Domain Reputation Checker: RDAP Lookup, DNS, SPF & DMARC

Domain Reputation Checker checks domain reputation and email authentication in bulk. It looks up any domain in the official registry (RDAP, the modern WHOIS alternative), checks its DNS, SPF, DMARC, DNSSEC and CAA records, its TLS certificate and HTTPS setup, and gives a transparent domain reputation and phishing risk score.

Made for security teams, MSPs, email and marketing teams, IT admins and domain investors. Output: domain records as a dataset (JSON or CSV), with explained scores, plus an optional HTML report. It can also monitor a list for expiry and DNS changes, and run a bulk domain availability check. Use it as a domain reputation API, in Apify Console, or as a tool for AI agents through the Apify MCP server. Every value comes from a real public source. No AI guesses, no paid APIs, no API keys needed.

Use with AI agents (MCP)

This Actor is an AI agent / MCP tool. Through the hosted Apify MCP server, Claude, Cursor, VS Code, ChatGPT or any MCP client can call it, read the input fields below as the tool's docs, and get the results as JSON.

• This tool only: https://mcp.apify.com/?tools=j0l30/domain-rdap-dns-reputation-checker
• All 5 Lycorax tools: https://mcp.apify.com/?tools=j0l30/shopify-seo-alt-text-fixer,j0l30/woocommerce-seo-alt-text-fixer,j0l30/website-image-seo-audit,j0l30/domain-rdap-dns-reputation-checker,j0l30/website-exposure-defense-knowledge

Sign in with Apify (OAuth) when your client asks, or send the header Authorization: Bearer <APIFY_TOKEN>. Runs are billed to your Apify account at the prices in "How much does it cost?". The tool returns the run and its datasetId; the agent then reads the rows with get-dataset-items, which the server adds for you.

Claude Desktop / claude.ai: Settings → Connectors → Add custom connector → paste the URL as Remote MCP server URL.

Claude Code:

$claude mcp add --transport http lycorax "https://mcp.apify.com/?tools=j0l30/domain-rdap-dns-reputation-checker"

Cursor (~/.cursor/mcp.json, or .cursor/mcp.json in your project):

{ "mcpServers": { "lycorax": { "url": "https://mcp.apify.com/?tools=j0l30/domain-rdap-dns-reputation-checker" } } }

VS Code (.vscode/mcp.json):

{ "servers": { "lycorax": { "type": "http", "url": "https://mcp.apify.com/?tools=j0l30/domain-rdap-dns-reputation-checker" } } }

ChatGPT (Developer mode on): Settings → Apps & Connectors → Create → MCP Server URL = the URL, Authentication = OAuth. ChatGPT can't change a connector's tools later, so pick the one-tool or the all-tools URL first.

Swap in the all-tools URL to give your agent every Lycorax tool at once.

Example prompts

1. "Check example.com, iana.org and paypa1-login.com. Flag lookalikes of the brand "paypal" (I own paypal.com) and tell me which domains have no DMARC enforcement."
2. "Are lycorax.com, lycorax.app and lycorax.dev registered? Use availability mode."
3. "For this list of 50 vendor domains, which expire within 30 days, have no SPF record, or have a TLS certificate ending within 14 days?"

Read-only lookups from public registry (RDAP), DNS-over-HTTPS and TLS data. Nothing is sent to the domains beyond one homepage request when checkHttp is on.

Output sample. One item from a real run for example.com (shortened). Nested rdap, dns, tls, risk and hygiene objects hold the details; availability mode returns type availability rows.

{"type": "domain", "domain": "example.com", "registration_status": "registered", "registrar": "RESERVED-Internet Assigned Numbers Authority", "age_days": 11387, "days_to_expiry": 299, "lifecycle": "active", "nameservers": ["elliott.ns.cloudflare.com", "hera.ns.cloudflare.com"], "mx": [], "spf_all": "-all", "dmarc_policy": "reject", "dnssec": true, "risk": {"score": 0, "level": "low", "breakdown": []}, "hygiene": {"score": 92, "checks": [{"check": "caa", "points": 0, "max": 5, "passed": false, "detail": "no CAA"}]}}

Other Lycorax tools: Shopify Alt Text Generator · WooCommerce Alt Text Generator · Image SEO Checker for Any Website · Website Exposure Audit & Dorks List for Defense.

What does it do?

• RDAP lookup (WHOIS alternative). Registrar, IANA ID, creation, expiry and last-changed dates, domain age, EPP status codes, nameservers and DNSSEC delegation, straight from the registry listed in the IANA RDAP bootstrap. RDAP is the IETF standard (RFC 9082/9083) that ICANN made the official replacement for port-43 WHOIS in 2025.
• DNS, SPF and DMARC checker. A, AAAA, MX (including null MX), NS, TXT, SPF (-all, ~all, +all, multiple records, over 10 lookups), DMARC policy and pct, CAA and DNSSEC (DS record plus resolver validation), through Cloudflare and Google DNS-over-HTTPS.
• TLS certificate. One direct handshake on port 443: trusted or not, issuer, validity dates, days left.
• Homepage security check. One request to http://domain/, following redirects by hand: does it redirect to HTTPS, HSTS, CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy, and whether the homepage shows a login form.
• Phishing and typosquat detection. Punycode/IDN names, mixed scripts (Latin + Cyrillic), lookalike characters (аpple.com with a Cyrillic а, paypa1, rn for m), brand keywords, names 1-2 letters from your brand, lure words (login, verify, wallet...), newly registered domains (under 30 days), login form with no mail records, registry hold status.
• Risk score 0-100 (higher = riskier) with a per-signal breakdown, so you can see exactly why. Hygiene score 0-100 (higher = better) for email authentication, DNSSEC, CAA, TLS and headers.
• Domain investor score. A simple, open heuristic: length, TLD, hyphens, digits, common words, pronounceability and age. It is not a price. We never invent dollar valuations.
• Expired domain and availability check. Give candidate names, or keywords × TLDs (plus prefixes and suffixes), and get each one's RDAP status. "Not found in RDAP" is labelled likely available, confirm at a registrar. Registered names in pending delete or redemption period are flagged as dropping soon.
• Monitoring. Saves a snapshot per domain in a named key-value store in your account. Next run, it alerts on: domain expiring within N days, registrar, nameserver, MX or A record changes, status changes, TLS certificate expiring, risk score jump, or a domain that dropped. Schedule it daily or weekly in Apify.
• Optional certificate transparency via crt.sh: unexpired certificates and hostnames seen in public CT logs.
• Optional blocklists with your own keys. Your Google Safe Browsing / Web Risk key or your abuse.ch URLhaus Auth-Key. Stored as secret inputs and sent only to those services.

Who is it for?

• Security teams and MSPs: brand protection, phishing and lookalike-domain triage, email spoofing gaps (SPF/DMARC) across client domains.
• Domain investors: bulk availability, drop-soon status and a transparent name-quality score.
• SEO and marketing teams: domain age, expiry and redirects of your own and partner sites, without paid WHOIS APIs.
• IT admins: never let a domain or certificate expire again.
• AI agents and MCP clients: clean JSON with explained scores.

How much does it cost?

Pay per result. Apify platform usage is included.

Event	Price	When
domain-check	$0.004 per domain	Check and monitor modes: full RDAP + DNS + TLS + HTTP + scores
availability-check	$0.001 per candidate	Availability mode: RDAP status of one name
report	$0.05 per run	Optional summary report.json + report.html (turn off with generateReport: false)

1,000 domains fully checked cost $4. 1,000 availability checks cost $1. Invalid or duplicate inputs are free. CSV export is always free. If you set a maximum cost per run, the Actor stops at your limit and never produces unpaid results.

How to use it

1. Pick a mode: check, monitor or availability.
2. Add your domains (or candidates/keywords for availability). URLs and subdomains are fine.
3. Optionally add brand keywords and your own domains for typosquat detection.
4. Run. Open the Overview, DNS & email security, TLS & web security, Monitor alerts or Availability view, or download domains.csv / availability.csv and report.html from the key-value store.

For monitoring, use the same monitorStoreName every time and add a schedule in Apify Console.

Input example

{
  "mode": "check",
  "domains": ["example.com", "iana.org", "paypa1-login.com"],
  "brandKeywords": ["paypal"],
  "ownedDomains": ["paypal.com"]
}

Output example (shortened)

{
  "domain": "iana.org",
  "registration_status": "registered",
  "registrar": "CSC Corporate Domains, Inc.",
  "created": "1995-06-05T04:00:00Z",
  "expires": "2027-12-08T17:00:00Z",
  "age_days": 11457,
  "nameservers": ["a.iana-servers.net", "..."],
  "spf_all": "redirect", "dmarc_policy": "none", "dnssec": true,
  "tls_issuer": "Sectigo Limited", "tls_days_left": 80,
  "https_redirect": true, "hsts": true,
  "risk_score": 0, "risk_level": "low", "risk_reasons": [],
  "hygiene_score": 85, "investor_score": 79,
  "risk": { "breakdown": [] },
  "hygiene": { "checks": [{ "check": "dmarc_enforced", "points": 0, "max": 15, "passed": false, "detail": "p=none" }] }
}

How the scores work

Risk (0-100, capped). Points per signal: blocklist hit 60, lookalike of your brand 40, typosquat of your brand 30, brand keyword 20, brand on a TLD you don't own 15, registered under 30 days 25 (under 90 days 10), mixed scripts 20, punycode 10, lure words 10, 3+ hyphens 5, login form with no MX 15, login form on a young domain 15, registry hold 15, no HTTPS 10, invalid or expired certificate 10. Levels: low < 20, medium 20-49, high 50-74, critical 75+.

Hygiene (0-100). SPF with -all/~all 10, DMARC quarantine/reject 15, DNSSEC 10, CAA 5, two or more nameservers 5, valid TLS with 14+ days 20, HTTPS redirect 10, HSTS 10, 4+ other security headers 15. Shown as a percentage of the checks that ran.

Investor score (0-100). Length up to 30, TLD up to 25 (.com 25, .net/.org 14, .io/.ai 12...), no hyphens 10, no digits 10, made of common English words 10, pronounceable 5, age up to 10. A rough guide to name quality, nothing more.

FAQ

Is RDAP the same as WHOIS? RDAP returns the same registration data in structured JSON over HTTPS, with standard error codes and privacy redaction built in. ICANN sunset the WHOIS requirement for gTLDs in January 2025, so RDAP is now the reference source.

Why is my TLD "unknown"? Some country-code TLDs (for example .io, .co, .de, .ma, .eu at the time of writing) publish no RDAP server in the IANA bootstrap. We then use DNS: if the domain is delegated, it is registered; if not, it may be available and you should check at a registrar.

Does "not found in RDAP" mean I can buy it? Very likely, but not always. Registries can reserve, block or premium-price names. Always confirm at a registrar.

Which blocklists are built in? None. The free lists we reviewed restrict commercial use (Spamhaus DBL, and abuse.ch beyond fair use), so we don't bundle them. Add your own Google Safe Browsing / Web Risk key or abuse.ch Auth-Key if you have one.

Can it check subdomains? Inputs are reduced to the registrable domain (blog.example.co.uk → example.co.uk), since that is what registries and DNS policy apply to.

Can I use it as an email domain reputation checker? Yes, for the DNS side of email: MX (including null MX), SPF and DMARC policy, scored in the hygiene score. It doesn't check DKIM (selectors aren't published) or mail server blocklists.

Is it an RDAP lookup tool for bulk lists? Yes. Paste hundreds of domains, or call the API, and get one structured record per domain.

How it compares (honestly)

• WHOIS and RDAP lookup websites: they usually check one domain at a time in a browser. This runs lists in bulk and returns structured JSON or CSV, with DNS, email authentication, TLS and scores in the same record.
• Dedicated DMARC and email deliverability tools: they go deeper on email, for example DKIM, DMARC aggregate reports and blocklist checks. This Actor reads SPF and DMARC policy from DNS only.
• Commercial threat-intelligence and domain reputation APIs: they bundle proprietary blocklists and historical records. This one bundles no blocklists (bring your own key) and keeps history only in your own monitoring snapshots. Its scores are open heuristics you can read line by line.

More tools from the same publisher

• Shopify Alt Text Generator: bulk alt text audit and auto-fix for Shopify product images.
• WooCommerce Alt Text Generator: the same for WooCommerce products and WordPress media, with a WP-CLI script.
• Image SEO Checker for Any Website: image SEO and alt text checks on any CMS, with white-label PDF reports.
• Website Exposure Audit & Dorks List for Defense: playbooks to find and fix leaked files on sites you own.

Legal and responsible use

• Public data only. RDAP registries, public DNS resolvers, a TLS handshake and the public homepage: what any browser or mail server sees. No logins, and it never bypasses rate limits, captchas or blocks.
• No personal data stored. Registrant names, emails, phone numbers and street addresses are discarded before anything is saved. A registrant organisation and country are kept only when the registry shows them unredacted and the record is clearly an organisation. The registrar's abuse mailbox is kept because it is a role address used to report abuse.
• Polite by design. Identifies itself as LycoraxDomainCheck, waits 0.5 s between requests to one RDAP server, 1 s between requests to one website, 3 s for crt.sh, retries at most twice and honours Retry-After. Only the homepage is requested; no other pages are crawled.
• Your keys, your terms. Optional Safe Browsing / Web Risk and abuse.ch keys are yours. Follow their terms (the free Safe Browsing API is non-commercial; Google Web Risk is the commercial option).
• Not a security guarantee. Scores are deterministic heuristics from public signals. A low score does not prove a domain is safe, and a high score does not prove it is malicious. Verify before you take action against anyone.
• Data accuracy. RDAP and DNS data come from registries, registrars and resolvers and can be incomplete, redacted, delayed or wrong. Expiry dates shown by some registries may differ from the registrar's own date.
• Not affiliated with ICANN, IANA, Verisign, Cloudflare, Google, abuse.ch, crt.sh / Sectigo or any registrar or brand named here. Brand names in examples are used only to describe typosquat detection. Trademarks belong to their owners.
• Your responsibility. Use the results lawfully, for example to protect your own brand, monitor your own or your clients' domains, or research public data.

Privacy

No tracking. Results stay in your own Apify storage. Calls go only to IANA, the registry's RDAP server, the DNS-over-HTTPS resolvers, the domain itself, and (only if you turn them on) crt.sh and the blocklist services whose keys you supply. Built by Youssef Ferri / Lycorax Technologies.