Bulk Domain Expiry, SSL & DNS Checker

Bulk domain expiry checker and SSL certificate expiry checker in one run: paste up to 5,000 domains or URLs and get one report per host with the domain expiration date and registrar (from RDAP, the modern WHOIS replacement), SSL certificate validity and days left, DNS records (A, AAAA, MX, NS, TXT, CAA) and SPF / DMARC email security. No API keys, browsers or proxies. Schedule it daily and send the warnings to Slack, email or a webhook so no domain or certificate expires by surprise.

• Domain expiration date and days left, registrar, registration date, status, nameservers and DNSSEC via RDAP
• SSL certificate check: chain and hostname verification, expiry date and days left, issuer, SANs, TLS version
• Bulk DNS lookup over DNS-over-HTTPS, plus SPF and DMARC policy checks
• Short warning codes (domain_expires_soon, ssl_expired, no_dmarc …) ready for alerts

What can I use this bulk domain checker for?

• Agencies and freelancers: audit every client domain for upcoming domain renewals and SSL expiry in one table.
• IT teams and MSPs: schedule daily certificate and renewal checks and alert on the warning codes.
• Email deliverability: find domains without SPF, without DMARC or with p=none.
• Domain portfolios and SEO: see registrar, expiry and DNS for hundreds of domains at once, and spot names that are not registered (rdapError: domain_not_found).

How much does it cost to check domains in bulk?

This Actor is priced per result: $1.50 per 1,000 domains saved to the dataset ($0.0015 per domain), plus an Actor start fee of $0.00005 per run. Apify platform usage is included in that price, so you do not pay separately for compute.

Example run	Domains	Cost
Daily check of 20 client domains	20	about $0.03 per run, about $0.90 per month if run daily
One-off audit of 1,000 domains	1,000	about $1.50
Maximum batch	5,000	about $7.50

Duplicates and invalid lines are skipped and not billed. Set a maximum cost per run in the run options: the Actor stops cleanly when the limit is reached. The price shown on the Pricing tab of this page is the one that applies.

Input

Field	Default	Description
domains	Required	1–5,000 strings: bare domains or HTTP(S) URLs
checkRdap	true	Registration data from RDAP
checkSsl	true	Verified TLS connection on port 443
checkDns	true	Query selected DNS records
dnsRecordTypes	A, AAAA, MX, NS, TXT, CAA	Also supports CNAME, SOA, PTR, SRV
checkEmailSecurity	true	SPF at apex and DMARC at _dmarc
expiryWarningDays	30	1–365 days
maxConcurrency	5	1–20 concurrent domains
timeoutSecs	15	1–120 seconds per request/connection attempt

{"domains":["apify.com","https://www.example.com/page"],"expiryWarningDays":30,"maxConcurrency":5}

Hosts are lowercased, IDNA-encoded, stripped of scheme/path/port and deduplicated by host. The first original value is retained. SSL/DNS use that host (including www); RDAP and email security use its registrable apex via the bundled public suffix list (registry rules, not private hosting suffixes). For example, expired.badssl.com checks registration of badssl.com. Values that are not valid domains or HTTP(S) URLs are skipped (and listed in the run log) without being billed; the run fails only if no valid domain remains.

Output

One dataset item per unique host, pushed as soon as it is ready. Full live examples are in tests/sample_output.json.

{"domain":"example.com","inputValue":"example.com","checkedAt":"2026-11-04T07:23:09Z","registrar":"RESERVED-Internet Assigned Numbers Authority","expirationDate":null,"daysUntilDomainExpiry":null,"sslValid":true,"sslError":null,"sslNotAfter":"2026-12-25T22:56:35Z","hasSpf":true,"hasDmarc":true,"dmarcPolicy":"reject","warnings":[],"status":"ok"}

Example above is abbreviated; every actual item contains all stable keys below (unknown or disabled values are null).

Fields	Meaning
domain, inputValue, checkedAt	Normalized checked host, first input, UTC timestamp
registrar	Registrar company only; no contact entities
registrationDate, expirationDate, lastChangedDate	UTC RDAP events
daysUntilDomainExpiry	Floor of remaining days; null if expiry is unavailable
domainStatus, nameservers, dnssecSigned, rdapError	RDAP statuses, lowercase servers, delegation signing, retrieval error: no_rdap_server (the TLD has no public RDAP service), domain_not_found (the registry has no such domain, so it is not registered), rdap_failed: …
sslValid, sslError	Chain/hostname verified; false on certificate rejection, null on connection failure
sslIssuer, sslSubject, sslSans	Issuer O/CN, subject CN, DNS SANs capped at 100
sslNotBefore, sslNotAfter, daysUntilSslExpiry, sslTlsVersion	Certificate dates, remaining days and negotiated TLS
dns	Type → answer list; empty means no records, null type means failed query
hasSpf, spfRecord	Apex SPF presence and first record
hasDmarc, dmarcPolicy, dmarcRecord	DMARC presence, recognized policy and first record
warnings	domain_expired, domain_expires_soon, domain_expiry_unknown, ssl_expired, ssl_expires_soon, ssl_invalid, no_mx, no_spf, no_dmarc, dmarc_policy_none
status	ok, warning, or error (retrieval failures); warnings still retained on error
error, errorMessage	Optional short per-input DNS/email/unexpected error; other domains continue

Mailbox addresses in TXT/DMARC and diagnostic strings are redacted as [redacted-email]. Records are otherwise preserved. Disabled checks remain null, including dependent expiry counters. no_mx is emitted only when MX was requested and returned no answers.

Billing details

One unique host is one billed result, including a useful partial/error report. Duplicates are not billed again, and invalid input lines are skipped for free. Set a maximum cost per run in the run options: the Actor stops normally when that limit is reached; in-flight checks may complete without being pushed.

Tips / limits

• Retry public endpoints up to three attempts with exponential backoff and respect Retry-After on 429/5xx. Google DNS is the fallback for failed Cloudflare requests.
• Which TLDs have expiry dates? All gTLDs (.com, .net, .org, .app, .dev, .xyz, .shop and other new gTLDs) plus the ccTLDs that publish RDAP, such as .uk, .fr, .ca, .in, .br, .kr, .tv, .ai. Popular ccTLDs missing from the IANA list are covered by their registries' official RDAP services: .io, .co, .me, .so, .sh, .ac, .ag, .bz, .lc, .mn, .vc, .gi.
• Some ccTLDs are not in the IANA RDAP list and have no public RDAP service we could verify (in November 2026 for example .de, .jp, .cn, .ru, .eu, .ch, .it, .es, .se, .dk, .at, .be, .us, .edu): rdapError is no_rdap_server and the status is error, while SSL, DNS and email checks still run. No WHOIS fallback is used.
• Some registries answer RDAP but do not publish an expiry date (for example .nl, .au, .pl): the item gets the domain_expiry_unknown warning instead of a silent ok. RDAP expiry is the registry date, which can differ from the renewal date shown by your registrar.
• Non-verifying TLS reconnect is used only after certificate verification rejection to obtain certificate dates; it never changes sslValid to true. Network failures may prevent certificate capture.
• SPF/DMARC checks detect records, not full SPF expansion, mail delivery, syntax compliance or effective organizational inheritance. Null MX (0 .) is preserved; multiple SPF/DMARC records require manual review.
• DNS records and certificate metadata are public infrastructure data. Do not submit URLs containing credentials or personal information. Hostnames are intended to be public; this is not a port scanner.

FAQ

Is this a WHOIS lookup?

It uses RDAP, the registry-run successor to WHOIS. RDAP returns structured registration and expiry dates, so nothing is scraped from WHOIS text. Contact details of registrants are never output, only the registrar company name.

How many domains can I check in one run?

Up to 5,000 domains or URLs. Hosts are normalized (scheme, path and port removed) and deduplicated; invalid lines are skipped without being billed.

Can I get alerts before a domain or SSL certificate expires?

Yes. Schedule the Actor daily in Apify, set expiryWarningDays (default 30), and filter rows whose warnings contain domain_expires_soon, ssl_expires_soon, domain_expired or ssl_expired. Send them to Slack, email or a webhook with Apify integrations.

Why is the status error for my .de / .jp domain?

Those registries are not in the IANA RDAP list and we found no public RDAP service for them, so the registration part cannot be checked (rdapError: no_rdap_server). The SSL, DNS and SPF/DMARC results in the same row are still valid.

Can I check only SSL, only DNS or only SPF/DMARC?

Yes. Turn the other checks off (checkRdap, checkSsl, checkDns, checkEmailSecurity); disabled fields stay null and the run is faster.

Can an AI agent call it?

Yes. It is a regular Apify Actor, so agents can run it through the Apify API or Apify's MCP server with an input like {"domains": ["example.com"]}.

Compliance & data source

Only official public endpoints: IANA RDAP bootstrap, registry RDAP services it advertises (plus the official registry RDAP services listed above for ccTLDs missing from it), Cloudflare DoH, Google DNS, and direct TLS on the supplied host. Descriptive Echo Lab User-Agent, bounded concurrency, no login/cookies/CAPTCHA bypass. Registrant/admin/technical contact entities and their vcards are never output; only the registrar company name is retained. Mailbox addresses are redacted. Users are responsible for complying with source terms and monitoring domains they are authorized to check.

Local development

UV_CACHE_DIR=/tmp/uvc uv pip install -p /tmp/apy/.venv -r requirements.txt pytest
/tmp/apy/.venv/bin/python -m pytest -q
APIFY_LOCAL_STORAGE_DIR=./storage /tmp/apy/.venv/bin/python -m src

Place input in storage/key_value_stores/default/INPUT.json. Storage is ignored by Git and Docker. Fixtures are minimized official responses with synthetic substitutions for deterministic assertions and contact-leak regression tests; certificate tests generate an expired DER certificate offline.

Support

Open an issue on the Actor's Issues tab.

More real output, worked pricing examples and a comparison with alternatives: https://echolab-tools.pages.dev/bulk-domain-expiry-ssl-checker/