# Domain WHOIS Lookup (RDAP) + DNS, MX, SPF and DMARC (`groundtruth/domain-intel`) Actor

Bulk domain lookup from official sources. For each domain: registrar, created, updated and expiry dates, domain age, status, nameservers and DNSSEC from the registry's RDAP server, plus DNS records, the email provider behind the MX, and SPF and DMARC policy. No registrant personal data.

- **URL**: https://apify.com/groundtruth/domain-intel.md
- **Developed by:** [Ground Truth](https://apify.com/groundtruth) (community)
- **Categories:** Developer tools, SEO tools, AI
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 domain lookups

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Domain WHOIS Lookup (RDAP) + DNS, MX, SPF and DMARC

Give it a list of domains. For each one you get who the registrar is, when it was registered and when it expires,
whether it is registered at all, its nameservers and DNS records, which email provider handles its mail, and
whether it publishes SPF and DMARC. Data comes from the registries' own RDAP servers and public DNS resolvers.
Every record links to the source it came from.

### When to use it

- Check a list of domains from a CRM, a lead list or a CSV: which are still registered, which expire soon, how old each is.
- Find which companies run Google Workspace, Microsoft 365, Zoho, Proofpoint or Mimecast, from their MX records.
- Audit email authentication across a portfolio: who has SPF, who has DMARC, and whether DMARC is `none`, `quarantine` or `reject`.
- Screen domains before you buy, rank or block them: registration age, registrar, status codes such as `client hold`.
- Spot names that are free to register: `registered: false` when the registry itself answers "not found".

**For an AI agent:** call it when you need hard, checkable facts about a domain (is it registered, how old, who hosts
its mail, does it have DMARC) instead of guessing from a web page.

### What it does not do

- It returns **no registrant data**: no owner name, email, phone or address, even when a registry sends them. Only the registrar, a company, is kept.
- It does not use WHOIS port 43 and does not scrape any site. For a TLD with no RDAP server (many country codes, for example .ru, .cn, .jp, .ch) it returns DNS data only and sets `rdap_available` to `false`.
- A few registries publish limited RDAP data. .de returns status and nameservers but no registrar or dates, and the record says so in `notes`.
- DNS answers reflect the public resolvers at the time of the run. It does not read DKIM keys or website content.
- `email_provider` is judged from MX hostnames. An unrecognised MX is `Other (not a recognised provider)`, never a guess.

### Sample output

Input:

```json
{ "domains": ["google.com", "this-domain-does-not-exist-q8z1x.com"] }
```

Output for the first domain (trimmed to the main fields, run on 2026-10-18):

```json
{
  "domain": "google.com",
  "lookup_status": "ok",
  "registered": true,
  "registered_basis": "rdap",
  "registrar": "MarkMonitor Inc.",
  "registrar_iana_id": 292,
  "created_date": "1997-09-15",
  "updated_date": "2019-09-09",
  "expiry_date": "2028-09-14",
  "domain_age_days": 10625,
  "days_until_expiry": 697,
  "status_codes": ["client delete prohibited", "client transfer prohibited", "client update prohibited",
                   "server delete prohibited", "server transfer prohibited", "server update prohibited"],
  "nameservers": ["ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com"],
  "dnssec_signed": false,
  "dns_mx": [{ "priority": 10, "host": "smtp.google.com" }],
  "email_provider": "Google Workspace",
  "email_provider_category": "mailbox",
  "has_spf": true,
  "spf_record": "v=spf1 include:_spf.google.com ~all",
  "spf_policy": "softfail",
  "has_dmarc": true,
  "dmarc_record": "v=DMARC1; p=reject; rua=mailto:***@google.com",
  "dmarc_policy": "reject",
  "verify_url": "https://rdap.verisign.com/com/v1/domain/google.com"
}
```

The second domain comes back as `registered: false`, `rdap_status: "not_found"`, `dns_status: "nxdomain"`.

**Check it yourself.** Open the `verify_url`: it is the exact registry RDAP record the answer was read from. For DNS,
open `dns_verify_url`, or run `nslookup -type=MX google.com`. To compare with classic WHOIS, query the registry at
whois.verisign-grs.com: the creation date, expiry date and registrar IANA id will match. Registrar numbers can be
checked in the IANA Registrar IDs registry (292 is MarkMonitor Inc.).

**A handled error.** Input such as `"exa mple..com"`, `"192.168.0.1"` or `12345` is skipped with a plain reason in the
run log and in the `SKIPPED_INPUTS` record, and is not charged. If every entry is unusable the run stops with a
message that says so.

### Input

| Field | Type | Required | Default | Meaning |
|---|---|---|---|---|
| `domains` | list of text | yes | example.com, iana.org, wikipedia.org | Up to 5,000 per run. Names, URLs, `www.` hosts and email addresses are reduced to the registered domain (`https://www.bbc.co.uk/news` becomes `bbc.co.uk`). Unicode names are converted to punycode. Duplicates are looked up once. |
| `lookup_rdap` | true or false | no | true | Registry data: registrar, dates, status, nameservers, DNSSEC, registered or not. |
| `lookup_dns` | true or false | no | true | A, AAAA, MX, NS, TXT, email provider, SPF, DMARC. |

### Output fields

| Field | Meaning |
|---|---|
| `input`, `domain`, `domain_unicode`, `tld` | What you gave, the registered domain looked up, its unicode form if different, and its TLD |
| `lookup_status` | `ok`, `partial` (one source did not answer) or `error` (none did, not charged) |
| `checked_date` | The UTC date of the lookup |
| `registered`, `registered_basis` | `true` or `false` with `rdap`, or `true` with `dns` for TLDs without RDAP (a delegation exists). `null` when it cannot be told |
| `rdap_available`, `rdap_status`, `rdap_server` | Whether the TLD has an RDAP server; `ok`, `not_found`, `no_rdap_for_tld`, `rate_limited`, `error` or `skipped`; the server used |
| `registrar`, `registrar_iana_id` | The registrar company and its IANA id |
| `created_date`, `updated_date`, `expiry_date` | UTC dates from the registry |
| `domain_age_days`, `days_until_expiry` | Counted from the registry dates to the check date. Negative days to expiry means the domain is past its expiry date |
| `status_codes`, `nameservers`, `dnssec_signed` | EPP status codes, registry nameservers, whether the delegation is DNSSEC signed |
| `dns_status` | `ok`, `partial`, `nxdomain` (name does not exist), `servfail`, `error` or `skipped` |
| `dns_a`, `dns_aaaa`, `dns_mx`, `dns_ns`, `dns_txt` | Resolved records. MX is a list of priority and host. TXT is capped at 100 records, and email addresses inside them are masked as `***@domain` |
| `email_provider`, `email_provider_category` | From the best-priority MX hosts. Category is `mailbox`, `gateway` (a filter such as Proofpoint or Mimecast in front of a mailbox system), `forwarding`, `other` or `none` (a null MX, RFC 7505) |
| `has_spf`, `spf_record`, `spf_policy` | SPF presence, the record, and its closing `all`: `fail`, `softfail`, `neutral` or `pass` |
| `has_dmarc`, `dmarc_record`, `dmarc_policy`, `dmarc_subdomain_policy`, `dmarc_pct` | DMARC presence and the policy tags. Report mailbox names are masked |
| `notes` | Anything worth knowing: a URL reduced to its domain, a registry with limited data, two SPF records |
| `verify_url`, `dns_verify_url` | The RDAP record the data came from (or a public DNS lookup where the TLD has no RDAP), and a public DNS lookup of the MX records |

### Errors and what to do

| What you see | Meaning | What to do |
|---|---|---|
| `lookup_status: "partial"` or `"error"` | A registry or resolver did not answer | Re-run those domains. It does not mean the domain is unregistered |
| `rdap_status: "rate_limited"` | The registry asked us to slow down and we stopped asking after two backoffs | Re-run later, or in smaller batches |
| `rdap_status: "no_rdap_for_tld"` | The TLD has no RDAP server | Use the DNS fields. `registered` is `true` only if nameservers exist |
| `registered: false` | The registry itself answered "not found" | The name is not registered (or has been released) |
| Entry skipped in the log | Not a usable domain | Fix the entry; skipped entries are not charged |

### Pricing

Pay per event: **$0.002 per domain looked up** (about $2 per 1,000), plus Apify's small start event. You are not
charged for invalid entries, duplicates, or a domain where every source failed.

### Sources and licensing

Registry RDAP servers (served under their own terms), the IANA RDAP bootstrap file, Cloudflare and Google public DNS
over HTTPS, and the Public Suffix List (Mozilla Public License 2.0). Details and the full testing record are in
SOURCES.md.

# Actor input Schema

## `domains` (type: `array`):

Domains to look up, one per line. Plain names (example.com), URLs and www hosts are fine: each is reduced to the registered domain. Up to 5,000 per run. Duplicates are looked up once.

## `lookup_rdap` (type: `boolean`):

Registrar, registration, update and expiry dates, domain age, status codes, nameservers and DNSSEC from the registry's official RDAP server. Also tells you whether the domain is registered.

## `lookup_dns` (type: `boolean`):

A, AAAA, MX, NS and TXT records over DNS-over-HTTPS, plus the email provider behind the MX records and the SPF and DMARC policy.

## Actor input object example

```json
{
  "domains": [
    "example.com",
    "https://www.bbc.co.uk/news",
    "bücher.de"
  ],
  "lookup_rdap": true,
  "lookup_dns": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `resultsCsv` (type: `string`):

No description

## `runDetails` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com",
        "iana.org",
        "wikipedia.org"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("groundtruth/domain-intel").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "example.com",
        "iana.org",
        "wikipedia.org",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("groundtruth/domain-intel").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com",
    "iana.org",
    "wikipedia.org"
  ]
}' |
apify call groundtruth/domain-intel --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,groundtruth/domain-intel"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/F2nyrEEq76abPoK3a/builds/aD6wnxBx6hAURgaX1/openapi.json