WHOIS & DNS Domain Lookup - Registrar, Age, Expiry, SSL & DMARC in One Report

Get a complete report for any list of domains in one run: who the registrar is, when the domain was created and when it expires, whether it is registered or available, all of its DNS records, whether its SSL certificate is valid and how many days are left, and how well its email is protected (SPF, DKIM, DMARC, with an A-F grade and the detected email provider).

Other actors split this into four separate tools. Here it is one row per domain, one low price, from official sources only: registry RDAP (the ICANN successor of WHOIS, with classic WHOIS as a fallback), public DNS and a normal TLS handshake.

What does WHOIS & DNS Domain Lookup do?

It takes a list of domains, URLs or email addresses and returns one row per domain: registration data from RDAP / WHOIS (registrar, creation and expiry dates, domain age, availability), all DNS records, the SSL certificate and its days to expiry, and an email-security report (SPF, DKIM, DMARC, MTA-STS, BIMI) with a 0-100 score, an A-F grade, the email provider and a plain-English list of issues.

Use cases

• Lead enrichment and qualification - company age, email provider (Google Workspace, Microsoft 365...), mail security maturity.
• Domain portfolio monitoring - schedule it daily and alert when a domain or certificate is about to expire.
• Security and deliverability audits - find clients with missing DMARC, weak SPF (+all, ?all) or expired certificates.
• Domain availability checks - registered: false means the name is free to register.
• Brand protection and due diligence - check lookalike domains, registrars and creation dates.
• AI agents - one tool call answers "who owns / hosts / secures this domain?" via the Apify MCP server.

Who is it for?

• Sales and RevOps teams qualifying leads by domain age and email provider (Google Workspace, Microsoft 365...).
• IT, security teams and MSPs auditing client domains for expiring certificates and weak DMARC.
• Email deliverability consultants checking SPF, DKIM and DMARC in bulk.
• Domain investors and brand-protection teams checking availability, registrars and creation dates.
• Developers who need a bulk WHOIS and DNS API with clean JSON.

What is checked

Area	Fields
Registration (RDAP / WHOIS)	registered, registrar, registrarIanaId, createdDate, expiresDate, updatedDate, domainAgeDays, daysUntilExpiry, status, registryNameservers, dnssec
DNS	A, AAAA, MX, NS, TXT, CAA, SOA, www CNAME/A (via 1.1.1.1 / 8.8.8.8 / 9.9.9.9)
SSL / TLS	valid, verification error, issuer, subject, validFrom, validTo, daysUntilExpiry, SAN list, TLS version
Email security	SPF record + all qualifier, DMARC record + policy + reporting, DKIM on 12 common selectors, MTA-STS, TLS-RPT, BIMI, emailProvider, 0-100 score, A-F grade
Summary	issues - a plain-English list of problems found

No personal data is collected: registrant names, emails and addresses are not read or returned.

How to use it

1. Click Try for free.
2. Paste domains, URLs or email addresses into Domains, one per line.
3. Leave all four checks on, or switch off the ones you do not need.
4. Click Start, then download the report as JSON, CSV or Excel, or read it through the API.

Input

Field	What it does	Default
domains	Domains, URLs or email addresses (reduced to the registrable domain)	apify.com, github.com, bbc.co.uk
includeWhois	Registration data	true
includeDns	DNS records	true
includeSsl	SSL certificate	true
includeEmailSecurity	SPF / DKIM / DMARC report	true
maxConcurrency	Domains processed in parallel	10

{
    "domains": ["stripe.com", "https://www.shopify.com/pricing", "ceo@example.org"]
}

Output

One dataset item per domain. Real output from a test run (the TXT and SAN lists are trimmed):

{
    "input": "apify.com",
    "domain": "apify.com",
    "registered": true,
    "registrySource": "rdap",
    "registrar": "Amazon Registrar, Inc.",
    "registrarIanaId": "468",
    "createdDate": "2009-06-02T17:14:10Z",
    "expiresDate": "2035-06-02T17:14:10Z",
    "updatedDate": "2026-05-16T16:53:04Z",
    "domainAgeDays": 6321,
    "daysUntilExpiry": 3174,
    "status": ["client transfer prohibited"],
    "registryNameservers": ["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
    "dnssec": true,
    "dns": {
        "a": ["3.170.42.100", "3.170.42.109", "3.170.42.68", "3.170.42.76"],
        "mx": ["1 aspmx.l.google.com", "5 alt1.aspmx.l.google.com", "5 alt2.aspmx.l.google.com"],
        "txt": ["openai-domain-verification=dv-WTM7Nna92Owwh4sgmDOVUyyt"],
        "caa": ["0 issue \"amazonaws.com\"", "0 issue \"letsencrypt.org\""],
        "soa": "ns-839.awsdns-40.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400"
    },
    "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com"],
    "email": {
        "emailProvider": "Google Workspace",
        "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
        "spfAll": "-all",
        "dmarcRecord": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
        "dmarcPolicy": "reject",
        "dmarcReportingEnabled": true,
        "dkimSelectorsFound": ["google"],
        "mtaSts": true,
        "tlsRpt": true,
        "score": 100,
        "grade": "A",
        "issues": []
    },
    "ssl": {
        "host": "apify.com",
        "reachable": true,
        "valid": true,
        "issuer": "Amazon",
        "subject": "*.apify.com",
        "validFrom": "2026-07-03T00:00:00Z",
        "validTo": "2027-01-16T23:59:59Z",
        "daysUntilExpiry": 116,
        "sanCount": 4,
        "tlsVersion": "TLSv1.3"
    },
    "issues": [],
    "processingTimeMs": 279,
    "error": null
}

For a domain that is not registered you get "registered": false and the issue "Domain is not registered (available)".

How much does a bulk WHOIS and DNS lookup cost?

Pay per event: $0.003 per domain analyzed ($3 per 1,000 domains) - registration, DNS, SSL and email security all included. Invalid inputs and domains where every lookup failed are free.

Worked examples:

• Enrich 5,000 lead domains = $15
• Monitor a 200-domain portfolio every day for a month = 6,000 lookups = $18
• The default demo run (3 domains) = $0.009

Set Maximum cost per run and the actor stops cleanly when it is reached.

Integrations and API

Run it from your own code with the official apify-client package (Python shown; JavaScript works the same way):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("kantolabs/domain-whois-dns-ssl-lookup").call(run_input={
    "domains": [
        "stripe.com",
        "shopify.com"
    ]
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

Or get the results in a single HTTP call:

curl -X POST "https://api.apify.com/v2/acts/kantolabs~domain-whois-dns-ssl-lookup/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["stripe.com", "shopify.com"]}'

• AI agents (MCP): add the Apify MCP server to Claude, ChatGPT, Cursor or any MCP client and the agent can call this Actor as a tool.
• No-code: Make, Zapier, n8n, Google Sheets, webhooks and Apify Schedules work out of the box.

Limits

• No registrant personal data is read or returned (names, emails and addresses of owners).
• Country domains without RDAP fall back to classic WHOIS, which can be sparse (for example .de publishes only the status).
• DKIM is checked on 12 common selectors; a domain that signs with a custom selector can show no DKIM.
• registered: false means the registry has no record of the name; it is not a price or purchase check.

FAQ

Why RDAP and not WHOIS? RDAP is ICANN's official, structured replacement for WHOIS and is mandatory for all generic TLDs. For country TLDs without RDAP the actor falls back to classic WHOIS (port 43), so fields may be sparser there (for example .de only publishes the status).

Why is registrar sometimes the company itself? Some registries (for example Nominet for .uk) list large organisations that act as their own registrar.

How is the email grade calculated? MX 10 points, SPF up to 25 (strict -all / ~all), DMARC up to 35 (reject 35, quarantine 28, none 12), DKIM 20, MTA-STS 5, TLS-RPT 5. A >= 85, B >= 70, C >= 50, D >= 30, else F.

Can I pass subdomains? Yes. Registration and DNS are reported for the registrable domain, and the SSL certificate is checked on the exact host you entered.

Something is not working? Open an issue on the Issues tab - it is answered quickly.

Related Actors by Kanto Labs

• Domain Authority Checker - bulk 0-100 authority from open web data
• Company Enrichment - logo, socials, industry and size from a domain
• Website Tech Stack Detector - what a website is built with