# WHOIS & DNS Lookup: Domain Age, SSL, Email Security (`fernandosord/domain-profile-whois-dns`) Actor
Profile a list of domains: registrar, creation and expiry dates and age from RDAP, DNS records, mail and hosting provider, an SPF, DKIM, DMARC, MTA-STS and BIMI audit with a grade, and the TLS certificate's issuer and days left. Optional tech stack. Unregistered and failed domains are free.
- **URL**: https://apify.com/fernandosord/domain-profile-whois-dns.md
- **Developed by:** [Plainsource](https://apify.com/fernandosord) (community)
- **Categories:** Developer tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet
## Pricing
from $4.00 / 1,000 domain profileds
This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event
## What's an Apify Actor?
An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.
## How to integrate an Actor?
If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.
For examples already wired to this Actor's own input schema, see the [API](#api) section below.
Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).
# README
WHOIS & DNS Lookup profiles a list of domains and returns one row per domain: registrar, creation and expiry dates, domain age in days, DNS records, mail and hosting provider, an email security grade and the TLS certificate's issuer and days left. It does the WHOIS lookup through RDAP, the structured successor to WHOIS, so the answer is JSON you can load into a spreadsheet or CRM.
Use it to check domain age before you trust a new supplier, to find weak SPF or DMARC setups, or to enrich a lead list. Unregistered and failed domains are not charged.
### What data can WHOIS & DNS Lookup extract?
| Group | Fields |
|---|---|
| Registration (RDAP) | `registrar`, `registrarIanaId`, `registrarAbuseEmail`, `createdAt`, `updatedAt`, `expiresAt`, `ageDays`, `daysUntilExpiry`, `domainStatus`, `nameservers`, `dnssec`, `rdapServer`, `rdapError` |
| DNS lookup | `dns.a`, `dns.aaaa`, `dns.mx` (priority and host), `dns.ns`, `dns.txt` and the `www` CNAME in `dns.wwwCname` |
| Providers | `mxProvider`, `dnsProvider`, `hostingProvider`, `cdnProvider`, `hostingEvidence`, and `servicesFromDns` (SaaS services that verified the domain with a TXT record or appear in SPF) |
| Email authentication | `emailGrade` (A to F), `emailScore` (0 to 100), `dmarcPolicy`, `spfLookupCount`, and `emailSecurity` with the full SPF, DMARC, DKIM (34 common selectors, with key size), MTA-STS, TLS-RPT and BIMI details and a list of issues in plain language |
| TLS certificate | `tlsIssuer`, `tlsDaysLeft`, and `tls` with `validFrom`, `validTo`, `sanCount`, `trusted`, `hostnameMatches` and `protocol` |
| Tech stack (optional) | `techStack`: `cms`, `ecommercePlatform`, `technologyNames` and `technologies` with evidence and confidence |
| Row info | `input`, `domain`, `status`, `checkedAt`, `error` |
`status` is `ok`, `not_found` (not registered, or not in DNS), `not_allowed`, `invalid_input`, `failed` or `skipped`. Registrant names, emails and addresses are never collected.
### How to use WHOIS & DNS Lookup
1. Open the Actor on Apify and paste your domains into **Domains**. Subdomains and full URLs are fine: `https://blog.example.co.uk/post` is reduced to `example.co.uk` with the Public Suffix List. Up to 1,000 per run.
2. Leave **Audit email authentication** and **Check the TLS certificate** on, or turn them off if you only need registration and DNS data.
3. Optional: add your own DKIM selector names under **Extra DKIM selectors**, or turn on **Add the website's tech stack** to fetch the homepage and detect its technologies.
4. Click **Start**. A short list takes seconds; the run is paced by the registries (see the FAQ).
5. Open the Output tab, or download the dataset as JSON, CSV or Excel. The run's key-value store also has an `OUTPUT` record with counts per status and per email grade.
### How much does it cost?
The Actor uses pay-per-event pricing.
| Event | Price |
|---|---|
| Run start | $0.002 per GB of memory, charged once per run (the Actor runs on 256 MB, so one event, $0.002) |
| Domain profiled | $0.004 per domain |
| Tech stack added (optional) | $0.002 per domain |
You are charged for a domain only when it was profiled (`status` is `ok`). Unregistered, invalid, refused and failed domains are free. The tech stack is charged only when the homepage was analysed and at least one technology was found.
Worked examples: 1,000 domains without the tech stack cost $0.002 + 1,000 x $0.004 = $4.002. With the tech stack found on every site, $0.002 + 1,000 x ($0.004 + $0.002) = $6.002. If 100 of the 1,000 do not exist, you pay for 900: $3.602. If a run reaches the maximum cost you set, the remaining domains are returned with status `skipped`.
### Input example
```json
{
"domains": ["apify.com", "wikipedia.org", "python.org"]
}
```
With a custom DKIM selector and the tech stack switched on:
```json
{
"domains": ["apify.com", "wikipedia.org", "python.org"],
"includeTechStack": true,
"dkimSelectors": ["mailo"]
}
```
| Field | Default | What it does |
|---|---|---|
| `domains` | | Domains, subdomains or URLs. Up to 1,000 per run. |
| `checkEmailSecurity` | on | SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI, with a grade. |
| `dkimSelectors` | | Your own DKIM selector names, checked as well as the 34 common ones. Up to 20. |
| `checkTls` | on | Reads the certificate on port 443 of the domain, or of its www host if the domain has no address. |
| `includeTechStack` | off | Fetches the homepage and detects its technologies. Charged as a separate event. |
| `respectRobotsTxt` | on | Applies to the homepage and the MTA-STS policy file. |
| `maxConcurrency` | 4 | 1 to 10 domains at once. RDAP queries to each registry are still one at a time. |
| `timeoutSecs` | 20 | 5 to 60 seconds for RDAP and web requests. |
### Output example
One row per domain. This is the row for `python.org` from a real run on 2026-10-28 with the first input above. The long lists (TXT records, services, DKIM keys and issues) are shortened here, and the other two domains are left out; every value shown is as returned.
```json
{
"input": "python.org",
"domain": "python.org",
"status": "ok",
"registrar": "Gandi SAS",
"registrarIanaId": "81",
"registrarAbuseEmail": "abuse@support.gandi.net",
"createdAt": "1995-03-27T05:00:00.545Z",
"updatedAt": "2026-08-12T05:01:11.536Z",
"expiresAt": "2033-03-28T05:00:00.000Z",
"ageDays": 11538,
"daysUntilExpiry": 2342,
"domainStatus": ["client transfer prohibited"],
"nameservers": ["ns-1134.awsdns-13.org", "ns-2046.awsdns-63.co.uk", "ns-484.awsdns-60.com", "ns-981.awsdns-58.net"],
"dnssec": false,
"rdapServer": "rdap.publicinterestregistry.org",
"rdapError": null,
"mxProvider": "Self-hosted or other",
"dnsProvider": "Amazon Route 53",
"hostingProvider": null,
"cdnProvider": "Fastly",
"hostingEvidence": ["Fastly: www.python.org CNAME dualstack.python.map.fastly.net"],
"emailGrade": "D",
"emailScore": 49,
"dmarcPolicy": "none",
"spfLookupCount": 8,
"tlsIssuer": "GlobalSign nv-sa",
"tlsDaysLeft": 108,
"dns": {
"a": ["151.101.64.223", "151.101.0.223", "151.101.192.223", "151.101.128.223"],
"aaaa": ["2a04:4e42:400::223", "2a04:4e42:600::223", "2a04:4e42::223", "2a04:4e42:200::223"],
"mx": [{ "priority": 50, "exchange": "mail.python.org" }],
"ns": ["ns-1134.awsdns-13.org", "ns-2046.awsdns-63.co.uk", "ns-484.awsdns-60.com", "ns-981.awsdns-58.net"],
"txt": ["MS=73147F1EC0843C399CF17F586EC6B8EAF8C57961"],
"wwwCname": ["dualstack.python.map.fastly.net"]
},
"servicesFromDns": [
{ "name": "OpenAI", "category": "AI", "evidence": ["TXT openai-domain-verification=dv-VgeNijVDgW7g56UZyGIVyKNr"] },
{ "name": "Mailgun", "category": "Email delivery", "evidence": ["SPF include:mailgun.org"] }
],
"emailSecurity": {
"grade": "D",
"score": 49,
"mailEnabled": true,
"issues": [
"DMARC policy is \"p=none\" (monitoring only): mail that fails authentication is still delivered. Move to \"quarantine\" or \"reject\" once reports look clean.",
"The DKIM key at \"google\" is 1024 bits; 2048 bits is the current recommendation.",
"No MTA-STS policy, so senders can be tricked into delivering mail to this domain without encryption."
],
"spf": {
"record": "v=spf1 mx ip4:188.166.95.178/32 ip6:2a03:b0c0:2:d0::71:1 include:stspg-customer.com include:_spf.google.com include:mailgun.org ~all",
"allQualifier": "~all",
"includes": ["stspg-customer.com", "_spf.google.com", "mailgun.org"],
"redirect": null,
"lookupCount": 8,
"lookupLimitExceeded": false,
"voidLookups": 0,
"valid": true,
"issues": []
},
"dmarc": {
"record": "v=DMARC1; p=none; pct=100; rua=mailto:re+shb8ybr70a3@dmarc.postmarkapp.com; sp=none; aspf=r;",
"policy": "none",
"subdomainPolicy": "none",
"pct": 100,
"rua": ["mailto:re+shb8ybr70a3@dmarc.postmarkapp.com"],
"ruf": [],
"adkim": null,
"aspf": "r",
"issues": ["DMARC policy is \"p=none\" (monitoring only): mail that fails authentication is still delivered. Move to \"quarantine\" or \"reject\" once reports look clean."]
},
"dkim": {
"selectorsChecked": 34,
"found": [
{ "selector": "google", "keyType": "rsa", "keyBits": 1024, "revoked": false },
{ "selector": "k2", "keyType": "rsa", "keyBits": 2048, "revoked": false }
],
"issues": ["The DKIM key at \"google\" is 1024 bits; 2048 bits is the current recommendation."]
},
"mtaSts": { "record": null, "id": null, "policyMode": null, "policyMaxAge": null, "policyMx": [], "policyError": null },
"tlsRpt": { "record": null, "rua": [] },
"bimi": { "record": null, "logoUrl": null, "certificateUrl": null }
},
"tls": {
"host": "python.org",
"issuer": "GlobalSign nv-sa",
"issuerCommonName": "GlobalSign Atlas R3 DV TLS CA 2025 Q4",
"subject": "www.python.org",
"validFrom": "2026-01-13T13:03:46.000Z",
"validTo": "2027-02-14T13:03:45.000Z",
"daysLeft": 108,
"sanCount": 3,
"trusted": true,
"hostnameMatches": true,
"protocol": "TLSv1.3",
"error": null
},
"techStack": null,
"checkedAt": "2026-10-28T22:07:29.906Z",
"error": null
}
```
The same run gave `apify.com` an email grade of A (100), `wikipedia.org` a C (65) and `python.org` a D (49). All three rows had the status `ok`.
#### How the email grade is worked out
For a domain that receives mail (it has MX records), the score out of 100 is: SPF up to 30 (`-all` 30, `~all` 25, `?all` or no `all` 10, broken 5), DMARC up to 40 (`reject` 35, `quarantine` 26, `none` 9, plus 5 for a report address, minus 5 if `pct` is under 100), a DKIM key at a checked selector 10, MTA-STS up to 10 (`enforce` 10, `testing` 5), TLS-RPT 5 and BIMI 5. A domain with no MX should not send mail either, so it is scored on SPF `-all` (40), DMARC `reject` (50) and a null MX record (10). Grades: A from 85, B from 70, C from 55, D from 40, F below 40.
### Use cases
- Check domain age before you work with a new supplier or partner. A very young domain is a warning sign.
- Enrich a lead list with domain age, mail provider, hosting and tech stack.
- Audit your own or your clients' domains for weak SPF, DMARC, DKIM or MTA-STS setups.
- Track domain registration and SSL certificate expiry dates across a portfolio.
- Find out who hosts a site, who runs its DNS and which SaaS tools it has verified.
### FAQ
#### Is this a WHOIS lookup?
It uses RDAP, the protocol that ICANN requires generic-TLD registries and registrars to run in place of port-43 WHOIS. It returns the same registration facts as structured JSON. Registrant, admin and tech contacts in RDAP responses are ignored, so only registrar-level data is kept.
#### Why is the registrar empty for my domain?
Its TLD has no RDAP service listed by IANA, or the registry did not answer. The reason is in `rdapError`. For example, `.de`, `.io` and `.co` were not in IANA's RDAP bootstrap file on 2026-10-28. DNS, email and TLS data are still returned for those domains.
#### How is domain age calculated?
`ageDays` is the number of days from the registration date in RDAP (`createdAt`) to the day of the run, and `daysUntilExpiry` is the days from the run to `expiresAt`.
#### How long does a run take?
Queries to each RDAP registry run one at a time, at least 1 second apart (2 seconds for Verisign, which runs .com and .net), because registries ask for low-volume use. The 3-domain run above took about 3.5 seconds. Going by the 2-second gap, 1,000 .com domains take at least about 33 minutes; that is an estimate from the code, not a measured run.
#### What are the limits?
Up to 1,000 domains per run, and this Actor is meant for enriching your own lists, not for bulk harvesting. DKIM can only be checked by selector name, so a domain that signs with a selector outside the 34 common ones needs it under **Extra DKIM selectors**. Provider guesses come from DNS names, published IP ranges and headers; the evidence is in `hostingEvidence` and `servicesFromDns`. Blocklists and certificate-transparency logs are not queried.
#### Why did the email grade change when nothing changed?
The grade counts what is published in DNS at the time of the run. A DKIM key on a selector the Actor does not check is not counted; add the selector under **Extra DKIM selectors**.
#### How is the SPF lookup count calculated?
Each `include`, `a`, `mx`, `ptr`, `exists` and `redirect` counts as one, and includes are followed recursively, as RFC 7208 describes. Receivers fail SPF when the total goes over 10.
#### Where does the data come from?
Registration data comes from the registry's RDAP server, found in IANA's bootstrap file (cached for 24 hours). DNS lookups go to the public resolvers 1.1.1.1 and 8.8.8.8, with the system resolver as a fallback. The TLS check is a handshake on port 443, so no page is requested. The MTA-STS policy file and, if you ask for it, the homepage are fetched over HTTPS after checking robots.txt. The Actor identifies itself as `PlainsourceDomainProfile`. LinkedIn, Facebook, Instagram, X and TikTok are not supported, and private or local addresses are refused.
#### Can I use the API, Make, Zapier, n8n, a schedule or an AI agent?
Yes. Every Apify Actor has an API, and the Make, Zapier and n8n integrations can start it and read the dataset. You can run it on a schedule with Apify's Schedules, for example weekly to watch expiry dates. AI agents can call it through the Apify MCP server with the same input. With the API client: `client.actor("fernandosord/domain-profile-whois-dns").call({ domains: ["example.com"] })`.
#### Something is wrong. Where do I report it?
Open an issue on this Actor's Issues tab, for example a wrong provider guess.
### Other Actors by this developer
- [Website Tech Stack Detector](https://apify.com/fernandosord/website-tech-stack-detector): find out which CMS, framework and tools a site uses.
- [Website Screenshot & URL to PDF](https://apify.com/fernandosord/website-screenshot-pdf): full-page screenshots and PDFs of a list of URLs.
- [Website Change Monitor](https://apify.com/fernandosord/website-change-monitor): watch pages and get the exact lines or links that were added or removed.
- [Open Places Leads](https://apify.com/fernandosord/open-places-leads): business lists by city or country from Overture Maps open data.
- [Document to Markdown](https://apify.com/fernandosord/document-to-markdown): turn PDF, Word and other files into Markdown.
# Actor input Schema
## `domains` (type: `array`):
Domains such as example.com. URLs and subdomains are accepted and reduced to the registered domain (https://blog.example.co.uk/post becomes example.co.uk). One row per domain, up to 1,000 per run.
## `checkEmailSecurity` (type: `boolean`):
Check SPF (with its DNS lookup count), DMARC, DKIM keys at common selectors, MTA-STS, TLS-RPT and BIMI, and give a grade from A to F with plain-language issues.
## `dkimSelectors` (type: `array`):
DKIM keys can only be found by name. 34 common selectors (google, selector1, selector2, k1, s1, default and others) are always checked. Add your own here, for example mailo or 2024a. Up to 20.
## `checkTls` (type: `boolean`):
Open a TLS connection to the domain (or its www host) on port 443 and read the certificate: issuer, valid from and to, days left, number of names it covers, and whether it is trusted.
## `includeTechStack` (type: `boolean`):
Fetch the homepage and detect its CMS, ecommerce platform, frameworks, analytics and CDN. Charged as a separate event, only when the homepage could be analysed.
## `respectRobotsTxt` (type: `boolean`):
Applies to the homepage fetch for the tech stack and to the MTA-STS policy file. DNS, RDAP and TLS checks are not page fetches. Turn off only for sites you own or have permission to check.
## `maxConcurrency` (type: `integer`):
RDAP queries to each registry always go one at a time, at least 1 s apart (2 s for Verisign's .com and .net), whatever this is set to.
## `timeoutSecs` (type: `integer`):
How long to wait for each RDAP or web request. DNS and TLS checks have their own shorter limits.
## Actor input object example
```json
{
"domains": [
"apify.com",
"wikipedia.org",
"python.org"
],
"checkEmailSecurity": true,
"checkTls": true,
"includeTechStack": false,
"respectRobotsTxt": true,
"maxConcurrency": 4,
"timeoutSecs": 20
}
```
# Actor output Schema
## `results` (type: `string`):
One row per domain: registration data, DNS, email security grade, TLS certificate and optional tech stack, or the reason it could not be profiled.
## `summary` (type: `string`):
Counts per status and per email grade.
# API
You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.
## JavaScript example
```javascript
import { ApifyClient } from 'apify-client';
// Initialize the ApifyClient with your Apify API token
// Replace the '' with your token
const client = new ApifyClient({
token: '',
});
// Prepare Actor input
const input = {
"domains": [
"apify.com",
"wikipedia.org",
"python.org"
]
};
// Run the Actor and wait for it to finish
const run = await client.actor("fernandosord/domain-profile-whois-dns").call(input);
// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
console.dir(item);
});
// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs
```
## Python example
```python
from apify_client import ApifyClient
# Initialize the ApifyClient with your Apify API token
# Replace '' with your token.
client = ApifyClient("")
# Prepare the Actor input
run_input = { "domains": [
"apify.com",
"wikipedia.org",
"python.org",
] }
# Run the Actor and wait for it to finish
run = client.actor("fernandosord/domain-profile-whois-dns").call(run_input=run_input)
# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
print(item)
# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start
```
## CLI example
```bash
echo '{
"domains": [
"apify.com",
"wikipedia.org",
"python.org"
]
}' |
apify call fernandosord/domain-profile-whois-dns --silent --output-dataset
```
## MCP server setup
```json
{
"mcpServers": {
"apify": {
"type": "http",
"url": "https://mcp.apify.com/?tools=fetch-actor-details,fernandosord/domain-profile-whois-dns"
}
}
}
```
The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).
## OpenAPI specification
Download the OpenAPI definition: https://api.apify.com/v2/actors/aoHciPYZCaepp4oXa/builds/tkxamuUJj7FsqQQxv/openapi.json