Domain Inspector

A domain's answers are scattered across four unrelated protocols: DNS for the records, RDAP for the registration, the TLS handshake on port 443 for the certificate, and plain HTTP for everything else. This asks all four. Paste up to 500 hostnames, get one row back per domain.

It's one pass. DNS, registration, HTTP behaviour, TLS and the rest all land on the same row, so there are no separate exports to line up afterwards.

What it checks

• DNS — A, AAAA, MX, NS, TXT and CAA records.
• Registration (RDAP) — registrar, registration and expiry dates, status codes, nameservers.
• HTTP and HTTPS — status on both, the full redirect chain with each hop, final URL, page title and meta description.
• TLS — validity dates, issuer, subject, SANs, fingerprint, and whether Node trusts the chain.
• Security headers — HSTS, CSP, X-Frame-Options and the rest of the usual set.
• robots.txt and sitemap.xml — present or not, status, and the sitemaps robots.txt points to.
• Technologies — framework and server signals read from the HTML and response headers.

What you get

Trimmed, because a full row is long:

{
  "domain": "stripe.com",
  "inspectedAt": "2026-08-21T13:14:39.740Z",
  "httpsStatus": 200,
  "httpStatus": 200,
  "title": "Stripe | Financial Infrastructure to Grow Your Revenue",
  "dnsA": ["198.137.150.111", "198.202.176.111"],
  "dnsAAAA": [],
  "tlsExpiresAt": "2026-11-12T23:59:59.000Z",
  "registrationExpiresAt": "2027-09-11T04:00:00.000Z",
  "technologies": ["Next.js", "Server: nginx"],
  "warningsCount": 0,
  "dns": {
    "a": ["198.137.150.111"],
    "mx": [
      { "exchange": "aspmx.l.google.com", "priority": 10 },
      { "exchange": "alt1.aspmx.l.google.com", "priority": 20 }
    ],
    "ns": ["ns-1087.awsdns-07.org", "ns-423.awsdns-52.com"],
    "txt": ["google-site-verification=hPfjsDwiisKJ4RP1ExOst9gAOD_0P8Q7-kxdcKUvEcc", "..."]
  },
  "redirects": [],
  "securityHeaders": { "strict-transport-security": "max-age=63072000" },
  "robots": { "present": true, "status": 200, "sitemaps": ["https://stripe.com/sitemap/sitemap.xml"] },
  "sitemap": { "present": true, "status": 200 },
  "warnings": []
}

The row is deliberately flat at the top and nested underneath. dnsA, tlsExpiresAt, registrationExpiresAt, warningsCount and title sit at the top level so a CSV export is immediately sortable. You can find every certificate expiring in the next 30 days without opening the nested objects. The full detail is still there in dns, tls, securityHeaders and redirects when you need it.

warnings is an array of plain sentences about what looked wrong: RDAP that returned nothing, DNS records that don't make sense, addresses that were blocked as non-public. warningsCount is there so you can sort by it and read the worst domains first.

A TXT record list can run to dozens of entries on a large company, mostly vendor verification tokens. Useful if you're working out which SaaS a company buys. Noise otherwise.

Input

{
  "domains": ["stripe.com", "https://example.com/pricing", "github.com"],
  "maxConcurrency": 5
}

URLs get reduced to their hostname, so pasting a column of page URLs is fine. Duplicates are removed.

• domains — up to 500 per run.
• domain — single-domain shortcut, combined with the list.
• maxConcurrency — default 5, ceiling 20. Keep it modest; DNS resolvers and target sites rate-limit.
• requestTimeoutSecs — default 8, ceiling 20. Applies to each DNS, RDAP, HTTP or TLS operation, and there's a hard per-domain deadline as well.
• maxRedirects — default 5, ceiling 10.
• checkRdap, checkWeb, checkTls, checkRobotsAndSitemap — all on by default. Turn off what you don't need and the run gets faster. The price is the same either way, so only do it for speed.

Limits

• 500 domains per run.
• RDAP coverage varies by registry. Most gTLDs are fine. Plenty of country-code TLDs publish little or nothing, and some publish no dates at all. You get a warning rather than a guess.
• No JavaScript. Title, meta and technology detection come from the served HTML. A site that renders its title client-side won't give you one.
• Non-public addresses (private ranges, loopback) are blocked on purpose, and a domain resolving only to those gets its web and TLS checks skipped with a warning saying so.
• Technology detection reads headers and HTML signals. It finds obvious things like the framework and server. It is not a full fingerprinting suite.
• A parked or dead domain still returns a row with DNS and RDAP populated and the web fields empty. That's a useful answer, and it is charged.

Proxy

Off by default. Public domain checks don't need one, and proxy bandwidth would eat into what you're paying. When enabled it's used only for HTTP/HTTPS, robots.txt and sitemap.xml. DNS, RDAP and TLS always connect directly, since those aren't HTTP and there's nothing to route.

Billing

$1.50 per 1,000 domains, and there is no run-start fee.

One charge per domain inspected, regardless of how many of the checks you left on or how many records come back. A domain that fails to inspect isn't charged. 500 domains, the maximum run, costs 75 cents.