WHOIS & DNS Lookup: Domain Age, SSL, Email Security

WHOIS & DNS Lookup profiles a list of domains and returns one row per domain: registrar, creation and expiry dates, domain age in days, DNS records, mail and hosting provider, an email security grade and the TLS certificate's issuer and days left. It does the WHOIS lookup through RDAP, the structured successor to WHOIS, so the answer is JSON you can load into a spreadsheet or CRM.

Use it to check domain age before you trust a new supplier, to find weak SPF or DMARC setups, or to enrich a lead list. Unregistered and failed domains are not charged.

What data can WHOIS & DNS Lookup extract?

Group	Fields
Registration (RDAP)	registrar, registrarIanaId, registrarAbuseEmail, createdAt, updatedAt, expiresAt, ageDays, daysUntilExpiry, domainStatus, nameservers, dnssec, rdapServer, rdapError
DNS lookup	dns.a, dns.aaaa, dns.mx (priority and host), dns.ns, dns.txt and the www CNAME in dns.wwwCname
Providers	mxProvider, dnsProvider, hostingProvider, cdnProvider, hostingEvidence, and servicesFromDns (SaaS services that verified the domain with a TXT record or appear in SPF)
Email authentication	emailGrade (A to F), emailScore (0 to 100), dmarcPolicy, spfLookupCount, and emailSecurity with the full SPF, DMARC, DKIM (34 common selectors, with key size), MTA-STS, TLS-RPT and BIMI details and a list of issues in plain language
TLS certificate	tlsIssuer, tlsDaysLeft, and tls with validFrom, validTo, sanCount, trusted, hostnameMatches and protocol
Tech stack (optional)	techStack: cms, ecommercePlatform, technologyNames and technologies with evidence and confidence
Row info	input, domain, status, checkedAt, error

status is ok, not_found (not registered, or not in DNS), not_allowed, invalid_input, failed or skipped. Registrant names, emails and addresses are never collected.

How to use WHOIS & DNS Lookup

1. Open the Actor on Apify and paste your domains into Domains. Subdomains and full URLs are fine: https://blog.example.co.uk/post is reduced to example.co.uk with the Public Suffix List. Up to 1,000 per run.
2. Leave Audit email authentication and Check the TLS certificate on, or turn them off if you only need registration and DNS data.
3. Optional: add your own DKIM selector names under Extra DKIM selectors, or turn on Add the website's tech stack to fetch the homepage and detect its technologies.
4. Click Start. A short list takes seconds; the run is paced by the registries (see the FAQ).
5. Open the Output tab, or download the dataset as JSON, CSV or Excel. The run's key-value store also has an OUTPUT record with counts per status and per email grade.

How much does it cost?

The Actor uses pay-per-event pricing.

Event	Price
Run start	$0.002 per GB of memory, charged once per run (the Actor runs on 256 MB, so one event, $0.002)
Domain profiled	$0.004 per domain
Tech stack added (optional)	$0.002 per domain

You are charged for a domain only when it was profiled (status is ok). Unregistered, invalid, refused and failed domains are free. The tech stack is charged only when the homepage was analysed and at least one technology was found.

Worked examples: 1,000 domains without the tech stack cost $0.002 + 1,000 x $0.004 = $4.002. With the tech stack found on every site, $0.002 + 1,000 x ($0.004 + $0.002) = $6.002. If 100 of the 1,000 do not exist, you pay for 900: $3.602. If a run reaches the maximum cost you set, the remaining domains are returned with status skipped.

Input example

{
    "domains": ["apify.com", "wikipedia.org", "python.org"]
}

With a custom DKIM selector and the tech stack switched on:

{
    "domains": ["apify.com", "wikipedia.org", "python.org"],
    "includeTechStack": true,
    "dkimSelectors": ["mailo"]
}

Field	Default	What it does
domains		Domains, subdomains or URLs. Up to 1,000 per run.
checkEmailSecurity	on	SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI, with a grade.
dkimSelectors		Your own DKIM selector names, checked as well as the 34 common ones. Up to 20.
checkTls	on	Reads the certificate on port 443 of the domain, or of its www host if the domain has no address.
includeTechStack	off	Fetches the homepage and detects its technologies. Charged as a separate event.
respectRobotsTxt	on	Applies to the homepage and the MTA-STS policy file.
maxConcurrency	4	1 to 10 domains at once. RDAP queries to each registry are still one at a time.
timeoutSecs	20	5 to 60 seconds for RDAP and web requests.

Output example

One row per domain. This is the row for python.org from a real run on 2026-10-28 with the first input above. The long lists (TXT records, services, DKIM keys and issues) are shortened here, and the other two domains are left out; every value shown is as returned.

{
    "input": "python.org",
    "domain": "python.org",
    "status": "ok",
    "registrar": "Gandi SAS",
    "registrarIanaId": "81",
    "registrarAbuseEmail": "abuse@support.gandi.net",
    "createdAt": "1995-03-27T05:00:00.545Z",
    "updatedAt": "2026-08-12T05:01:11.536Z",
    "expiresAt": "2033-03-28T05:00:00.000Z",
    "ageDays": 11538,
    "daysUntilExpiry": 2342,
    "domainStatus": ["client transfer prohibited"],
    "nameservers": ["ns-1134.awsdns-13.org", "ns-2046.awsdns-63.co.uk", "ns-484.awsdns-60.com", "ns-981.awsdns-58.net"],
    "dnssec": false,
    "rdapServer": "rdap.publicinterestregistry.org",
    "rdapError": null,
    "mxProvider": "Self-hosted or other",
    "dnsProvider": "Amazon Route 53",
    "hostingProvider": null,
    "cdnProvider": "Fastly",
    "hostingEvidence": ["Fastly: www.python.org CNAME dualstack.python.map.fastly.net"],
    "emailGrade": "D",
    "emailScore": 49,
    "dmarcPolicy": "none",
    "spfLookupCount": 8,
    "tlsIssuer": "GlobalSign nv-sa",
    "tlsDaysLeft": 108,
    "dns": {
        "a": ["151.101.64.223", "151.101.0.223", "151.101.192.223", "151.101.128.223"],
        "aaaa": ["2a04:4e42:400::223", "2a04:4e42:600::223", "2a04:4e42::223", "2a04:4e42:200::223"],
        "mx": [{ "priority": 50, "exchange": "mail.python.org" }],
        "ns": ["ns-1134.awsdns-13.org", "ns-2046.awsdns-63.co.uk", "ns-484.awsdns-60.com", "ns-981.awsdns-58.net"],
        "txt": ["MS=73147F1EC0843C399CF17F586EC6B8EAF8C57961"],
        "wwwCname": ["dualstack.python.map.fastly.net"]
    },
    "servicesFromDns": [
        { "name": "OpenAI", "category": "AI", "evidence": ["TXT openai-domain-verification=dv-VgeNijVDgW7g56UZyGIVyKNr"] },
        { "name": "Mailgun", "category": "Email delivery", "evidence": ["SPF include:mailgun.org"] }
    ],
    "emailSecurity": {
        "grade": "D",
        "score": 49,
        "mailEnabled": true,
        "issues": [
            "DMARC policy is \"p=none\" (monitoring only): mail that fails authentication is still delivered. Move to \"quarantine\" or \"reject\" once reports look clean.",
            "The DKIM key at \"google\" is 1024 bits; 2048 bits is the current recommendation.",
            "No MTA-STS policy, so senders can be tricked into delivering mail to this domain without encryption."
        ],
        "spf": {
            "record": "v=spf1 mx ip4:188.166.95.178/32 ip6:2a03:b0c0:2:d0::71:1 include:stspg-customer.com include:_spf.google.com include:mailgun.org ~all",
            "allQualifier": "~all",
            "includes": ["stspg-customer.com", "_spf.google.com", "mailgun.org"],
            "redirect": null,
            "lookupCount": 8,
            "lookupLimitExceeded": false,
            "voidLookups": 0,
            "valid": true,
            "issues": []
        },
        "dmarc": {
            "record": "v=DMARC1; p=none; pct=100; rua=mailto:re+shb8ybr70a3@dmarc.postmarkapp.com; sp=none; aspf=r;",
            "policy": "none",
            "subdomainPolicy": "none",
            "pct": 100,
            "rua": ["mailto:re+shb8ybr70a3@dmarc.postmarkapp.com"],
            "ruf": [],
            "adkim": null,
            "aspf": "r",
            "issues": ["DMARC policy is \"p=none\" (monitoring only): mail that fails authentication is still delivered. Move to \"quarantine\" or \"reject\" once reports look clean."]
        },
        "dkim": {
            "selectorsChecked": 34,
            "found": [
                { "selector": "google", "keyType": "rsa", "keyBits": 1024, "revoked": false },
                { "selector": "k2", "keyType": "rsa", "keyBits": 2048, "revoked": false }
            ],
            "issues": ["The DKIM key at \"google\" is 1024 bits; 2048 bits is the current recommendation."]
        },
        "mtaSts": { "record": null, "id": null, "policyMode": null, "policyMaxAge": null, "policyMx": [], "policyError": null },
        "tlsRpt": { "record": null, "rua": [] },
        "bimi": { "record": null, "logoUrl": null, "certificateUrl": null }
    },
    "tls": {
        "host": "python.org",
        "issuer": "GlobalSign nv-sa",
        "issuerCommonName": "GlobalSign Atlas R3 DV TLS CA 2025 Q4",
        "subject": "www.python.org",
        "validFrom": "2026-01-13T13:03:46.000Z",
        "validTo": "2027-02-14T13:03:45.000Z",
        "daysLeft": 108,
        "sanCount": 3,
        "trusted": true,
        "hostnameMatches": true,
        "protocol": "TLSv1.3",
        "error": null
    },
    "techStack": null,
    "checkedAt": "2026-10-28T22:07:29.906Z",
    "error": null
}

The same run gave apify.com an email grade of A (100), wikipedia.org a C (65) and python.org a D (49). All three rows had the status ok.

How the email grade is worked out

For a domain that receives mail (it has MX records), the score out of 100 is: SPF up to 30 (-all 30, ~all 25, ?all or no all 10, broken 5), DMARC up to 40 (reject 35, quarantine 26, none 9, plus 5 for a report address, minus 5 if pct is under 100), a DKIM key at a checked selector 10, MTA-STS up to 10 (enforce 10, testing 5), TLS-RPT 5 and BIMI 5. A domain with no MX should not send mail either, so it is scored on SPF -all (40), DMARC reject (50) and a null MX record (10). Grades: A from 85, B from 70, C from 55, D from 40, F below 40.

Use cases

• Check domain age before you work with a new supplier or partner. A very young domain is a warning sign.
• Enrich a lead list with domain age, mail provider, hosting and tech stack.
• Audit your own or your clients' domains for weak SPF, DMARC, DKIM or MTA-STS setups.
• Track domain registration and SSL certificate expiry dates across a portfolio.
• Find out who hosts a site, who runs its DNS and which SaaS tools it has verified.

FAQ

Is this a WHOIS lookup?

It uses RDAP, the protocol that ICANN requires generic-TLD registries and registrars to run in place of port-43 WHOIS. It returns the same registration facts as structured JSON. Registrant, admin and tech contacts in RDAP responses are ignored, so only registrar-level data is kept.

Why is the registrar empty for my domain?

Its TLD has no RDAP service listed by IANA, or the registry did not answer. The reason is in rdapError. For example, .de, .io and .co were not in IANA's RDAP bootstrap file on 2026-10-28. DNS, email and TLS data are still returned for those domains.

How is domain age calculated?

ageDays is the number of days from the registration date in RDAP (createdAt) to the day of the run, and daysUntilExpiry is the days from the run to expiresAt.

How long does a run take?

Queries to each RDAP registry run one at a time, at least 1 second apart (2 seconds for Verisign, which runs .com and .net), because registries ask for low-volume use. The 3-domain run above took about 3.5 seconds. Going by the 2-second gap, 1,000 .com domains take at least about 33 minutes; that is an estimate from the code, not a measured run.

What are the limits?

Up to 1,000 domains per run, and this Actor is meant for enriching your own lists, not for bulk harvesting. DKIM can only be checked by selector name, so a domain that signs with a selector outside the 34 common ones needs it under Extra DKIM selectors. Provider guesses come from DNS names, published IP ranges and headers; the evidence is in hostingEvidence and servicesFromDns. Blocklists and certificate-transparency logs are not queried.

Why did the email grade change when nothing changed?

The grade counts what is published in DNS at the time of the run. A DKIM key on a selector the Actor does not check is not counted; add the selector under Extra DKIM selectors.

How is the SPF lookup count calculated?

Each include, a, mx, ptr, exists and redirect counts as one, and includes are followed recursively, as RFC 7208 describes. Receivers fail SPF when the total goes over 10.

Where does the data come from?

Registration data comes from the registry's RDAP server, found in IANA's bootstrap file (cached for 24 hours). DNS lookups go to the public resolvers 1.1.1.1 and 8.8.8.8, with the system resolver as a fallback. The TLS check is a handshake on port 443, so no page is requested. The MTA-STS policy file and, if you ask for it, the homepage are fetched over HTTPS after checking robots.txt. The Actor identifies itself as PlainsourceDomainProfile. LinkedIn, Facebook, Instagram, X and TikTok are not supported, and private or local addresses are refused.

Can I use the API, Make, Zapier, n8n, a schedule or an AI agent?

Yes. Every Apify Actor has an API, and the Make, Zapier and n8n integrations can start it and read the dataset. You can run it on a schedule with Apify's Schedules, for example weekly to watch expiry dates. AI agents can call it through the Apify MCP server with the same input. With the API client: client.actor("fernandosord/domain-profile-whois-dns").call({ domains: ["example.com"] }).

Something is wrong. Where do I report it?

Open an issue on this Actor's Issues tab, for example a wrong provider guess.

Other Actors by this developer

• Website Tech Stack Detector: find out which CMS, framework and tools a site uses.
• Website Screenshot & URL to PDF: full-page screenshots and PDFs of a list of URLs.
• Website Change Monitor: watch pages and get the exact lines or links that were added or removed.
• Open Places Leads: business lists by city or country from Overture Maps open data.
• Document to Markdown: turn PDF, Word and other files into Markdown.