Domain Inspector

Inspect up to 500 domains in one run and receive one consolidated row per domain. The actor combines DNS, RDAP, HTTP, HTTPS, TLS, security, discovery, and basic technology data without requiring an API key or a proxy.

What it checks

• DNS: A, AAAA, MX, NS, TXT, and CAA records
• Registration: RDAP handle, registrar, statuses, registration, update, and expiration dates
• Web: HTTP and HTTPS status, redirect chain, final URL, title, description, canonical URL, language, Open Graph metadata, and response headers
• TLS: subject, issuer, SANs, valid-from and valid-to dates, days until expiry, fingerprints, protocol, and trust result
• Security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, and CORP
• Discovery: standard robots.txt and sitemap.xml presence plus sitemap URLs declared in robots.txt
• Technology signals: common CMS, frameworks, analytics, CDN, hosting, and server hints visible in public headers or HTML

The result is designed for domain due diligence, lead enrichment, portfolio monitoring, security triage, SEO checks, and dataset enrichment.

Why use this actor

• One row per domain instead of separate DNS, certificate, and page datasets
• Batch input with bounded concurrency and strict operation timeouts
• Direct connections by default, so normal runs avoid residential proxy bandwidth
• Private, loopback, link-local, reserved, test, and internal destinations are blocked
• Redirect destinations are resolved and checked before every request
• Partial failures keep all useful data and add precise warnings
• Totally failed domains return uncharged diagnostics instead of failing the run
• Empty input returns one clearly labeled, uncharged sample row for Store previews and automated checks

Input

Field	Default	Description
domains	empty	Up to 500 domains or public HTTP(S) URLs. URLs are reduced to hostnames and duplicates are removed.
domain	empty	Optional single-domain shortcut, combined with domains.
maxConcurrency	5	Domains inspected at once, from 1 to 20.
requestTimeoutSecs	8	Timeout for each network operation, from 3 to 20 seconds.
maxRedirects	5	Redirects followed for each web request, from 0 to 10.
checkRdap	true	Include public RDAP registration data.
checkWeb	true	Include HTTP and HTTPS checks, metadata, headers, and technology signals.
checkTls	true	Include the port 443 certificate check.
checkRobotsAndSitemap	true	Check standard discovery files on the best working origin.
proxyConfiguration	off	Optional proxy for web requests only. DNS, RDAP, and TLS remain direct.

Example:

{
  "domains": [
    "example.com",
    "https://apify.com/store"
  ],
  "maxConcurrency": 5,
  "requestTimeoutSecs": 8,
  "checkRdap": true,
  "checkWeb": true,
  "checkTls": true,
  "checkRobotsAndSitemap": true,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}

Output

Successful records have ok: true and contain both flat summary fields for the dataset view and detailed nested objects:

{
  "ok": true,
  "domain": "example.com",
  "inspectedAt": "2026-07-25T15:00:00.000Z",
  "httpsStatus": 200,
  "httpStatus": 301,
  "title": "Example Domain",
  "dnsA": ["93.184.216.34"],
  "tlsExpiresAt": "2027-01-15T23:59:59.000Z",
  "registrationExpiresAt": "2026-08-13T04:00:00.000Z",
  "technologies": ["IANA"],
  "warningsCount": 0,
  "dns": {
    "a": ["93.184.216.34"],
    "aaaa": [],
    "mx": [],
    "ns": ["a.iana-servers.net", "b.iana-servers.net"],
    "txt": [],
    "caa": []
  },
  "rdap": {
    "available": true,
    "handle": "2336799_DOMAIN_COM-VRSN",
    "statuses": ["client delete prohibited"],
    "registeredAt": "1995-08-14T04:00:00.000Z",
    "expiresAt": "2026-08-13T04:00:00.000Z"
  },
  "http": {
    "status": 301,
    "finalUrl": "https://example.com/",
    "redirects": []
  },
  "https": {
    "status": 200,
    "finalUrl": "https://example.com/",
    "metadata": {
      "title": "Example Domain",
      "description": null,
      "canonicalUrl": null
    },
    "securityHeaders": {
      "present": [],
      "missing": ["strict-transport-security"]
    }
  },
  "tls": {
    "available": true,
    "authorized": true,
    "expiresAt": "2027-01-15T23:59:59.000Z",
    "daysUntilExpiry": 174
  },
  "robots": {
    "present": true,
    "status": 200
  },
  "sitemap": {
    "present": false,
    "status": 404
  },
  "warnings": []
}

Fields unavailable for a specific TLD, host, protocol, or certificate remain empty or null. A domain is still successful when at least one requested subsystem returns useful public data. Warnings explain every requested subsystem that could not be completed.

Invalid or totally failed domains return ok: false, an errorCode, and warnings. These rows are diagnostics and are not charged.

Charging and planned Store price

The actor calls the pay-per-event event domain exactly once after each successful result row is saved. Sample rows and diagnostic rows never call the event.

The intended Store price is $0.0015 per successful domain, below the compared marketplace price of $0.002 per domain. At 1,000 successful domains that is $1.50 gross customer spend. Proxy is off by default because residential bandwidth would reduce or remove this margin. Before publishing, confirm the final Apify platform fee and run-cost benchmark with representative batches, then configure the domain event price in the Console.

Proxy guidance

No proxy is needed for normal DNS, RDAP, TLS, or public-site checks. Enable a proxy only when a target site blocks Apify datacenter traffic and the additional result value justifies the bandwidth cost.

When enabled, the proxy is used only for HTTP and HTTPS page, robots.txt, and sitemap.xml requests. The actor still resolves every target and redirect locally first and rejects non-public addresses. DNS, RDAP, and TLS never use the proxy.

Safety and limits

• Inputs must normalize to a public domain with at least two labels.
• IP literals and internal suffixes such as .local, .internal, .test, and .localhost are rejected.
• DNS answers containing private, loopback, link-local, reserved, documentation, or other non-global IP addresses are blocked from web and TLS connections.
• Direct web connections are pinned to a checked public DNS answer to reduce DNS-rebinding risk.
• HTTP is restricted to port 80 and HTTPS to port 443, including redirects.
• HTML reads are capped, redirect counts are bounded, and every operation has a timeout.
• This actor reports public technical metadata. It does not scan ports, bypass authentication, or access private networks.

Run locally

npm ci
npm test
npm run test:live
npm start

The live smoke test uses example.com and requires outbound DNS and HTTPS access. npm start with no local input writes one uncharged sample record to the default local dataset.