningDays": 60,
  "outputFilter": "alerts_only",
  "trackChanges": true
}

Availability sweep example:

{
  "names": ["lumora", "brightfield"],
  "tlds": ["com", "io", "ai", "co", "app"],
  "outputFilter": "available_only",
  "trackChanges": false
}

Output

One dataset item per domain. Example (real data, shortened):

{
  "domain": "google.com",
  "domainUnicode": "google.com",
  "input": "google.com",
  "tld": "com",
  "lookupStatus": "registered",
  "isRegistered": true,
  "source": "rdap",
  "registrar": "MarkMonitor Inc.",
  "registrarIanaId": "292",
  "registrarAbuseEmail": "abusecomplaints@markmonitor.com",
  "registrantOrganization": "Google LLC",
  "registrantCountry": "US",
  "registrantPrivacy": "public",
  "createdAt": "1997-09-15T04:00:00.000Z",
  "updatedAt": "2019-09-09T15:39:04.000Z",
  "expiresAt": "2028-09-14T04:00:00.000Z",
  "daysUntilExpiry": 715,
  "expiryStatus": "ok",
  "domainAgeDays": 10606,
  "statusCodes": ["clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited",
                  "serverDeleteProhibited", "serverTransferProhibited", "serverUpdateProhibited"],
  "transferLocked": true,
  "onHold": false,
  "pendingDelete": false,
  "dnssecSigned": false,
  "nameservers": ["ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com"],
  "dnsProvider": "Google",
  "riskFlags": ["dnssec_unsigned"],
  "isAlert": false,
  "changes": [],
  "previousCheckAt": "2026-09-22T14:10:20.797Z",
  "notes": [],
  "sourceUrl": "https://rdap.verisign.com/com/v1/domain/google.com",
  "error": null,
  "checkedAt": "2026-09-29T14:10:37.236Z"
}

lookupStatus is one of registered, available, unsupported_tld, invalid_input or error. registrantPrivacy is public, redacted, proxy or null (unknown). When something changed since the previous run, changes lists it field by field, for example {"field": "registrar", "previous": "Old Registrar LLC", "current": "MarkMonitor Inc."}.

The key-value store record SUMMARY holds counts per status, the expiring domains sorted by days left, expired and available domains, all alerts with their changes, and failed lookups with the reason. The dataset has three views: Expiry overview, Registration details and Changes since previous run.

What each registry publishes (tested live on google.

Coverage depends on what the registry itself makes public. The Actor never guesses: missing values are null, with a note explaining why.

TLDs	Source	Expiry date	Owner organisation
.com .net .org .info .xyz .ai .tv .cc .app .dev and other gTLDs	RDAP + registrar RDAP	yes	yes, unless redacted or proxied
.ca .fr .pl .in .sg .fi .si .cz .com.ar	RDAP	yes	varies (.ca, .fr, .pl often yes)
.uk	RDAP	yes	redacted
.nl .no .com.au	RDAP	no	.nl redacted
.io .co .me .us .it .se .dk .sk .ee .lt .hr .jp .tr .pt .cl .com.mx .com.tw .com.co	WHOIS	yes	varies (.io, .me, .us, .it, .jp, .cl often yes)
.de .eu .be .at .ro .bg .lv .hu .ae .co.nz .co.il	WHOIS	no	.lv, .ae yes for companies
.ch .li .es .gr .co.za	none	–	Returned as unsupported_tld (free).

A few registries (for example .ru, .cn, .com.hk, .co.kr, .com.br, .co.id) only answer some networks. If they are unreachable from the Apify platform, the domain comes back as error with the reason, free of charge.

Use cases

• Domain portfolio management: never lose a domain to a missed renewal. Schedule weekly with alerts_only and get only what is expiring, in auto-renew grace or changed.
• Brand protection: watch look-alike domains and get alerted when one is newly registered, changes owner or nameservers, or drops. Sweep a new brand name across TLDs before launch.
• Security and fraud triage: flag newly registered domains (newly_registered, domainAgeDays), find the registrar abuse contact, and detect a removed transfer lock or a registrar change on your own domains.
• Sales and market intelligence: registrant organisation, registrar and DNS provider (Cloudflare, Route 53, Azure, Shopify, Wix, ...) for a list of company domains.
• M&A, KYB and vendor due diligence: ownership, registration age, registrar and lock status.
• Domain investing: check availability, parked domains and pending-delete status in bulk.

Integrations and scheduling

Create a task with outputFilter: alerts_only, schedule it (for example weekly), and attach an Apify integration (e-mail, Slack, webhook, Zapier or Make) that fires when the run succeeds. You then only get a message with items when a domain needs attention. The SUMMARY record is a compact JSON for dashboards.

Pricing

Pay per event: $0.002 per domain result ($2 per 1,000 domains), with no start fee. The registrar owner lookup, the WHOIS fallback and the email security checks are included in that price. You only pay for successful lookups (registered or available). Errors, unsupported TLDs and invalid input are free. With alerts_only or available_only you only pay for the results you receive. A weekly check of 100 domains costs at most $0.87 per month ($0.20 per run), and less in alerts-only mode.

Legal

The Actor only uses the official, public RDAP and WHOIS services of registries and registrars, which are designed for automated queries (RFC 9082/9083), plus Google's public DNS-over-HTTPS endpoint for mail records. It keeps request rates modest per server and does not work around blocks. Personal data is kept out on purpose: of the registrant, only the organisation name and country are returned. Names, e-mail addresses, phone numbers and street addresses are never output, even when a registry publishes them. Registrar abuse addresses are role contacts of the registrar company.

The email section reads only DNS records: MX hosts, SPF, DMARC, DKIM selectors and transport-security records. It reports no mailbox addresses and enumerates no subdomains; DKIM selectors are probed by name, not discovered by crawling. mailProvider and spfThirdPartySenders name the service a domain uses (Google Workspace, Proofpoint, Mailchimp, ...), which is public infrastructure information and the signal the lead-gen use case is after. You remain responsible for how you use the results, including each registry's terms of use.

FAQ

Why is expiresAt empty for my .nl / .de / .eu domain? Those registries do not publish expiry dates publicly. Domains in these TLDs renew automatically through the registrar, so ask your registrar for the renewal date. The record still shows registration status, registrar (where published), status and nameservers.

What does auto_renew_grace mean? The domain passed its expiry date and the registry renewed it automatically, but the registrar can still delete it during the grace period (usually up to 45 days) if the renewal is not paid. The new expiresAt can then be misleading, which is why this is an alert.

Why is the owner shown for google.com but not for my domain? Most registrars redact individual registrants under GDPR, and many domains use a privacy/proxy service (registrantPrivacy: proxy). Company registrations at corporate registrars are often public.

What is the difference between WHOIS and RDAP? RDAP is the modern, standardised JSON replacement for WHOIS. ICANN made it mandatory for gTLDs and retired port-43 WHOIS for them in 2025. This Actor prefers RDAP and uses WHOIS only as a fallback.

Does available mean I can register the domain? It means the registry has no registration for it. Some names are still reserved or blocked by the registry, so a registrar may refuse them. Premium pricing is not checked.

Does dkimPresent: false mean the domain does not sign its mail? No, and the output says so too: DKIM keys are published under a selector name chosen by the sender, so this Actor probes the common ones (google, selector1, selector2, k2, mail, default, k1 in basic; 22 selectors in full) and reports dkimSelectorsChecked. A custom selector such as 20230601 will not be found. dkim_unknown in riskFlags means exactly that: not found, not absent.

Why is mailProvider empty for some domains? Because the MX host is not in the table of known mail providers. Rather than guessing from a hostname that looks familiar, the field stays null and mxHosts still shows the real MX hosts.

Why does mtaSts say unknown? Because in emailSecurity: "basic" those records are not requested at all. absent would claim "we looked and it is not there", unknown says "we did not look". The same applies when a DNS lookup fails: a timed-out read is unknown and never absent, and it never turns into a security finding or a change alert.

What does +all in SPF mean, and why is it flagged? +all authorises any host in the world to send mail as the domain, which disables the protection SPF is there for. ~all (soft fail, Google's recommendation) is normal practice; it is recorded as spf_softfail but is not an alert. -all (hard fail) scores highest.

Why is there no DMARC record for some of my domains? dmarc_missing means the _dmarc DNS name does not exist. Some registrars only add it when a mail provider sets it up. If the DNS lookup itself failed, the record says "DMARC could not be read" instead of claiming the record is missing.

How does change tracking work? With trackChanges on, a snapshot per domain is stored in a named key-value store. The next run compares registration status, registrar, owner organisation, expiry date, significant status codes, nameservers and DNSSEC. The first run is the baseline (changes: null).

Can I check thousands of domains? Yes. Requests are spread across registries with a small delay per server. Raise maxDomains if you need more than 1,000 per run.

Why do I see dnssec_unsigned on big-brand domains? Most domains are not DNSSEC-signed. It is an informational flag, not an alert.

Related Actors

• Website Screenshot Monitor: visual change monitoring for the websites behind your domains.
• Brand Mention News Monitor: pair it with domain monitoring for brand protection.
• Container CVE Matcher: more security tooling for your infrastructure.
• URL to Structured Fact: verify a URL's institution type and domain registration age before citing it — the per-URL source-verification counterpart to this bulk monitor.

Keywords

whois lookup, bulk whois, rdap lookup, domain owner lookup, domain expiry checker, domain expiration monitor, domain expiry alert, domain availability checker, brand name availability, registrar lookup, domain age checker, nameserver lookup, dns provider lookup, dnssec check, domain portfolio monitoring, brand protection, newly registered domains, epp status codes, spf check, spf record, dmarc check, dmarc record, dmarc policy, dkim check, dkim selector, mx lookup, mx records, mail provider lookup, email security check, email deliverability, mail authentication, email security audit, mta-sts, tls-rpt, bimi, domeinbeheer, domeinverval, e-mailbeveiliging, spf-controle, dmarc-beleid

Changelog

0.3.0

• Bugfix: a failed DNS lookup no longer invents security alerts. spf_present, mxHosts, dmarcPolicy and dkimSelectors are only written to the comparison baseline when the DNS read that produced them actually answered; a timeout keeps the previous baseline instead of reporting spf_removed, mx_changed and dkim_removed.
• emailSecurity: "basic" now reports MTA-STS, TLS-RPT and BIMI as unknown (not checked) instead of absent, and says so in findings. A failed DKIM probe says "could not be read" instead of claiming every selector was checked.
• Errors from the MTA-STS/TLS-RPT/BIMI lookups are now collected in dnsErrors rather than silently reading as "not enforced".
• Performance: the MX, TXT and DMARC reads now run in parallel (they were sequential); DKIM selectors stay sequential so a bulk run does not burst 20+ simultaneous queries for one domain.
• allMailProviders is new and lists every configured provider with the highest-priority one first.

0.2.0

• Email security per domain, read from DNS (Google's public DNS-over-HTTPS endpoint, keyless): MX hosts and mail provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Amazon SES, ...), SPF with its all policy and the senders it authorises, DMARC with policy/subdomain policy/percentage, DKIM probed over 7 (or 22) common selectors, plus MTA-STS, TLS-RPT and BIMI in full mode.
• 0-100 authentication score with letter grade and plain-language findings; +all, more than 10 SPF lookups and p=none are surfaced as findings rather than quietly scored.
• Mail change detection: mx_changed, mail_provider_changed, spf_removed, dmarc_policy_changed, dmarc_weakened and dkim_removed, of which the downgrades become alerts. A DNS failure keeps the previous baseline instead of reporting everything as removed.
• New emailSecurity input (off / basic / full, default basic) and a new Email security view in the Output tab. Mail data is part of the existing domain-result event: no price change.
• Honest limits: DKIM selectors are probed by name (a custom selector is not found), an unknown mail provider stays null instead of being guessed, and a failed DNS lookup is reported as a failed lookup.

0.1.0

• First release: RDAP via the IANA bootstrap plus the registrar's RDAP for owner organisation/country, and a WHOIS fallback tested on 30+ registry formats (also used when an RDAP server is down).
• Expiry status, risk flags, DNS provider detection, and change tracking between runs with noise suppression.
• Output modes all, alerts_only and available_only, brand-name availability sweep, and a run summary.