Domain Trust Monitor — Pay-Per-Event, No Rental

Pay-per-event — zero monthly fee, zero subscription. Monitor WHOIS/RDAP, SSL certificates, and DNS records for your domains. Detect changes (registrar transfer, DNS hijacking, SSL expiry) and get alerts — without paying for idle months.

---

What it does

This actor checks three independent data sources for each domain and tracks changes over time via Apify's Key-Value Store:

1. WHOIS / RDAP — Fetches domain registration data via rdap.org bootstrap (free, no API key). Fields: registrar, creation/expiry/update dates, nameservers, domain status, DNSSEC.
2. SSL Certificates — Queries crt.sh Certificate Transparency logs for all SSL certificates issued for the domain. Finds the latest cert and computes days until expiry.
3. DNS Records — Resolves A, AAAA, MX, TXT, NS, CNAME, and SOA records via Node.js system resolver.

Monitoring, not just lookup

Most domain tools provide one-shot WHOIS, DNS, or SSL lookups. This actor adds a KVS-based monitoring layer:

• Register domains, get an initial "trust card"
• On subsequent scheduled runs, get alerts ONLY on changes — no noise
• Change detection across all three dimensions: registrar change, DNS record change, SSL cert renewal/expiry

---

Why monitoring matters

Monitoring scenario	How this actor helps
SSL cert about to expire	Scheduled daily runs auto-alert when expiry approaches
DNS record changes	Change detection across A, MX, TXT, NS records on every run
Domain registration expiry	Auto-alert N days before expiry (configurable threshold)
Registrar transfer	Detected on the next run — whois data is compared against KVS state

Note: This actor bundles WHOIS+DNS+SSL monitoring in one run. Standalone SSL monitoring tools exist (e.g. gp005/tls-cert-monitor, 2 users). WHOIS change monitoring across all three dimensions in a single actor is what differentiates this product.

---

Use cases

• SSL cert expiry monitoring — Get alerts before certificates expire; avoid downtime and browser warnings
• DNS hijacking detection — Detect unauthorized changes to A, MX, or NS records (a common attack vector)
• Domain expiry reminders — Never accidentally lose a domain registration
• Infrastructure security — Monitor DNS record changes across your entire domain portfolio
• Registrar transfer tracking — Detect when domains move between registrars
• Due diligence — Verify domain registration status, DNSSEC configuration, and SSL health during M&A or vendor checks
• Brand protection — Detect unauthorized changes to your brand domains

---

Input

{
  "domains": ["example.com", "myapp.io"],
  "checkWhois": true,
  "checkDns": true,
  "checkSsl": true,
  "dnsRecordTypes": ["A", "AAAA", "MX", "TXT", "NS"],
  "sslExpiryWarnDays": 30,
  "domainExpiryWarnDays": 60,
  "webhookUrl": "https://hooks.slack.com/...",
  "webhookSecret": "your-secret-token",
  "emitInitialState": true,
  "maxDomains": 50
}

Field	Type	Default	Description
domains	string[]	required	Domain names to monitor
checkWhois	boolean	true	Fetch RDAP/WHOIS data
checkDns	boolean	true	Resolve DNS records
checkSsl	boolean	true	Fetch SSL certs from crt.sh
dnsRecordTypes	string[]	["A","AAAA","MX","TXT","NS"]	DNS record types to check
sslExpiryWarnDays	integer	30	Alert when SSL expires within N days
domainExpiryWarnDays	integer	60	Alert when domain expires within N days
webhookUrl	string	(optional)	POST URL for change/alert notifications
webhookSecret	string	(optional)	Bearer token for webhook Authorization header
emitInitialState	boolean	true	Emit trust card on first check (even without changes)
maxDomains	integer	50	Max domains per run

---

Output (Dataset)

Each run pushes one DomainTrustCard record per domain (when changes, alerts, or initial state):

{
  "domain": "example.com",
  "checkedAt": "2026-07-24T12:00:00.000Z",
  "isFirstCheck": false,
  "whois": {
    "registrar": "VeriSign, Inc.",
    "creationDate": "1995-08-14T04:00:00Z",
    "expiryDate": "2027-08-13T04:00:00Z",
    "nameservers": ["A.IANA-SERVERS.NET", "B.IANA-SERVERS.NET"],
    "statuses": ["client transfer prohibited"],
    "dnssec": true,
    "rawAvailable": true
  },
  "ssl": {
    "latestCert": {
      "issuer": "C=US, O=Cloudflare Inc, CN=Cloudflare Inc ECC CA-3",
      "notBefore": "2026-07-01T00:00:00",
      "notAfter": "2027-07-01T23:59:59",
      "serialNumber": "1122334455667788",
      "subjectAlternativeNames": ["example.com", "www.example.com"]
    },
    "totalCertsFound": 12,
    "expiresInDays": 342,
    "rawAvailable": true
  },
  "dns": {
    "records": {
      "A": ["93.184.216.34"],
      "NS": ["a.iana-servers.net", "b.iana-servers.net"],
      "MX": []
    },
    "rawAvailable": true
  },
  "changes": {
    "whoisChanged": false,
    "dnsChanged": false,
    "sslChanged": false,
    "whoisChangeDetail": null,
    "dnsChangeDetail": null,
    "sslChangeDetail": null
  },
  "alerts": {
    "sslExpiringSoon": false,
    "sslExpired": false,
    "domainExpiringSoon": false,
    "domainExpired": false
  }
}

---

Payment events

Event	Price	When charged
domain-checked	$0.001	Once per domain per run
domain-changed	$0.002	When WHOIS, DNS, or SSL changed since last run
alert-triggered	$0.005	When SSL or domain is expiring/expired
apify-actor-start	Platform-managed	Per run start, ~$0.005 at 2048 MB

Example run with 5 domains, 2 with changes, 1 alert: = 5×$0.001 + 2×$0.002 + 1×$0.005 = $0.014 total.

No monthly subscription. Pay only for what you use.

---

How to schedule monitoring

1. Run the actor once with your domains to get initial trust cards → saves state to KVS
2. Schedule the actor to run daily or weekly (same Apify schedule)
3. On each subsequent run, you only get dataset records when something changes or an alert triggers
4. Optionally configure a webhook URL to get real-time notifications

---

Honest limitations

• RDAP availability varies by TLD: Most gTLDs (.com, .org, .net) and many ccTLDs support RDAP, but some ccTLDs (especially smaller ones) do not. Domains on non-RDAP TLDs will return whois: null.
• crt.sh coverage: crt.sh only has certificates that have been submitted to Certificate Transparency logs. Very new domains (first cert issued minutes ago) or domains behind certain CDNs may not appear immediately.
• DNS resolution perspective: DNS runs from Apify's datacenter IPs, which may differ from your local resolver due to CDN geo-routing and anycast. This is fine for detecting changes over time (delta consistency), but absolute A-record values may vary by location.
• No login-gated data: All data sources are fully public and free. We do not and cannot verify domain ownership.
• First run cost: The initial run always emits full trust cards (if emitInitialState: true) but charges the lower domain-checked rate — domain-changed is never charged on first check.
• KVS storage: Previous state is kept in the actor's default Key-Value Store. Running under a different Apify account will start fresh (first check for all domains).

---

Data sources

• RDAP.org — Free RFC 7483 bootstrap service for domain registration data
• crt.sh — Free Certificate Transparency log search (no API key needed)
• Node.js dns module — System resolver, no external dependency

All data sources are free, no API keys required, no scraping.