Domain Intel: DNS, WHOIS/RDAP, Email Security & Tech Stack

One row per domain with everything you usually need five tools for: DNS records + hosting/CDN (ASN), registration data via RDAP (the official successor of WHOIS), email security (SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI + an A–F score), website/TLS/security headers, technology stack (7,600+ open fingerprints) and optional public contact emails & social links.

Built only on open protocols and open data — no paid WHOIS, no BuiltWith API, no AI calls, no headless browser. That is why it is fast (≈ 30 domains in 10 s) and cheap.

You only pay for domains that resolve. Typos, dead and non-existent domains (NXDOMAIN), DNS errors and invalid input are returned for free with a clear error code.

Who is it for?

• Sales & lead generation – enrich a list of company domains with tech stack (Shopify? HubSpot? Salesforce?), mail provider (Google Workspace vs Microsoft 365), public emails and social profiles.
• Security audits & MSPs – spot missing DMARC, ~all SPF, too many SPF lookups, weak 1024-bit DKIM keys, missing HSTS/CSP, expiring certificates and domains.
• Agencies – pitch clients with a concrete "email deliverability & website security" report, exported to CSV.
• M&A / due diligence / brand protection – domain age, registrar, expiry date, DNSSEC, hosting provider and parked domains across a portfolio.
• AI agents – a single structured call (via API or MCP) answers "what is this company running and is its email secure?".

How to use it (step by step)

1. Open the Actor and paste domains or URLs in Domains or URLs (one per line; https://www.example.com/page, Example.COM and münchen.de are all accepted, normalized and de-duplicated).
2. Keep the defaults or switch modules off (RDAP, email security, DKIM probing, web, tech stack, contacts) to go faster.
3. Optionally set Max total charge in the run options — the Actor stops charging exactly at your limit (remaining domains get a free BUDGET_EXCEEDED row).
4. Click Start. Results appear in the Overview, Email security, Leads and Infrastructure views.
5. Download as JSON/Excel/CSV, or take the flat SUMMARY.csv from the key-value store (one line per domain, ready for spreadsheets/CRMs).

Input

Field	Default	What it does
domains	–	Domains or URLs (also accepts urls / startUrls via API)
keepSubdomains	false	Analyze blog.example.com as is instead of example.com
hostingAsn	true	Map IPs to ASN/hosting/CDN via Team Cymru DNS
rdap	true	Registrar, dates, status via RDAP (IANA bootstrap)
emailSecurity / probeDkim / dkimSelectors	true / true / []	SPF/DMARC/MTA-STS/TLS-RPT/BIMI + DKIM probing of ~30 common selectors plus yours
web / techStack / contacts	true	Homepage fetch (1 request, ≤8 redirects), TLS, headers, tech stack, emails & socials
maxConcurrency	20	Parallel domains (max 60)
maxDomains	–	Hard cap for the run
dnsResolvers	system	e.g. ["1.1.1.1","8.8.8.8"]

Output (one row per domain)

Flat columns for tables/CSV plus nested detail objects (dns, rdap, emailSecurity, web, techStack, modules, errors, timingsMs). Real example (apify.com, 2026-10-31, shortened):

{
  "domain": "apify.com", "status": "OK", "charged": true,
  "ips": ["3.170.42.100", "..."], "hostingProvider": "AWS", "asn": 16509, "dnsProvider": "Amazon Route 53",
  "mailProvider": "Google Workspace", "dnssec": true,
  "registrar": "Amazon Registrar, Inc.", "createdDate": "2009-06-02T17:14:10+00:00", "daysUntilExpiry": 3135,
  "emailSecurityScore": 100, "emailSecurityGrade": "A", "spoofingProtection": "strong",
  "spf": "present -all", "spfLookups": 10, "dmarcPolicy": "reject", "dkimSelectors": ["google"],
  "mtaSts": "enforce", "tlsRpt": true, "bimi": true,
  "finalUrl": "https://apify.com/", "httpStatus": 200, "https": true, "tlsIssuer": "Amazon",
  "securityHeadersGrade": "B", "title": "Apify: Marketplace of ready-to-run tools for AI",
  "technologies": ["Leadfeeder", "Linkedin Insight Tag", "Amazon CloudFront", "Algolia", "HSTS", "..."],
  "dnsTechnologies": ["Mixpanel", "HubSpot", "Mailgun", "..."],
  "emails": ["support@apify.com"], "socialLinks": {"x": ["https://x.com/apify"], "github": ["https://github.com/apify"]},
  "modules": {"dns": {"status": "ok"}, "rdap": {"status": "ok"}, "email": {"status": "ok"}, "web": {"status": "ok"}, "tech": {"status": "ok"}},
  "errors": []
}

technologies = evidence from the website (headers, HTML, scripts, cookies, meta). dnsTechnologies = only seen as DNS-TXT verification tokens (the company verified a domain with that vendor; it may not be in active use). techStack[] has category, version, confidence and detectedBy for each.

Status values: OK, PARTIAL (DNS resolved, some module failed — see errors), NXDOMAIN, NO_DNS_RECORDS, DNS_ERROR, INVALID_INPUT, BUDGET_EXCEEDED. Only OK and PARTIAL are charged.

Error codes (stable, per module): INVALID_DOMAIN, NXDOMAIN, DNS_NO_RECORDS, DNS_TIMEOUT, DNS_SERVFAIL, DNS_ERROR, ASN_LOOKUP_FAILED, RDAP_UNSUPPORTED_TLD, RDAP_NOT_FOUND, RDAP_RATE_LIMITED, RDAP_HTTP_ERROR, RDAP_TIMEOUT, RDAP_BAD_RESPONSE, EMAIL_TIMEOUT, WEB_DNS_ERROR, WEB_CONNECT_ERROR, WEB_TIMEOUT, WEB_TLS_ERROR, WEB_TOO_MANY_REDIRECTS, WEB_HTTP_ERROR, TLS_NO_HTTPS, TLS_CERT_INVALID, TECH_TIMEOUT, BUDGET_EXCEEDED, MODULE_CRASHED.

Email security score (0–100): SPF 25, DMARC 35, DKIM 20, MTA-STS 10, TLS-RPT 5 (the last three only if the domain receives mail), BIMI 5, normalized. A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, else F. Each problem is listed in emailSecurity.findings with code, severity and a plain-English message (e.g. SPF_TOO_MANY_LOOKUPS, DMARC_MISSING, DKIM_1024_BIT_KEY).

Pricing

Pay per event: one domain-analyzed event per domain that resolves in DNS. No start fee. Free: NXDOMAIN, DNS errors, invalid input, anything over your max total charge.

How it compares (Apify Store, checked 2026-10-31)

Actor	Scope	Price model (as listed)
Domain Intel (this)	DNS+ASN, RDAP, SPF/DMARC/DKIM/MTA-STS/TLS-RPT/BIMI score, TLS, headers, tech, contacts	per resolving domain, no start fee
BuiltWith – technology scraper (most used in the niche)	tech stack	$0.002 / result
santamaria-automations – domain WHOIS & DNS	WHOIS + DNS	$0.001 start + $0.003 / result
agenscrape – WHOIS domain lookup	WHOIS	$0.0025 / result
automation-lab – Wappalyzer technology lookup	tech stack	$0.005 start + $0.00024 / result
Email-security checkers (several, ≤ 3 monthly users each)	SPF/DMARC (some DKIM)	$0.0008–$0.006 / result
Prices and features of third-party Actors change; verify on their pages.

Use via API, integrations and MCP

Run synchronously and get the rows back (replace the token; ~ separates user and Actor name):

curl -X POST "https://api.apify.com/v2/acts/hanielazevedo~domain-intel/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' -d '{"domains":["apify.com","github.com"],"probeDkim":false}'

Python: ApifyClient(token).actor("hanielazevedo/domain-intel").call(run_input={"domains": [...]}), then read defaultDatasetId. The flat CSV is at .../key-value-stores/{defaultKeyValueStoreId}/records/SUMMARY.csv, run totals at OUTPUT.

AI agents (MCP): add Apify's MCP server (https://mcp.apify.com, e.g. https://mcp.apify.com?tools=hanielazevedo/domain-intel) to Claude, Cursor, VS Code or any MCP client; the agent gets a tool that takes domains and returns the rows above. Tip for agents: switch off probeDkim and contacts for the fastest answers.

Works with Apify integrations (Zapier, Make, n8n, Google Sheets, webhooks) and scheduling.

FAQ

Is this WHOIS? It uses RDAP, the IETF-standard JSON replacement for WHOIS that ICANN requires for gTLDs. Registries are found through the official IANA bootstrap; requests are paced per server and honour Retry-After. Why is registrant name empty? Since GDPR, registries redact personal data. We return registrant organization/country only when the registry publishes them, and never personal names. Why RDAP_UNSUPPORTED_TLD for .de, .so …? Some ccTLDs have no public RDAP service. All other modules still run. Why did DKIM say "not found" for a domain that signs mail? DKIM selectors cannot be listed; we probe ~30 common ones (Google, Microsoft 365, Mailchimp/Mandrill, SendGrid, HubSpot, Zoho, Proton, Fastmail, Mailjet, …). Add your own in dkimSelectors. Google's rotating date-based selectors are not guessable. Some sites show WEB_HTTP_ERROR 403? Some sites block non-browser clients (bot protection). DNS, RDAP and email data are still returned and the row is PARTIAL. Is it legal? It reads public DNS, public registration data and one public homepage per domain — the same as a browser. Use contact data in line with GDPR/LGPD/CAN-SPAM.

Limitations

• One homepage request, no JavaScript rendering: technologies that only appear after JS runs (or behind bot walls) are missed; DNS-only detections are reported separately.
• Hosting/CDN is inferred from ASN and CNAMEs; a site behind a CDN shows the CDN, not the origin host.
• Parked detection uses parking nameservers and page text; not exhaustive.
• RDAP coverage depends on each registry (some ccTLDs missing, some rate-limit heavily — large batches of one ccTLD can return RDAP_RATE_LIMITED).
• Results reflect DNS/web state at run time and the resolver used.

Data sources & licences

• Technology fingerprints: enthec/webappanalyzer (GPL-3.0), pinned commit, fetched unmodified at build time. Commit is reported in the run OUTPUT.
• IP→ASN: Team Cymru IP-to-ASN DNS service (free, public).
• RDAP: IANA RDAP bootstrap registry and registry/registrar RDAP servers.
• Public Suffix List via tldextract (MPL-2.0), bundled snapshot (no network).
• Libraries: dnspython (ISC), httpx (BSD), cryptography (Apache-2.0/BSD), idna (BSD), Apify SDK (Apache-2.0).