Domain Intelligence | $0.02 / domain |

What does Domain Intelligence do? 🔎

Paste a list of domains, get one audit-ready row per domain: who hosts it, what it is built with, whether its email can be spoofed, and when its TLS certificate and its registration expire. Security teams use it to find domains with a weak DMARC policy, agencies use it to qualify leads by tech stack, and SRE teams use it to catch certificates before they lapse.

One run replaces a stack of one-domain-at-a-time tools: check DMARC and SPF records in bulk, run a domain tech stack lookup, read MX records and name the mail provider, check SSL certificate expiry, look up hosting ASN and CDN, and pull RDAP registration data (the modern replacement for WHOIS). No API key, no browser, no proxies — the Actor speaks DNS-over-HTTPS, RDAP, TLS and plain HTTPS, so a domain takes a couple of seconds and costs $0.05.

✨ Try it: hit Start with the prefilled domains. Three full reports land in about 10 seconds.

🛡️ Honest by design: every value is measured, never guessed. An unrecognised platform is null, not "probably WordPress". A row that could not be checked says so in status and error, and you are not billed for it.

Use cases: spoofing audits, tech-stack lead scoring, certificate monitoring 💡

• 🛡️ Security and IT teams auditing email spoofing risk. Run your supplier or subsidiary list and pull out every domain sitting on p=none, missing an SPF -all, or publishing no DMARC record at all — the domains an attacker can spoof today.
• 🎯 Agencies and SDRs qualifying leads by tech stack. Score a prospect list before a rep touches it: "every store on this list running a hosted commerce platform", "every prospect still on a self-hosted CMS", "everyone using a chat widget we integrate with".
• 🔐 SRE and platform teams watching certificate expiry. Schedule a daily run across your whole domain portfolio and alert when tlsDaysToExpiry drops under 30 or when a chain stops being trusted. The RDAP expiresAt date catches domains about to lapse too.
• 🏗️ Agencies inheriting client estates. Inventory the CMS, CDN, DNS provider, mail host and registrar of every domain a new client owns in one pass, instead of clicking through five lookup sites per domain.
• 📈 SEO and content teams checking AI-crawler policy. See which competitors publish an llms.txt, and which ones disallow GPTBot, ClaudeBot, CCBot or Google-Extended in robots.txt.
• 🔬 Analysts mapping a market's technology. Which frameworks, analytics, payment and hosting stacks the domains in a niche use, and which ASNs they sit behind — a whole category profiled in one dataset.

The Actor does not log in anywhere, does not read private data and does not need a captcha solver. Every signal is public protocol data that the domain owner publishes on purpose.

What data you get 📦

One row per domain. These flat columns are what the Overview table shows first, and they are what most people export:

Field	Type	What it tells you
domain	string	The registrable host name that was analysed: lower-case, punycode, no leading www..
cms	string | null	Primary CMS, hosted commerce platform or site generator detected on the homepage. null when no fingerprint matched.
cdn	string | null	CDN or edge network in front of the site, taken from response headers first and the hosting ASN second.
mailProvider	string | null	Hosted mail provider derived from MX, other when MX exists but is self-hosted or unknown, null when the domain receives no mail.
dmarcPolicy	string | null	none, quarantine or reject. null when no DMARC record is published — the highest-risk case.
tlsDaysToExpiry	integer | null	Whole days until the TLS certificate expires; negative when it already has.
registrar	string | null	Sponsoring registrar, from RDAP.
status	string	ok, not_found or error (see the table below).
error	string	Why the row is not ok. Absent on ok rows.
url	string	Homepage URL of the domain (https://<domain>/).
scrapedAt	string	ISO 8601 timestamp of the probe.

Each flat column is a copy of one value inside a nested block. The blocks carry the full detail:

Block	Contents
dns	a, aaaa (IP arrays), mx (priority + exchange, sorted), ns, txt (raw TXT strings, including SaaS verification tokens), caa (flags, tag, value).
emailSecurity	spf (present, record, allMechanism — -all/~all/?all/+all, includes), dmarc (present, record, policy, subdomainPolicy, percentage, reportingEnabled), dkimSelectorsFound (of google, selector1, selector2, k1, mail, default).
tls	issuer, issuerCn, subject, validFrom, validTo, daysToExpiry, sanCount, protocol, trusted, host (apex or www fallback).
rdap	registrar, registrarIanaId, createdAt, updatedAt, expiresAt, nameservers, status (EPP flags such as client transfer prohibited), source (the RDAP server that answered).
hosting	ip (first A record), asn, asnName, cdn, dnsProvider (from the NS host names).
techStack	server, poweredBy, cms, analytics[], frameworks[], ecommerce[], chatWidgets[], other[] (marketing, payments, hosting), plus homepageStatus, homepageUrl and title.
files	robotsTxt, llmsTxt, securityTxt, sitemap (booleans), sitemapUrls (from robots.txt, max 10) and aiBotsBlocked (AI crawlers fully disallowed).
warnings	Non-fatal problems on an otherwise good row, e.g. RDAP: the .de registry publishes no RDAP service. Absent when everything worked.

A section you switch off in the input is absent from the row. A section that was checked but unavailable is null, and warnings says why. That difference is deliberate: null always means "we looked and there is nothing", never "we did not look".

Result status (tri-state output)

status	Meaning	Billed?
ok	The domain resolves and was probed. Individual sections may still be null with a warnings entry.	Yes
not_found	NXDOMAIN — the domain does not exist in DNS (unregistered, expired or a typo).	No
error	The lookups themselves failed (resolvers unreachable, broken zone/SERVFAIL, or an unparseable input). error says which.	No

Output 📤

Export as JSON, CSV, Excel, XML or HTML, or read the dataset straight from the API. This is a real row from the default run (apify.com, 2026-09-08), with a few repetitive txt, aaaa and caa entries trimmed so it stays readable:

{
    "domain": "apify.com",
    "url": "https://apify.com/",
    "status": "ok",
    "scrapedAt": "2026-09-08T10:42:48.227Z",
    "dns": {
        "a": ["65.9.46.39", "65.9.46.103", "65.9.46.99", "65.9.46.26"],
        "aaaa": ["2600:9000:2094:a400:9:a03e:6540:93a1", "2600:9000:2094:6200:9:a03e:6540:93a1"],
        "mx": [
            { "priority": 1, "exchange": "aspmx.l.google.com" },
            { "priority": 5, "exchange": "alt1.aspmx.l.google.com" },
            { "priority": 5, "exchange": "alt2.aspmx.l.google.com" },
            { "priority": 10, "exchange": "aspmx2.googlemail.com" },
            { "priority": 10, "exchange": "aspmx3.googlemail.com" }
        ],
        "ns": ["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
        "txt": [
            "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com -all",
            "google-site-verification=jrECJwBG9eeO_FUrOMhp7JY1oF8JSBxhzmLsLGvrt9s",
            "openai-domain-verification=dv-WTM7Nna92Owwh4sgmDOVUyyt",
            "zapier-domain-verification-challenge=2c358aa9-fa36-419f-b21a-ca9eb6f2791d",
            "mixpanel-domain-verify=44615d9c-27f2-4587-a781-8a0a1c734e9a"
        ],
        "caa": [
            { "flags": 0, "tag": "issue", "value": "letsencrypt.org" },
            { "flags": 0, "tag": "issue", "value": "amazonaws.com" },
            { "flags": 0, "tag": "issue", "value": "digicert.com" }
        ]
    },
    "emailSecurity": {
        "spf": {
            "present": true,
            "record": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com -all",
            "allMechanism": "-all",
            "includes": ["_spf.google.com", "mailgun.org", "amazonses.com"]
        },
        "dmarc": {
            "present": true,
            "record": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
            "policy": "reject",
            "subdomainPolicy": "reject",
            "percentage": 100,
            "reportingEnabled": true
        },
        "dkimSelectorsFound": ["google"]
    },
    "mailProvider": "Google Workspace",
    "tls": {
        "issuer": "Amazon",
        "issuerCn": "Amazon RSA 2048 M04",
        "subject": "*.apify.com",
        "validFrom": "2026-07-03T00:00:00.000Z",
        "validTo": "2027-01-16T23:59:59.000Z",
        "daysToExpiry": 130,
        "sanCount": 4,
        "protocol": "TLSv1.3",
        "trusted": true,
        "host": "apify.com"
    },
    "rdap": {
        "registrar": "Amazon Registrar, Inc.",
        "registrarIanaId": "468",
        "createdAt": "2009-06-02T17:14:10Z",
        "updatedAt": "2026-05-16T16:53:04Z",
        "expiresAt": "2035-06-02T17:14:10Z",
        "nameservers": ["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
        "status": ["client transfer prohibited"],
        "source": "rdap.verisign.com"
    },
    "hosting": {
        "ip": "65.9.46.39",
        "asn": 16509,
        "asnName": "AMAZON-02 - Amazon.com, Inc.",
        "cdn": "Amazon CloudFront",
        "dnsProvider": "Amazon Route 53"
    },
    "techStack": {
        "server": null,
        "poweredBy": null,
        "cms": "Next.js",
        "analytics": ["Google Tag Manager"],
        "frameworks": ["Next.js", "React", "Bootstrap"],
        "ecommerce": [],
        "chatWidgets": ["Intercom"],
        "other": ["HubSpot", "OneTrust", "Amazon CloudFront"],
        "homepageStatus": 200,
        "homepageUrl": "https://apify.com/",
        "title": "Apify: The largest marketplace of trusted tools for AI"
    },
    "files": {
        "robotsTxt": true,
        "llmsTxt": true,
        "securityTxt": true,
        "sitemap": true,
        "sitemapUrls": ["https://apify.com/sitemap.xml"],
        "aiBotsBlocked": []
    },
    "registrar": "Amazon Registrar, Inc.",
    "cms": "Next.js",
    "cdn": "Amazon CloudFront",
    "dmarcPolicy": "reject",
    "tlsDaysToExpiry": 130
}

The Overview table of that same run, one line per domain:

domain	cms	cdn	mailProvider	dmarcPolicy	tlsDaysToExpiry	registrar	status
apify.com	Next.js	Amazon CloudFront	Google Workspace	reject	130	Amazon Registrar, Inc.	ok
wordpress.org	WordPress	null	other	reject	45	MarkMonitor Inc.	ok
nextjs.org	Next.js	Vercel	Google Workspace	quarantine	42	Tucows Domains Inc.	ok

And the two free row types, so you can see exactly what a domain that costs nothing looks like:

[
    {
        "domain": "invalid.invalid",
        "inputDomain": "not a domain",
        "url": "https://invalid.invalid/",
        "status": "error",
        "error": "Invalid domain name: \"not a domain\" is not a host name (expected something like example.com)",
        "scrapedAt": "2026-09-08T10:43:22.234Z"
    },
    {
        "domain": "this-domain-does-not-exist-9x8y7z6w.com",
        "url": "https://this-domain-does-not-exist-9x8y7z6w.com/",
        "status": "not_found",
        "error": "NXDOMAIN: this-domain-does-not-exist-9x8y7z6w.com does not exist in DNS",
        "scrapedAt": "2026-09-08T10:43:22.526Z"
    }
]

How to check DMARC, SPF and the tech stack of a domain list 🛠️

1. Add your domains 📝 — paste them into Domains, one per line. Bare names (stripe.com), full URLs (https://www.stripe.com/pricing) and e-mail addresses (sales@stripe.com) all work; everything is reduced to the registrable host name and duplicates are dropped.
2. Pick the sections ✅ — all five are on by default. Switching one off makes the run slightly faster; the price per domain does not change.
3. Set Maximum results 🔢 — the safety cap on how many rows the run may write.
4. Start ▶️ — rows appear in the dataset in real time, one per domain, roughly 1-3 seconds each with 10 domains in flight.
5. Export or automate 📤 — download from the Output tab, or add a Schedule so the same list is re-checked every morning.

Input 📥

Every field, its default and when you would change it:

Field	Type	Default	When to change it
startUrls	array of strings	3 sample domains	Always — this is your domain list (the Domains field). Names, URLs or e-mail addresses; each entry produces exactly one row. domains is accepted as an alias if you prefer that name from the API.
maxItems	integer	20	Raise it before a production run: it caps how many rows (any status) the run may write, so it is your hard stop on volume.
includeDns	boolean	true	Turn off when you only want the tech stack or the certificate and do not need A, AAAA, MX, NS, TXT and CAA records.
includeEmailSecurity	boolean	true	Leave on for any spoofing or deliverability audit — it fills emailSecurity, mailProvider and dmarcPolicy. Turn off if you only care about hosting and platform.
includeTls	boolean	true	Leave on for certificate monitoring. Turn off if you are profiling domains that have no HTTPS endpoint and want to skip the handshake.
includeRdap	boolean	true	Turn off when your list is mostly ccTLDs without an RDAP service, or when you do not need registrar and expiry dates — it saves one request per domain.
includeTechStack	boolean	true	Leave on for lead scoring and competitor research. Turn off for a pure DNS/mail audit; it is the only section that fetches the homepage.

Example input — this is the default, and it runs in about 10 seconds:

{
    "startUrls": ["apify.com", "wordpress.org", "nextjs.org"],
    "maxItems": 20,
    "includeDns": true,
    "includeEmailSecurity": true,
    "includeTls": true,
    "includeRdap": true,
    "includeTechStack": true
}

How much does it cost? 💰

Pay per event, so you pay for reports and not for run time. The prices below are the whole price list:

Event	Charged when	Price
Actor start	Once per run, one event per GB of memory (one event at the default 1 GB)	$0.005
Domain report	One domain analysed successfully (status: ok)	$0.05

• 100 domains ≈ $2.01, 1,000 domains ≈ $20.01, 10,000 domains ≈ $200.01.
• Rows with status not_found or error are never charged. A list full of dead domains costs you the start fee and nothing else.
• The Actor stops gracefully when your run's maximum charge is reached, and again when maxItems rows have been written.
• The free Apify plan includes enough credit to try the Actor on a few hundred domains.

How it compares ⚖️

This Actor is built for breadth across a list, not depth on one host. Its strength is that a single $0.05 row answers questions that normally need five different lookup sites, and that the answer is structured, dated and diffable — which makes it good for scheduled monitoring and for feeding a scoring model.

It is not for you if you need a subdomain inventory, port scanning, vulnerability scanning or an audited technology census. Tech detection is fingerprint-based on the homepage only, so it is a strong signal rather than proof, and it reports null instead of guessing. If you need per-mailbox email verification, this is the wrong tool — see Limitations. And if you only ever check one domain at a time by hand, a free web lookup will do the job.

Integrations, API and AI agents 🔌

Results export to CSV, JSON, Excel, XML and HTML from the Output tab, and can be pushed straight into Google Sheets, Airtable, Slack or your CRM through Apify integrations and webhooks (n8n, Make and Zapier included). Add a Schedule to re-run the same domain list daily and diff the results.

The Actor can also be called from the Apify API (Node.js, Python or curl — see the API tab), from the Apify MCP server, or by any AI agent: the input is a plain list of strings and every row is self-describing thanks to status, error and warnings, so an agent can tell "this domain does not exist" apart from "we could not check it" without parsing prose.

FAQ ❓

Do I need any API keys or accounts? No. Every source is public and keyless: DNS-over-HTTPS, the registry's RDAP service, public ASN data, and plain HTTPS for the homepage and well-known files.

Can it check DMARC and SPF for hundreds of domains at once? Yes — that is the main use case. Each row gives you the SPF record and its all qualifier, the DMARC policy, subdomain policy, percentage and whether aggregate reporting is on, plus the DKIM selectors that answered. Sort by dmarcPolicy to find the spoofable domains first.

Does it return WHOIS data? It returns the modern equivalent: RDAP, the structured protocol that replaced WHOIS. You get registrar, creation/update/expiry dates, EPP status flags and nameservers. Registrant contact details are intentionally not returned, and for most gTLDs the registry redacts them anyway.

Can it verify e-mail addresses? No, and no HTTP-only Actor can. It tells you the mail provider and whether the domain publishes SPF, DMARC and DKIM, which is what you need to judge deliverability and spoofing risk. Mailbox-level verification needs SMTP on port 25, which Apify blocks.

Why is mailProvider set to other? The domain has MX records that do not match a known hosted provider — usually a self-hosted mail server or a niche host. Look at dns.mx for the actual exchanges.

Why did some domains cost me nothing? Because they came back not_found or error. Only ok rows are billed.

How many domains can I run at once? As many as you like; they are processed 10 at a time. Raise maxItems accordingly and use the run's maximum-charge setting as your budget cap.

Can I run it on a schedule and get alerted on changes? Yes. Schedule a daily run over your portfolio, then use a webhook or an integration to compare tlsDaysToExpiry, dmarcPolicy and registrar with yesterday's dataset.

Can I get subdomains too? Not yet. Certificate-transparency subdomain enumeration is slow and would need its own event; open an issue in the Issues tab if you need it.

Limitations 🚧

Stated plainly, so nothing surprises you:

• RDAP coverage is thin for some ccTLDs. .com, .net, .org and most new gTLDs answer well. Several country registries (.de, .jp, .ru, .eu among them) publish no RDAP service at all, and others rate-limit it. Those rows come back with rdap: null, registrar: null and a warnings entry naming the reason — the rest of the report is unaffected.
• No SMTP mailbox verification. Apify's infrastructure blocks outbound port 25, and the large mail providers refuse RCPT probing from datacenter ranges anyway. This Actor reports the mail provider and the domain's e-mail posture (SPF/DMARC/DKIM); it does not and cannot tell you whether jane@example.com exists.
• Tech detection is fingerprint-based and best-effort. It matches response headers, cookies, <meta name="generator">, script/link URLs and HTML markers against a curated rule set, on the homepage only. It will miss a technology that loads deeper in the site or behind a tag manager, and it reports null rather than guessing. Treat it as a strong signal, not as an audited inventory.
• One homepage, one moment in time. Sub-pages, staging hosts and A/B variants are not visited, and a site behind a bot wall may answer the homepage request with a challenge page — then techStack reflects that page and a warnings entry says so.
• DKIM is selector guessing. Only the six most common selectors are probed, so an empty dkimSelectorsFound does not prove that DKIM is missing.
• hosting.asn is the ASN of the first A record, which for a proxied domain is the CDN's ASN, not the origin's.
• Subdomain enumeration is not included, and neither is HSTS-preload status or port scanning.

Troubleshooting 🚦

Symptom	Fix
Row has status: not_found	The name really does not resolve. Check for a typo, or that you passed the registrable domain rather than a subdomain that was never delegated.
Row has status: error with "Invalid domain name"	The input was not a host name (a phrase, an IP address, or localhost).
rdap is null with a warning	The TLD publishes no RDAP service, or the server rate-limited the run. Re-run later, or accept it for that ccTLD.
techStack is null with a warning	The homepage refused the request or timed out. Some sites block unknown user agents; DNS, mail, TLS and RDAP data are unaffected.
cms is null on a site you know uses X	The fingerprint is not in the rule set, or the marker is not on the homepage. Report it in the Issues tab and it will be added.
Fewer rows than domains you pasted	Duplicates are removed, and maxItems or your run's maximum charge stopped the run. Check the log for "Stopping gracefully".

Privacy 🔒

This Actor is built so that it cannot collect personal data:

• ✅ RDAP contacts are never read. Only the registrar entity is parsed. Registrant, administrative and technical contacts — names, e-mail addresses, phone numbers and postal addresses — are dropped even when a registry returns them unredacted. A golden test asserts this against a registry answer that contains all of them.
• ✅ No mailbox verification, no e-mail addresses collected. The Actor never probes SMTP and never harvests addresses from pages.
• ✅ Public protocol data only — DNS records, an RDAP registry answer, a TLS certificate, a homepage response and four well-known files, all published by the domain owner on purpose.
• ✅ No login, no access controls circumvented, no captcha solving. Every request is anonymous and read-only.
• ✅ No page content is stored. The homepage HTML is fingerprinted in memory; only the detected technology names and the <title> are saved.
• ⚠️ Raw DNS records are returned verbatim in dns.txt and in emailSecurity.spf/dmarc.record. If a domain owner published a personal address inside their own DMARC rua= tag, it is part of that public record. Set includeDns and includeEmailSecurity to false if you do not want raw records at all.

Legal and data-protection notice ⚖️

This Actor reads only public protocol data that domain owners publish themselves: DNS records, RDAP registry answers, TLS certificates, homepage responses and well-known files. It does not log in, does not defeat access controls and does not extract private user data. Registrant, administrative and technical contacts are deliberately discarded before anything is written to the dataset.

Your results can still contain data that is personal in your context — a raw DNS TXT record chosen by the domain owner, for example. Personal data is protected by the GDPR in the European Union and by other regulations around the world. You should not process personal data unless you have a legitimate reason to do so; if you are unsure whether your reason is legitimate, consult your lawyers. You are responsible for complying with applicable law and with the terms of the domains you analyse.

This Actor is an independent tool. It is not affiliated with, endorsed by or sponsored by any of the registries, registrars, hosting providers or technology vendors whose names may appear in its output. All trademarks belong to their respective owners.