Domain Portfolio & Expiry Monitor

For a list of domains: when each one expires, who the registrar is, whether it is locked against transfer, whether it is DNSSEC-signed, and who hosts its DNS.

Whois is effectively dead — closed, redacted, and free-form text. RDAP replaced it (RFC 7483) and returns JSON. But there is no single RDAP server: there is one per registry, and you have to know which one to ask for which domain.

No API key. No account.

---

The three things this does that the source does not

1. It routes to the right registry.

IANA publishes a TLD → RDAP server table covering 1,200 TLDs. This Actor loads it and talks to each registry directly.

The obvious alternative is the public rdap.org proxy, and it is a trap:

Approach	Resolved	Rate limited
rdap.org proxy	7 of 23	16 (HTTP 429)
Direct to registries	16 of 22 in 10 seconds	0

The proxy starts refusing after about ten lookups. Routing yourself removes the bottleneck entirely, which is what makes a 500-domain portfolio practical.

2. Days until expiry, not a date.

The question is never "what is the expiry date". It is "how long have I got" — and a brand domain that lapses is a brand someone else can take. In a sample of well-known domains, one was 49 days from expiry.

3. Locks read, not quoted.

client transfer prohibited means the domain is protected against an unauthorised transfer. Its absence is an exposure. This Actor turns the EPP status strings into booleans you can filter and sort on: transferLocked, deleteLocked, updateLocked, pendingDelete, clientHold.

And it reads the DNS provider out of the nameservers — ns-1435.awsdns-51.org means AWS Route 53. Detected on 91.3% of resolved domains: Route 53, Cloudflare, Azure DNS, Google, Akamai, UltraDNS, Vercel, Alibaba Cloud and others.

---

Field coverage

Measured on a 28-domain international sample, 23 resolved.

Field	Coverage
createdAt, expiresAt, lastChangedAt	100%
daysUntilExpiry, domainAgeYears	100%
status, nameservers	100%
registrar	95.7%
registrarIanaId	91.3%
dnsProvider	91.3%

Two findings from the same sample, both worth knowing: 91.3% carried a transfer lock — but only 4.3% had DNSSEC enabled. Median domain age was 21.5 years.

---

What it is for

• Portfolio renewal. Sort by daysUntilExpiry. A lapsed brand domain is the cheapest disaster there is.
• Acquisition due diligence. Domain age, registrar, and whether the target actually locked its own names.
• Security review. transferLocked and dnssecEnabled across every domain you own, in one table.
• Infrastructure mapping. dnsProvider across a set of companies shows who runs their DNS — and who a competitor just migrated to, because lastChangedAt moves when nameservers do.
• Brand protection. Check lookalike domains for registration date and registrar.

Pairs directly with Subdomain Finder & Certificate Inventory: that one maps the hosts under a domain, this one covers the domain registration itself.

Three dataset views ship with the Actor: Portfolio, Exposure and Infrastructure.

---

Limits

Stated plainly, because they affect what you can conclude.

• Some country TLDs have no RDAP service at all. .de, .jp, .cn, .ru and .so among them — they still run whois only. Those domains come back with resolved: false and a note naming the reason, and are not charged. This matters: a silently missing row looks exactly like an available domain, and it is not one.
• Registrant contact details are gone. GDPR removed them from public RDAP almost everywhere. What survives is what this Actor returns: dates, registrar, status, nameservers. Do not expect an owner name.
• Some registries publish less than others. registro.br returns no registrar at all, because Brazilian domains are registered directly. The field is left empty rather than guessed.
• Query the registrable domain. www.example.com is normalised to example.com; a deeper subdomain has no registration record of its own and will not resolve.
• Expiry is the registry's date, not your renewal date. Auto-renew settings live with the registrar and are not published here.
• One request per domain. 500 domains is the per-run cap, paced to stay within what registries tolerate.

---

Source

RDAP servers operated by the domain registries, discovered through the IANA bootstrap registry. Public, no authentication. This Actor is not affiliated with IANA or with any registry.