Domain Inspector

Inspect up to 500 domains in one run and receive one consolidated row per domain. The actor combines DNS, RDAP, HTTP, HTTPS, TLS, security, discovery, and basic technology data without requiring an API key or a proxy.

What it checks

• DNS: A, AAAA, MX, NS, TXT, and CAA records
• Registration: RDAP handle, registrar, statuses, registration, update, and expiration dates
• Web: HTTP and HTTPS status, redirect chain, final URL, title, description, canonical URL, language, Open Graph metadata, and response headers
• TLS: subject, issuer, SANs, valid-from and valid-to dates, days until expiry, fingerprints, protocol, and trust result
• Security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, and CORP
• Discovery: standard robots.txt and sitemap.xml presence plus sitemap URLs declared in robots.txt
• Technology signals: common CMS, frameworks, analytics, CDN, hosting, and server hints visible in public headers or HTML

The result is designed for domain due diligence, lead enrichment, portfolio monitoring, security triage, SEO checks, and dataset enrichment.

Why use this actor

• One row per domain instead of separate DNS, certificate, and page datasets
• Batch input with bounded concurrency and strict operation timeouts
• Direct connections by default, so normal runs avoid residential proxy bandwidth
• Private, loopback, link-local, reserved, test, and internal destinations are blocked
• Redirect destinations are resolved and checked before every request
• Partial failures keep all useful data and add precise warnings
• Totally failed domains return uncharged diagnostics instead of failing the run
• Empty input returns one clearly labeled, uncharged sample row for Store previews and automated checks

Input

Field	Default	Description
domains	empty	Up to 500 domains or public HTTP(S) URLs. URLs are reduced to hostnames and duplicates are removed.
domain	empty	Optional single-domain shortcut, combined with domains.
maxConcurrency	5	Domains inspected at once, from 1 to 20.
requestTimeoutSecs	8	Timeout for each network operation, from 3 to 20 seconds.
maxRedirects	5	Redirects followed for each web request, from 0 to 10.
checkRdap	true	Include public RDAP registration data.
checkWeb	true	Include HTTP and HTTPS checks, metadata, headers, and technology signals.
checkTls	true	Include the port 443 certificate check.
checkRobotsAndSitemap	true	Check standard discovery files on the best working origin.
proxyConfiguration	off	Optional proxy for web requests only. DNS, RDAP, and TLS remain direct.

Example:

{
  "domains": [
    "example.com",
    "https://apify.com/store"
  ],
  "maxConcurrency": 5,
  "requestTimeoutSecs": 8,
  "checkRdap": true,
  "checkWeb": true,
  "checkTls": true,
  "checkRobotsAndSitemap": true,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}

Output

Successful records have ok: true and contain both flat summary fields for the dataset view and detailed nested objects:

{
  "ok": true,
  "domain": "example.com",
  "inspectedAt": "2026-07-25T15:00:00.000Z",
  "httpsStatus": 200,
  "httpStatus": 301,
  "title": "Example Domain",
  "dnsA": ["93.184.216.34"],
  "tlsExpiresAt": "2027-01-15T23:59:59.000Z",
  "registrationExpiresAt": "2026-08-13T04:00:00.000Z",
  "technologies": ["IANA"],
  "warningsCount": 0,
  "dns": {
    "a": ["93.184.216.34"],
    "aaaa": [],
    "mx": [],
    "ns": ["a.iana-servers.net", "b.iana-servers.net"],
    "txt": [],
    "caa": []
  },
  "rdap": {
    "available": true,
    "handle": "2336799_DOMAIN_COM-VRSN",
    "statuses": ["client delete prohibited"],
    "registeredAt": "1995-08-14T04:00:00.000Z",
    "expiresAt": "2026-08-13T04:00:00.000Z"
  },
  "http": {
    "status": 301,
    "finalUrl": "https://example.com/",
    "redirects": []
  },
  "https": {
    "status": 200,
    "finalUrl": "https://example.com/",
    "metadata": {
      "title": "Example Domain",
      "description": null,
      "canonicalUrl": null
    },
    "securityHeaders": {
      "present": [],
      "missing": ["strict-transport-security"]
    }
  },
  "tls": {
    "available": true,
    "authorized": true,
    "expiresAt": "2027-01-15T23:59:59.000Z",
    "daysUntilExpiry": 174
  },
  "robots": {
    "present": true,
    "status": 200
  },
  "sitemap": {
    "present": false,
    "status": 404
  },
  "warnings": []
}

Fields unavailable for a specific TLD, host, protocol, or certificate remain empty or null. A domain is still successful when at least one requested subsystem returns useful public data. Warnings explain every requested subsystem that could not be completed.

Invalid or totally failed domains return ok: false, an errorCode, and warnings. These rows are diagnostics and are not charged.

Pricing

$1.50 per 1,000 domains ($0.0015 each), with no run-start fee. Flat rate — no volume tiers, no plan gates — and you are charged only for domains that actually return data.

The actor calls the pay-per-event event domain exactly once after each successful result row is saved. Sample rows and diagnostic rows never call the event. There is no second charge event: DNS, RDAP, HTTP/HTTPS, TLS, security headers, robots, sitemap and technology detection are all folded into that one $0.0015, so turning every subsystem on costs the same as turning one on. A domain that fails outright is a diagnostic row and is free.

Comparable domain and WHOIS actors generally cost more per 1,000, and several reserve their best rate for a top volume tier that a new account never sees. The $1.50 here applies on every plan including the free one, from the very first run, with no tier to unlock.

Proxy guidance

No proxy is needed for normal DNS, RDAP, TLS, or public-site checks. Enable a proxy only when a target site blocks Apify datacenter traffic and the additional result value justifies the bandwidth cost.

When enabled, the proxy is used only for HTTP and HTTPS page, robots.txt, and sitemap.xml requests. The actor still resolves every target and redirect locally first and rejects non-public addresses. DNS, RDAP, and TLS never use the proxy.

Safety and limits

• Inputs must normalize to a public domain with at least two labels.
• IP literals and internal suffixes such as .local, .internal, .test, and .localhost are rejected.
• DNS answers containing private, loopback, link-local, reserved, documentation, or other non-global IP addresses are blocked from web and TLS connections.
• Direct web connections are pinned to a checked public DNS answer to reduce DNS-rebinding risk.
• HTTP is restricted to port 80 and HTTPS to port 443, including redirects.
• HTML reads are capped, redirect counts are bounded, and every operation has a timeout.
• This actor reports public technical metadata. It does not scan ports, bypass authentication, or access private networks.

Trying it out

Run it with no input at all and it returns one clearly labelled, uncharged sample record so you can see the row shape before spending anything.