Domain WHOIS DNS SSL Lookup — OSINT & Security Audit

Bulk domain WHOIS lookup, DNS, SSL and security audit API. Paste domains or URLs and get WHOIS/RDAP, DNS records, SSL certificates, CT subdomains, security headers score, SPF/DMARC/DKIM, tech stack, IP/ASN and a reputation score — one clean JSON record per domain (~$3 per 1,000 domains).

Most WHOIS scrapers return registrar and expiry date, then stop. This Actor replaces five or six separate tools with one bulk-friendly run, billed per successfully analyzed domain.

What you get for every domain

Module	Data returned
WHOIS / RDAP	Registrar, IANA ID, creation / update / expiry dates, ageDays, daysUntilExpiry, name servers, EPP status, DNSSEC flag
DNS	A, AAAA, MX, TXT, NS, CNAME and SOA records
SSL / TLS	Issuer, subject, validFrom, validTo, daysRemaining, trust status, protocol, SAN list
Subdomains	Deduplicated subdomains from public Certificate Transparency logs (crt.sh), capped at your limit
Security headers	HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus a 0–100 securityScore and letter grade
Email authentication	SPF policy, DMARC policy/reporting, DKIM detection on 37 common selectors, email provider (Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Mimecast and more)
Tech stack	Web server, CDN/WAF, CMS, frameworks, analytics and more from headers, cookies and HTML hints
IP & ASN	Primary IPv4/IPv6, ASN, organization, BGP prefix, country
Reputation	0–100 heuristic score, risk level, explainable signals, DNSBL blacklisted flag

Who uses it

• Security & threat-intel teams — triage suspicious or newly registered domains, spot missing email auth, expired certificates and weak headers.
• Sales & lead-gen teams — enrich a prospect list with tech stack, email provider and domain age before outreach.
• SEO & agencies — audit client and competitor domains: expiry risk, CMS, CDN, security posture.
• Domain investors & brand protection — monitor expiry dates, registrars and name-server changes.
• IT / compliance — verify SPF, DMARC, HSTS and certificate validity across a whole portfolio.

Why it beats WHOIS-only tools

• RDAP, not fragile WHOIS parsing. Structured JSON straight from registries via RDAP, with automatic fallback to the IANA bootstrap.
• Eleven signals in one record. No stitching together separate DNS, SSL, header and email tools.
• Built for bulk. Concurrency control, per-module timeouts and domain deduplication.
• Never fails the whole run. One slow or blocked source adds an entry to that domain's errors array; everything else is still delivered.
• Validated output. Every record is checked against a strict schema before it is saved, so your downstream code gets a stable format.
• Pay only for results. You are charged per successfully analyzed domain, not for invalid input or domains that don't exist.

Input

{
  "domains": ["apify.com", "https://www.github.com/apify", "example.org"],
  "includeWhois": true,
  "includeDns": true,
  "includeSsl": true,
  "includeSubdomains": true,
  "includeSecurityHeaders": true,
  "includeEmailAuth": true,
  "includeTechDetect": true,
  "includeReputation": true,
  "concurrency": 5,
  "timeoutSecs": 30
}

• domains (required) — domains or full URLs. Entries are normalized to the registrable domain (https://www.Shop.Example.co.uk/path → example.co.uk), IDNs are converted to punycode, and duplicates are removed. IP addresses and invalid entries are skipped and reported in the log.
• include* — switch modules on or off. Turn off what you don't need to speed up large runs (subdomain lookup is the slowest).
• includeNetwork — IP and ASN lookup (on by default).
• maxSubdomains — cap per domain (default 100).
• concurrency — domains analyzed in parallel (default 5, max 50).
• timeoutSecs — timeout applied to each network module (default 30).

Output example

{
  "domain": "apify.com",
  "status": "ok",
  "analyzedAt": "2026-10-11T08:30:12.481Z",
  "summary": {
    "registrar": "Amazon Registrar, Inc.",
    "ageDays": 6339,
    "daysUntilExpiry": 3156,
    "ip": "18.66.102.102",
    "asn": "AS16509",
    "asnOrg": "AMAZON-02 - Amazon.com, Inc., US",
    "sslDaysRemaining": 98,
    "securityScore": 75,
    "reputationScore": 95,
    "blacklisted": false,
    "emailProvider": "Google Workspace",
    "subdomainCount": 35,
    "technologies": ["Amazon CloudFront", "Next.js", "Google Tag Manager"]
  },
  "whois": { "...": "..." },
  "dns": { "...": "..." },
  "ssl": { "...": "..." },
  "subdomains": { "...": "..." },
  "securityHeaders": { "...": "..." },
  "tech": { "...": "..." },
  "emailAuth": { "...": "..." },
  "network": { "...": "..." },
  "reputation": { "...": "..." },
  "errors": []
}

Each record has a status: ok (everything requested succeeded), partial (some modules reported errors) or failed (no evidence the domain exists or every module failed). The errors array lists { module, code, message } for anything that went wrong.

At the end of each run a RUN_STATS record is saved to the key-value store: domains analyzed, ok/partial/failed counts, charged events, duration and error counts per module.

Pricing

Pay-per-event pricing:

Event	Price	When it is charged
domain-analyzed	$0.003 (about $3 per 1,000 domains)	One domain successfully analyzed

Domains that fail entirely (for example unregistered domains) are returned with status: "failed" and are not charged. The Actor respects your maximum run cost and stops cleanly when the limit is reached.

Good to know

• Reputation score is a heuristic. It combines domain age, certificate health, email authentication, header posture, registry status and blocklists. It is a triage aid, not a verdict. It is most accurate when WHOIS, DNS, SSL, security headers and email modules are all enabled.
• DNSBL checks can soft-fail. Spamhaus blocks queries from some public resolvers; when that happens the list is marked inconclusive and blacklisted stays false. Check reputation.blacklistCheck (clean, listed, inconclusive).
• DKIM is best-effort. DKIM selectors can't be enumerated, so 37 common ones are probed. "Not found" does not prove DKIM is missing.
• RDAP coverage varies. Some country-code TLDs don't publish RDAP; those domains get a whois error but still receive every other module.
• Subdomains come from Certificate Transparency. Great coverage for HTTPS hosts, but it won't list internal names that never received a public certificate. crt.sh is a free community service and can be slow or return errors under load; the Actor retries once and then records an error.
• Passive and polite. The Actor performs normal DNS queries, a TLS handshake and a single homepage request per domain. No port scanning or intrusive probing.

Use with AI agents (MCP)

Works with the Apify MCP server:

{
  "mcpServers": {
    "apify": {
      "type": "http",
      "url": "https://mcp.apify.com/?tools=fetch-actor-details,call-actor,invincible_brookbed/domain-intel-suite"
    }
  }
}

Authenticate via OAuth or an Apify API token. Agents can inspect the schema and call this Actor for domain due diligence.

FAQ

Can I analyze subdomains directly? Entries are reduced to their registrable domain. Subdomains are discovered through the subdomain module.

Can I run it via API or on a schedule? Yes. Use the Apify API, schedules, webhooks or integrations (Make, Zapier, n8n) to monitor domains continuously.

How fast is it? Without subdomain lookup, a domain typically takes a few seconds. Raise concurrency for large lists.

Questions or feature requests? Open an issue on the Actor page.