Domain Intelligence: WHOIS, DNS, SPF and DMARC Check

Give it a list of domains. Get back one row each covering who registered it and when, where its DNS and mail point, and whether anyone can forge email from it.

Two jobs, one lookup. For sales it is firmographics: domain age, registrar, DNS host and whether a company runs Google Workspace or Microsoft 365. For security it is a spoofing audit: SPF, DKIM, DMARC and MTA-STS, with a plain verdict instead of a wall of raw records.

$3 per 1,000 domains. Unregistered domains are reported and never charged.

---

What you get for every domain

Registration

Field	Example
registrar	Amazon Registrar, Inc.
createdAt, expiresAt, updatedAt	2009-06-02T17:14:10+00:00
domainAgeDays	6277
expiresInDays	3219
isNewlyRegistered	false (under 90 days old)
isExpiringSoon	false (under 30 days left)
domainStatus	["client transfer prohibited"]
isDnssecSigned	true
registrantOrganization, registrantCountry	where the registry publishes them

DNS and mail

Field	Example
nameservers	["ns-1225.awsdns-25.org", ...]
dnsProvider	Amazon Route 53
aRecords	["76.76.21.21"]
hasMxRecord, mxHosts	true, ["aspmx.l.google.com"]
mailProvider	Google Workspace

Email authentication

Field	Example
emailSecurityGrade	A to F
spoofProtection	protected, partially_protected or spoofable
spoofReason	DMARC policy is reject
isSpoofable	false
spfRecord, spfPolicy, spfLookupCount	v=spf1 ... -all, fail, 4
dmarcRecord, dmarcPolicy, dmarcSubdomainPolicy, dmarcPercentage	reject, none, 100
dmarcReportsTo	["dmarc@northwind.co"]
hasDkim, dkimSelector	true, google
hasMtaSts	true
issues	["monitoring_only_policy"]

---

The spoofing verdict, and why SPF alone is not enough

The question worth answering is not "does this domain have SPF". It is "can somebody send mail as this domain and have it delivered".

SPF alone does not stop that. SPF tells a receiving server which hosts are allowed to send, and then says nothing about what to do when the check fails. DMARC is the part that instructs the receiver to reject. A domain with a perfect SPF record and no DMARC is still spoofable, and that combination is extremely common.

Verdict	When
protected	DMARC policy is reject, applied to all mail
partially_protected	DMARC is quarantine, or reject at less than 100%
spoofable	DMARC is missing, or present but set to none, which enforces nothing

spoofReason always says which of these applied, in a sentence you can paste into a report.

The issues array flags the specific problems worth fixing: monitoring_only_policy, no_aggregate_reporting, permissive_all_mechanism, too_many_dns_lookups, partial_enforcement, no_dkim_found, expiring_soon.

The SPF lookup count matters more than it looks. SPF allows ten DNS lookups. Go over and receivers treat the record as an error and ignore it, which silently undoes the whole setup. Counting them is one line of output and a frequent real finding.

---

Registration data comes from RDAP, not WHOIS

RDAP is the IANA-designated replacement for WHOIS: the same registry data delivered as structured JSON over HTTPS rather than free text over port 43.

That matters for accuracy. Every WHOIS library on earth is a pile of per-registry text parsing that breaks when a registry changes its output. RDAP returns typed fields, so dates are dates and the registrar is the registrar.

Some registries publish less than others. Several country registries, .uk among them, return status and nameservers but no registration date, and most registrant contact details are redacted worldwide under GDPR. Those fields come back null rather than guessed at.

---

Common uses

Pre-send domain hygiene. Before a campaign, check that your own domains and your clients' are actually protected. emailSecurityGrade and issues turn into a fix list.

Security assessments and pitches. A list of a prospect's domains, run through this, produces a defensible finding: these three are spoofable and here is why. This is the single most common quick win in an email-security engagement.

Vendor and supply-chain review. Check whether the companies you exchange invoices with can be impersonated, which is exactly the vector behind invoice fraud.

Lead qualification. mailProvider and dnsProvider tell you what a prospect runs before you call. Anyone selling into the email, DNS or security stack qualifies on those two fields.

Domain portfolio monitoring. expiresInDays and isExpiringSoon catch a renewal you were about to miss across hundreds of domains.

Fraud and abuse triage. isNewlyRegistered is a strong signal: a domain registered nine days ago that is already sending you invoices deserves a second look.

---

Pricing

$0.003 per domain, so $3 per 1,000. One charge per domain that exists.

Not charged when a domain is not registered, which the run reports with error: domain_not_registered. Duplicates are removed before anything runs, and URLs and email addresses are reduced to their domain first, so the same company supplied three ways costs once.

Tier discounts apply automatically on paid Apify plans, down to $2 per 1,000.

---

Honest limits

DKIM cannot be enumerated. There is no DNS query that lists a domain's DKIM selectors. This probes the selectors the major providers use and reports which one answered, so hasDkim: true is proof and hasDkim: false means "not found among the common selectors", not "not configured". dkimSelector shows exactly what was found.

Registrant details are usually redacted. GDPR removed most contact data from public registration records. What survives is generally the organisation on business domains and nothing on personal ones.

A grade is a summary, not an audit. It scores the presence and strength of SPF, DMARC, DKIM and MTA-STS. It does not read your DMARC reports or check that your sending sources are actually aligned.

---

Frequently asked questions

How do I check if a domain has SPF and DMARC? Put the domain in. spfRecord and dmarcRecord return the raw records, and spfPolicy and dmarcPolicy return the interpreted versions.

Can someone spoof my domain? isSpoofable answers that directly and spoofReason explains it. In short: without DMARC set to quarantine or reject, yes.

What is a good DMARC policy? p=reject with pct=100 and an rua address collecting reports. p=none monitors and blocks nothing, which is why it is flagged as an issue here rather than treated as a pass.

How do I find out when a domain expires? expiresAt and expiresInDays, where the registry publishes them.

Can I use this to check who a company's email provider is? Yes. mailProvider is derived from the MX records and names Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho and around 25 others.

Is this WHOIS? It is the modern equivalent. RDAP is the official successor and returns the same registry data as structured JSON.

Do you query my domains from my IP? No. DNS goes out from Apify's infrastructure and RDAP lookups go through the proxy you configure.

---

Works well with

• Bulk Email Verifier: verify individual addresses at those domains
• Website Lead Extractor: turn the same domains into emails, phones and postal addresses
• Website Tech Stack Detector: what those sites are built and sold on

---

Notes

Reads public DNS records and public registry data only. Nothing is sent to the domains themselves and no mail is transmitted.