Domain Intelligence - DNS, SSL, RDAP, email security and tech stack for thousands of domains

Paste a list of domains (or URLs) and get one clean record per domain with everything you usually need five tools for:

Block	What you get
DNS	A, AAAA, MX, NS, TXT, CNAME, CAA and SOA, resolved through resolvers you choose (default 1.1.1.1 and 8.8.8.8) with an automatic DNS-over-HTTPS fallback
Email security	SPF (parsed, with the real DNS-lookup count), DMARC policy / percentage / alignment, DKIM selector probe (~40 common selectors + your own), MTA-STS (policy fetched), BIMI, mail provider, plain-English issues list
SSL/TLS	Issuer, valid from / to, days to expiry, SANs, protocol, cipher, key type, chain, trust errors (expired, self-signed, hostname mismatch, weak key)
HTTP	Final URL after redirects, status code, redirect chain, Server, HSTS (max-age, preload), security headers present, time to first byte
Registration (RDAP)	Registrar, created / updated / expires dates, domain age, status flags, nameservers, DNSSEC - via the IANA RDAP bootstrap, so it works for 1,200+ TLDs
Availability	available / registered / likely-available, with the basis and a confidence level (RDAP 404 = not registered)
Tech stack (add-on)	CMS, e-commerce platform, analytics, tag managers, CDN, hosting, frameworks, DNS and email provider (~200 technologies)

No API keys, no logins, no proxy. Everything uses open protocols (DNS, TLS, HTTPS, RDAP).

Partial results never fail the run. Each check has its own timeout and error. A dead site only loses its own HTTP/SSL check; the DNS, email and RDAP parts of the record are still delivered, and checks / errors tell you exactly what happened.

Privacy

Only company-level technical data is collected. RDAP registrant, administrative, technical and abuse contacts are never read; only the registrar is kept. Mailbox addresses found in DMARC rua/ruf tags are masked (mailto:***@example.com), and the SOA contact mailbox is dropped.

Input

{
  "domains": ["apify.com", "https://www.github.com/pricing", "example.org"],
  "detectTech": true
}

Field	Default	Description
domains	-	Domains or URLs, one per line. Only the host is used. Duplicates removed; invalid entries skipped and not charged.
checkDns, checkEmailSecurity, checkSsl, checkHttp, checkRdap	true	Switch each block on or off.
detectTech	false	Technology detection add-on (reuses the homepage fetched by the HTTP check).
resolvers	1.1.1.1, 8.8.8.8	Recursive resolvers (IPs).
dohFallback	true	Retry failed UDP lookups over Cloudflare/Google DNS-over-HTTPS.
extraDkimSelectors	[]	Selectors to probe in addition to the built-in list.
concurrency	25	Domains in parallel (1-200).
checkTimeoutSecs	10	Timeout per check.
maxItems	100000	Cap on domains per run.

Output example (shortened)

{
  "domain": "github.com",
  "registrableDomain": "github.com",
  "tld": "com",
  "status": "ok",
  "dns": { "status": "ok", "a": ["140.82.121.4"], "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }], "ns": ["dns1.p08.nsone.net"], "caa": [{ "flags": 0, "tag": "issue", "value": "digicert.com" }], "resolvedVia": "udp" },
  "email": {
    "provider": "Google Workspace",
    "spf": { "present": true, "policy": "~all", "dnsLookups": 9 },
    "dmarc": { "present": true, "policy": "reject", "pct": 100, "aggregateReports": true },
    "dkim": { "probed": 43, "found": [{ "selector": "google", "keyType": "rsa", "approxKeyBits": 2048 }] },
    "mtaSts": { "present": false }, "bimi": { "present": false },
    "issues": []
  },
  "ssl": { "valid": true, "issuer": { "commonName": "Sectigo Public Server Authentication CA DV E36" }, "validTo": "2026-11-29T23:59:59.000Z", "daysToExpiry": 47, "protocol": "TLSv1.3", "issues": [] },
  "http": { "finalUrl": "https://github.com/", "statusCode": 200, "server": "github.com", "hsts": { "maxAge": 31536000, "includeSubDomains": true, "preload": true }, "ttfbMs": 210 },
  "rdap": { "registered": true, "registrar": "MarkMonitor Inc.", "registeredAt": "2007-10-09T18:20:50.000Z", "expiresAt": "2028-10-09T18:20:50.000Z", "daysToExpiry": 727, "dnssec": false },
  "availability": { "status": "registered", "available": false, "confidence": "high", "basis": "rdap-record" },
  "tech": [{ "name": "Google Workspace", "category": "Email provider", "evidence": ["dns:mx"] }],
  "checks": { "dns": "ok", "email": "ok", "ssl": "ok", "http": "ok", "rdap": "ok", "tech": "ok" },
  "errors": {}
}

status is ok, partial (a check timed out or errored), nxdomain (the name does not resolve) or failed.

Pricing (pay per event)

Event	Price
domain-result - one domain record, all checks included	US$2.00 per 1,000 domains
tech-detection - add-on, only when detectTech is on	US$1.00 per 1,000 domains

Invalid inputs and duplicates are free. A run capped by your spending limit stops cleanly and keeps what it has.

Use cases

• Domain portfolio monitoring: certificate and registration expiry across hundreds of domains, in one scheduled run.
• Email deliverability audits: find domains without SPF/DMARC, p=none policies, SPF over the 10-lookup limit.
• Lead enrichment and segmentation: which CMS / e-commerce platform / mail provider does each prospect use?
• Domain investing and brand protection: availability and expiry dates at scale; spot lookalike domains.
• Security and compliance sweeps: HSTS, security headers, outdated TLS, self-signed or expired certificates.

FAQ

Is availability 100% accurate? An RDAP 404 means the registry has no record of the name, which is how registries report an unregistered domain. It does not detect premium, reserved or restricted names, so treat it as "likely available". TLDs without RDAP (several country codes) fall back to a low-confidence DNS verdict.

Why was my DKIM selector not found? DKIM selectors are secret by design; the probe covers ~40 widely used ones. Add yours in extraDkimSelectors.

How fast is it? Roughly 2 domains per second with every check on (about 4 minutes for 500 domains in our local test). Turn off blocks you do not need to go faster.

Does it need a proxy? No.

En español

Pega una lista de dominios o URLs y obtén un registro por dominio con DNS (A, MX, NS, TXT, CAA, SOA), seguridad de correo (SPF, DMARC, DKIM, MTA-STS, BIMI), certificado SSL con días para vencer, HTTP (redirecciones, HSTS), datos de registro por RDAP (registrador, fechas, vencimiento), disponibilidad del dominio y, opcionalmente, las tecnologías que usa el sitio. Sin API keys ni proxy. Si un chequeo falla, el resto del registro se entrega igual. Precio: US$2,00 por 1.000 dominios (+ US$1,00 por 1.000 si activas la detección de tecnologías). No se recopilan datos de personas: solo el registrador.