# Domain Trust Monitor (`mfapitools/domain-trust-monitor`) Actor Monitor WHOIS/RDAP, SSL certificates (crt.sh), and DNS records for domains. Detects changes (registrar change, DNS hijacking, SSL expiry) and alerts via webhook. Pay-per-event, no rental. - **URL**: https://apify.com/mfapitools/domain-trust-monitor.md - **Developed by:** [Mariano Ferreras](https://apify.com/mfapitools) (community) - **Categories:** Developer tools, Automation, Agents - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.50 / 1,000 domain trust checks This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Domain Trust Monitor — Pay-Per-Event, No Rental > **Pay-per-event — zero monthly fee, zero subscription.** Monitor WHOIS/RDAP, SSL certificates, and DNS records for your domains. Detect changes (registrar transfer, DNS hijacking, SSL expiry) and get alerts — without paying for idle months. --- ### What it does This actor checks **three independent data sources** for each domain and **tracks changes over time** via Apify's Key-Value Store: 1. **WHOIS / RDAP** — Fetches domain registration data via `rdap.org` bootstrap (free, no API key). Fields: registrar, creation/expiry/update dates, nameservers, domain status, DNSSEC. 2. **SSL Certificates** — Queries crt.sh Certificate Transparency logs for all SSL certificates issued for the domain. Finds the latest cert and computes days until expiry. 3. **DNS Records** — Resolves A, AAAA, MX, TXT, NS, CNAME, and SOA records via Node.js system resolver. #### Monitoring, not just lookup Most domain tools provide one-shot WHOIS, DNS, or SSL lookups. This actor adds a **KVS-based monitoring layer**: - Register domains, get an initial "trust card" - On subsequent scheduled runs, get alerts **ONLY on changes** — no noise - Change detection across all three dimensions: registrar change, DNS record change, SSL cert renewal/expiry --- ### Why monitoring matters | Monitoring scenario | How this actor helps | |---|---| | SSL cert about to expire | Scheduled daily runs auto-alert when expiry approaches | | DNS record changes | Change detection across A, MX, TXT, NS records on every run | | Domain registration expiry | Auto-alert N days before expiry (configurable threshold) | | Registrar transfer | Detected on the next run — whois data is compared against KVS state | **Note:** This actor bundles WHOIS+DNS+SSL monitoring in one run. Standalone SSL monitoring tools exist (e.g. `gp005/tls-cert-monitor`, 2 users). WHOIS change monitoring across all three dimensions in a single actor is what differentiates this product. --- ### Use cases - **SSL cert expiry monitoring** — Get alerts before certificates expire; avoid downtime and browser warnings - **DNS hijacking detection** — Detect unauthorized changes to A, MX, or NS records (a common attack vector) - **Domain expiry reminders** — Never accidentally lose a domain registration - **Infrastructure security** — Monitor DNS record changes across your entire domain portfolio - **Registrar transfer tracking** — Detect when domains move between registrars - **Due diligence** — Verify domain registration status, DNSSEC configuration, and SSL health during M&A or vendor checks - **Brand protection** — Detect unauthorized changes to your brand domains --- ### Input ```json { "domains": ["example.com", "myapp.io"], "checkWhois": true, "checkDns": true, "checkSsl": true, "dnsRecordTypes": ["A", "AAAA", "MX", "TXT", "NS"], "sslExpiryWarnDays": 30, "domainExpiryWarnDays": 60, "webhookUrl": "https://hooks.slack.com/...", "webhookSecret": "your-secret-token", "emitInitialState": true, "maxDomains": 50 } ```` | Field | Type | Default | Description | |---|---|---|---| | `domains` | `string[]` | **required** | Domain names to monitor | | `checkWhois` | `boolean` | `true` | Fetch RDAP/WHOIS data | | `checkDns` | `boolean` | `true` | Resolve DNS records | | `checkSsl` | `boolean` | `true` | Fetch SSL certs from crt.sh | | `dnsRecordTypes` | `string[]` | `["A","AAAA","MX","TXT","NS"]` | DNS record types to check | | `sslExpiryWarnDays` | `integer` | `30` | Alert when SSL expires within N days | | `domainExpiryWarnDays` | `integer` | `60` | Alert when domain expires within N days | | `webhookUrl` | `string` | (optional) | POST URL for change/alert notifications | | `webhookSecret` | `string` | (optional) | Bearer token for webhook Authorization header | | `emitInitialState` | `boolean` | `true` | Emit trust card on first check (even without changes) | | `maxDomains` | `integer` | `50` | Max domains per run | *** ### Output (Dataset) Each run pushes one **DomainTrustCard** record per domain (when changes, alerts, or initial state): ```json { "domain": "example.com", "checkedAt": "2026-07-24T12:00:00.000Z", "isFirstCheck": false, "whois": { "registrar": "VeriSign, Inc.", "creationDate": "1995-08-14T04:00:00Z", "expiryDate": "2027-08-13T04:00:00Z", "nameservers": ["A.IANA-SERVERS.NET", "B.IANA-SERVERS.NET"], "statuses": ["client transfer prohibited"], "dnssec": true, "rawAvailable": true }, "ssl": { "latestCert": { "issuer": "C=US, O=Cloudflare Inc, CN=Cloudflare Inc ECC CA-3", "notBefore": "2026-07-01T00:00:00", "notAfter": "2027-07-01T23:59:59", "serialNumber": "1122334455667788", "subjectAlternativeNames": ["example.com", "www.example.com"] }, "totalCertsFound": 12, "expiresInDays": 342, "rawAvailable": true }, "dns": { "records": { "A": ["93.184.216.34"], "NS": ["a.iana-servers.net", "b.iana-servers.net"], "MX": [] }, "rawAvailable": true }, "changes": { "whoisChanged": false, "dnsChanged": false, "sslChanged": false, "whoisChangeDetail": null, "dnsChangeDetail": null, "sslChangeDetail": null }, "alerts": { "sslExpiringSoon": false, "sslExpired": false, "domainExpiringSoon": false, "domainExpired": false } } ``` *** ### Payment events | Event | Price | When charged | |---|---|---| | `domain-checked` | $0.001 | Once per domain per run | | `domain-changed` | $0.002 | When WHOIS, DNS, or SSL changed since last run | | `alert-triggered` | $0.005 | When SSL or domain is expiring/expired | | `apify-actor-start` | Platform-managed | Per run start, ~$0.005 at 2048 MB | Example run with 5 domains, 2 with changes, 1 alert: = 5×$0.001 + 2×$0.002 + 1×$0.005 = **$0.014 total**. No monthly subscription. Pay only for what you use. *** ### How to schedule monitoring 1. Run the actor once with your domains to get initial trust cards → saves state to KVS 2. Schedule the actor to run daily or weekly (same Apify schedule) 3. On each subsequent run, you only get dataset records when something **changes** or an **alert triggers** 4. Optionally configure a webhook URL to get real-time notifications *** ### Honest limitations - **RDAP availability varies by TLD**: Most gTLDs (.com, .org, .net) and many ccTLDs support RDAP, but some ccTLDs (especially smaller ones) do not. Domains on non-RDAP TLDs will return `whois: null`. - **crt.sh coverage**: crt.sh only has certificates that have been submitted to Certificate Transparency logs. Very new domains (first cert issued minutes ago) or domains behind certain CDNs may not appear immediately. - **DNS resolution perspective**: DNS runs from Apify's datacenter IPs, which may differ from your local resolver due to CDN geo-routing and anycast. This is fine for detecting changes over time (delta consistency), but absolute A-record values may vary by location. - **No login-gated data**: All data sources are fully public and free. We do not and cannot verify domain ownership. - **First run cost**: The initial run always emits full trust cards (if `emitInitialState: true`) but charges the lower `domain-checked` rate — `domain-changed` is never charged on first check. - **KVS storage**: Previous state is kept in the actor's default Key-Value Store. Running under a different Apify account will start fresh (first check for all domains). *** ### Data sources - [RDAP.org](https://rdap.org/) — Free RFC 7483 bootstrap service for domain registration data - [crt.sh](https://crt.sh/) — Free Certificate Transparency log search (no API key needed) - Node.js `dns` module — System resolver, no external dependency All data sources are **free, no API keys required, no scraping**. # Actor input Schema ## `domains` (type: `array`): List of domain names to check. Example: \["example.com", "myapp.io"]. Min 1, max limited by maxDomains setting. ## `checkWhois` (type: `boolean`): Fetch RDAP/WHOIS data (registrar, creation/expiry dates, nameservers, DNSSEC) via rdap.org bootstrap. Default: true. ## `checkDns` (type: `boolean`): Resolve DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA) via system resolver. Default: true. ## `checkSsl` (type: `boolean`): Fetch SSL certificate data from crt.sh Certificate Transparency logs. Default: true. ## `dnsRecordTypes` (type: `array`): DNS record types to check when checkDns is true. Default: A, AAAA, MX, TXT, NS. ## `sslExpiryWarnDays` (type: `integer`): Alert when an SSL certificate expires within this many days. Default: 30. Min: 1, Max: 365. ## `domainExpiryWarnDays` (type: `integer`): Alert when a domain registration expires within this many days. Default: 60. Min: 1, Max: 365. ## `webhookUrl` (type: `string`): Optional URL to POST alert JSON to when changes or alerts are detected. HTTP POST with Content-Type: application/json. ## `webhookSecret` (type: `string`): Optional bearer token sent as Authorization header when posting to webhookUrl. Use an Apify input secret (not a plain text field) to keep it confidential. ## `emitInitialState` (type: `boolean`): On the first check of a domain, emit the full trust card even though nothing has changed yet. Default: true. ## `maxDomains` (type: `integer`): Maximum number of domains to check in a single run. Limits run duration and cost. Default: 50. ## Actor input object example ```json { "domains": [ "example.com" ], "checkWhois": true, "checkDns": true, "checkSsl": true, "dnsRecordTypes": [ "A", "AAAA", "MX", "TXT", "NS" ], "sslExpiryWarnDays": 30, "domainExpiryWarnDays": 60, "emitInitialState": true, "maxDomains": 50 } ``` # Actor output Schema ## `cards` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "example.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("mfapitools/domain-trust-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": ["example.com"] } # Run the Actor and wait for it to finish run = client.actor("mfapitools/domain-trust-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "example.com" ] }' | apify call mfapitools/domain-trust-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=mfapitools/domain-trust-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Domain Trust Monitor", "description": "Monitor WHOIS/RDAP, SSL certificates (crt.sh), and DNS records for domains. Detects changes (registrar change, DNS hijacking, SSL expiry) and alerts via webhook. Pay-per-event, no rental.", "version": "0.1", "x-build-id": "aVzgi2QnRo39gBUC6" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/mfapitools~domain-trust-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-mfapitools-domain-trust-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/mfapitools~domain-trust-monitor/runs": { "post": { "operationId": "runs-sync-mfapitools-domain-trust-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/mfapitools~domain-trust-monitor/run-sync": { "post": { "operationId": "run-sync-mfapitools-domain-trust-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Domains to monitor", "type": "array", "description": "List of domain names to check. Example: [\"example.com\", \"myapp.io\"]. Min 1, max limited by maxDomains setting.", "items": { "type": "string" } }, "checkWhois": { "title": "Check WHOIS/RDAP", "type": "boolean", "description": "Fetch RDAP/WHOIS data (registrar, creation/expiry dates, nameservers, DNSSEC) via rdap.org bootstrap. Default: true.", "default": true }, "checkDns": { "title": "Check DNS records", "type": "boolean", "description": "Resolve DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA) via system resolver. Default: true.", "default": true }, "checkSsl": { "title": "Check SSL certificates", "type": "boolean", "description": "Fetch SSL certificate data from crt.sh Certificate Transparency logs. Default: true.", "default": true }, "dnsRecordTypes": { "title": "DNS record types", "type": "array", "description": "DNS record types to check when checkDns is true. Default: A, AAAA, MX, TXT, NS.", "items": { "type": "string", "enum": [ "A", "AAAA", "MX", "TXT", "NS", "CNAME", "SOA" ], "enumTitles": [ "A records", "AAAA records", "MX records", "TXT records", "NS records", "CNAME records", "SOA records" ] }, "default": [ "A", "AAAA", "MX", "TXT", "NS" ] }, "sslExpiryWarnDays": { "title": "SSL expiry warning (days)", "minimum": 1, "maximum": 365, "type": "integer", "description": "Alert when an SSL certificate expires within this many days. Default: 30. Min: 1, Max: 365.", "default": 30 }, "domainExpiryWarnDays": { "title": "Domain expiry warning (days)", "minimum": 1, "maximum": 365, "type": "integer", "description": "Alert when a domain registration expires within this many days. Default: 60. Min: 1, Max: 365.", "default": 60 }, "webhookUrl": { "title": "Webhook URL", "type": "string", "description": "Optional URL to POST alert JSON to when changes or alerts are detected. HTTP POST with Content-Type: application/json." }, "webhookSecret": { "title": "Webhook secret", "type": "string", "description": "Optional bearer token sent as Authorization header when posting to webhookUrl. Use an Apify input secret (not a plain text field) to keep it confidential." }, "emitInitialState": { "title": "Emit initial state", "type": "boolean", "description": "On the first check of a domain, emit the full trust card even though nothing has changed yet. Default: true.", "default": true }, "maxDomains": { "title": "Max domains per run", "minimum": 1, "maximum": 1000, "type": "integer", "description": "Maximum number of domains to check in a single run. Limits run duration and cost. Default: 50.", "default": 50 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```