Domain Lookup - WHOIS/RDAP, DNS, SSL Certificate & Email Security in One Report

Get a complete report for any list of domains in one run: who the registrar is, when the domain was created and when it expires, whether it is registered or available, all of its DNS records, whether its SSL certificate is valid and how many days are left, and how well its email is protected (SPF, DKIM, DMARC, with an A-F grade and the detected email provider).

Other actors split this into four separate tools. Here it is one row per domain, one low price, from official sources only: registry RDAP (the ICANN successor of WHOIS, with classic WHOIS as a fallback), public DNS and a normal TLS handshake.

What you can use it for

• Lead enrichment and qualification - company age, email provider (Google Workspace, Microsoft 365...), mail security maturity.
• Domain portfolio monitoring - schedule it daily and alert when a domain or certificate is about to expire.
• Security and deliverability audits - find clients with missing DMARC, weak SPF (+all, ?all) or expired certificates.
• Domain availability checks - registered: false means the name is free to register.
• Brand protection and due diligence - check lookalike domains, registrars and creation dates.
• AI agents - one tool call answers "who owns / hosts / secures this domain?" via the Apify MCP server.

What is checked

Area	Fields
Registration (RDAP / WHOIS)	registered, registrar, registrarIanaId, createdDate, expiresDate, updatedDate, domainAgeDays, daysUntilExpiry, status, registryNameservers, dnssec
DNS	A, AAAA, MX, NS, TXT, CAA, SOA, www CNAME/A (via 1.1.1.1 / 8.8.8.8 / 9.9.9.9)
SSL / TLS	valid, verification error, issuer, subject, validFrom, validTo, daysUntilExpiry, SAN list, TLS version
Email security	SPF record + all qualifier, DMARC record + policy + reporting, DKIM on 12 common selectors, MTA-STS, TLS-RPT, BIMI, emailProvider, 0-100 score, A-F grade
Summary	issues - a plain-English list of problems found

No personal data is collected: registrant names, emails and addresses are not read or returned.

Input

Field	What it does	Default
domains	Domains, URLs or email addresses (reduced to the registrable domain)	apify.com, github.com, bbc.co.uk
includeWhois	Registration data	true
includeDns	DNS records	true
includeSsl	SSL certificate	true
includeEmailSecurity	SPF / DKIM / DMARC report	true
maxConcurrency	Domains processed in parallel	10

{
    "domains": ["stripe.com", "https://www.shopify.com/pricing", "ceo@example.org"]
}

Output

One dataset item per domain. Real output from a test run (the TXT and SAN lists are trimmed):

{
    "input": "apify.com",
    "domain": "apify.com",
    "registered": true,
    "registrySource": "rdap",
    "registrar": "Amazon Registrar, Inc.",
    "registrarIanaId": "468",
    "createdDate": "2009-06-02T17:14:10Z",
    "expiresDate": "2035-06-02T17:14:10Z",
    "updatedDate": "2026-05-16T16:53:04Z",
    "domainAgeDays": 6321,
    "daysUntilExpiry": 3174,
    "status": ["client transfer prohibited"],
    "registryNameservers": ["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
    "dnssec": true,
    "dns": {
        "a": ["3.170.42.100", "3.170.42.109", "3.170.42.68", "3.170.42.76"],
        "mx": ["1 aspmx.l.google.com", "5 alt1.aspmx.l.google.com", "5 alt2.aspmx.l.google.com"],
        "txt": ["openai-domain-verification=dv-WTM7Nna92Owwh4sgmDOVUyyt"],
        "caa": ["0 issue \"amazonaws.com\"", "0 issue \"letsencrypt.org\""],
        "soa": "ns-839.awsdns-40.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400"
    },
    "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com"],
    "email": {
        "emailProvider": "Google Workspace",
        "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
        "spfAll": "-all",
        "dmarcRecord": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
        "dmarcPolicy": "reject",
        "dmarcReportingEnabled": true,
        "dkimSelectorsFound": ["google"],
        "mtaSts": true,
        "tlsRpt": true,
        "score": 100,
        "grade": "A",
        "issues": []
    },
    "ssl": {
        "host": "apify.com",
        "reachable": true,
        "valid": true,
        "issuer": "Amazon",
        "subject": "*.apify.com",
        "validFrom": "2026-07-03T00:00:00Z",
        "validTo": "2027-01-16T23:59:59Z",
        "daysUntilExpiry": 116,
        "sanCount": 4,
        "tlsVersion": "TLSv1.3"
    },
    "issues": [],
    "processingTimeMs": 279,
    "error": null
}

For a domain that is not registered you get "registered": false and the issue "Domain is not registered (available)".

Pricing

Pay per event: $0.003 per domain analyzed ($3 per 1,000 domains) - registration, DNS, SSL and email security all included. Invalid inputs and domains where every lookup failed are free.

Worked examples:

• Enrich 5,000 lead domains = $15
• Monitor a 200-domain portfolio every day for a month = 6,000 lookups = $18
• The default demo run (3 domains) = $0.009

Set Maximum cost per run and the actor stops cleanly when it is reached.

FAQ

Why RDAP and not WHOIS? RDAP is ICANN's official, structured replacement for WHOIS and is mandatory for all generic TLDs. For country TLDs without RDAP the actor falls back to classic WHOIS (port 43), so fields may be sparser there (for example .de only publishes the status).

Why is registrar sometimes the company itself? Some registries (for example Nominet for .uk) list large organisations that act as their own registrar.

How is the email grade calculated? MX 10 points, SPF up to 25 (strict -all / ~all), DMARC up to 35 (reject 35, quarantine 28, none 12), DKIM 20, MTA-STS 5, TLS-RPT 5. A >= 85, B >= 70, C >= 50, D >= 30, else F.

Can I pass subdomains? Yes. Registration and DNS are reported for the registrable domain, and the SSL certificate is checked on the exact host you entered.

Something is not working? Open an issue on the Issues tab - it is answered quickly.