# Bulk WHOIS (RDAP) & Domain Expiry, DNS, SPF/DMARC Checker (`michael80/domain-intelligence-rdap-dns-email-security`) Actor

Bulk WHOIS lookup via official RDAP, one row per domain: registrar, creation and expiry date, days until expiry, likely availability, DNS records and email security (SPF, DMARC) with a plain grade. No API key, failures free.

- **URL**: https://apify.com/michael80/domain-intelligence-rdap-dns-email-security.md
- **Developed by:** [Michael Schönherr](https://apify.com/michael80) (community)
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.50 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk WHOIS (RDAP) & Domain Expiry, DNS, SPF/DMARC Checker

Check hundreds or thousands of domains in one run and get **one clean row per domain**: who the registrar is, when the domain was registered and **when it expires**, whether it is **likely available**, where it points (DNS) and how well it is protected against **email spoofing** (SPF and DMARC), with a plain-language grade and the reasons.

- **Official sources only:** registration data via **RDAP** (the ICANN-mandated successor of WHOIS) using the IANA bootstrap registry, DNS via **DNS-over-HTTPS** (Google, Cloudflare as fallback). No scraping, no captchas, no API key.
- **Paste anything:** domains, full URLs or email addresses. Subdomains are reduced to the registrable domain (`shop.example.co.uk` → `example.co.uk`), internationalised domains are converted (`bücher.de` → `xn--bcher-kva.de`), duplicates removed.
- **Fast:** 20 domains in about 2 seconds in our tests. Registry servers are rate-limited per server automatically.
- **Fair billing:** failures and invalid inputs are free. You can set a maximum cost per run; the Actor stops cleanly when it is reached.
- **Privacy by design:** registrant names, emails and phone numbers are never stored, even if a registry returns them.

### Who uses it

| You are | You use it to |
| --- | --- |
| SEO / web agency | Audit client portfolios: expiring domains, broken DNS, missing DMARC |
| IT / security team | Find spoofable domains in your brand portfolio (no SPF `-all`, DMARC `p=none`) |
| Domain investor | Check availability and age of large lists |
| Sales / lead qualification | Enrich company domains with age, registrar and mail provider |
| AI agents | Call it as an MCP tool: *"Which of these 50 domains expire in the next 90 days?"* |

### Output (one row per domain)

| Field | Example | Notes |
| --- | --- | --- |
| `domain` | `apify.com` | normalised, Punycode |
| `status` | `ok` | `ok`, `partial`, `error`, `invalid` |
| `availability` | `registered` | `registered`, `likely-available`, `unknown` |
| `registrationSource` | `rdap` | `rdap` or `dns` (see country domains below) |
| `registrar`, `registrarIanaId` | `Amazon Registrar, Inc.`, `468` | |
| `createdAt`, `updatedAt`, `expiresAt` | `2035-06-02` | date (UTC), ready for Excel and filters |
| `domainAgeDays`, `daysUntilExpiry` | `3135` | ready for filters and alerts |
| `statusCodes` | `["client transfer prohibited"]` | EPP status codes |
| `nameservers`, `dnssec` | `["ns1…"]`, `true` | from the registry |
| `ipv4`, `ipv6`, `resolves` | `["104.18…"]`, `true` | |
| `mx`, `acceptsEmail`, `nullMx` | `["1 aspmx.l.google.com"]` | null MX per RFC 7505 detected |
| `spfRecord`, `spfAllQualifier` | `-all` | `-all`, `~all`, `?all`, `+all`, `redirect` |
| `dmarcRecord`, `dmarcPolicy` | `reject` | `none`, `quarantine`, `reject` |
| `emailSecurityGrade` | `strong` | `strong`, `weak`, `poor`, `not-applicable` |
| `emailSecurityIssues` | `["DMARC only in monitoring mode (p=none)"]` | the reasons behind the grade |
| `notes`, `errors` | | transparent explanations, never silent gaps |

Export as JSON, CSV, Excel or via API. The **Overview** table view shows the most important columns at a glance.

#### How the email security grade works

- **strong:** SPF ends in `-all` or `~all` (or delegates via `redirect`) **and** DMARC policy is `quarantine` or `reject`.
- **weak:** exactly one problem, for example DMARC `p=none`.
- **poor:** two or more problems, for example no SPF and no DMARC.
- **not-applicable:** the domain is not registered.

Domains that send no email should still publish `v=spf1 -all` and `p=reject` so nobody can send in their name. The Actor tells you when that is missing.

### Country domains (.de, .at, .ch, .io …)

Some country registries do not offer RDAP. For those domains you still get DNS, email security and **availability determined via DNS** (a delegated domain is registered; NXDOMAIN means likely available). Registrar and expiry date are not published by these registries, so the row says so in `notes`. These rows are billed at the **lower DNS-only price**.

### Pricing

Pay per event, no subscription:

| Event | When | Price |
| --- | --- | --- |
| `domain-checked` | row with registration data from RDAP | $2.50 per 1,000 domains |
| `dns-email-checked` | row with DNS and email security only (e.g. `.de`, or registration check switched off) | $1.20 per 1,000 domains |
| invalid input / complete failure | | free |

### Input example

```json
{
  "domains": ["apify.com", "https://shop.example.co.uk/page", "info@firma.de"],
  "checkRegistration": true,
  "checkDns": true,
  "checkEmailSecurity": true,
  "maxConcurrency": 10
}
```

### Tips

- **Expiry monitoring:** schedule the Actor weekly and filter `daysUntilExpiry < 60`. Connect to Slack, email, Make, Zapier or n8n via Apify integrations.
- **Availability** is a strong hint, not a guarantee: premium, reserved or blocked names can show as available. Always confirm with a registrar before buying.

### FAQ

**Is this legal?** The Actor only uses public, standardised protocols (RDAP, DNS) that are designed for automated access, and it stores no personal data.

**Why is the registrar missing for some domains?** The registry for that country ending does not offer RDAP. See *Country domains* above.

**Something wrong or missing?** Open an issue on the Actor page. We usually answer within one business day and fix confirmed bugs quickly.

***

### Kurz auf Deutsch

Prüft Domains in großen Mengen: Registrar, Registrierungs- und **Ablaufdatum**, **Verfügbarkeit**, DNS sowie **E-Mail-Sicherheit (SPF/DMARC)** mit verständlicher Bewertung. Nur offizielle Quellen (RDAP, DNS-over-HTTPS), keine Personendaten, Fehlschläge kostenlos. Bei **.de, .at, .ch** stellen die Registries kein RDAP bereit: Hier gibt es DNS, E-Mail-Sicherheit und Verfügbarkeit über DNS zum günstigeren Preis.

***

**Anbieter / Impressum (Angaben gemäß § 5 DDG):** Michael Schönherr · Am Spiegelwald 1 · 08344 Grünhain-Beierfeld · Deutschland · E-Mail: m.schoenherr80@gmail.com

# Changelog

This Actor's version history is a separate document: https://apify.com/michael80/domain-intelligence-rdap-dns-email-security/changelog.md

# Actor input Schema

## `domains` (type: `array`):

One per line. URLs (https://shop.example.com/page) and email addresses (info@example.com) are reduced to the registrable domain automatically. Duplicates are removed. Up to 10,000 per run.

## `checkRegistration` (type: `boolean`):

Registrar, creation and expiry date, days until expiry, status codes, nameservers, DNSSEC, likely availability. Uses the official RDAP protocol via the IANA bootstrap registry.

## `checkDns` (type: `boolean`):

A, AAAA, MX and NS records via DNS-over-HTTPS.

## `checkEmailSecurity` (type: `boolean`):

SPF record and its 'all' qualifier, DMARC policy, plus a plain grade (strong / weak / poor) with the reasons.

## `maxConcurrency` (type: `integer`):

How many domains are checked at the same time. Registry servers are additionally rate-limited per server, so higher values do not risk blocks.

## `selfTest` (type: `boolean`):

Checks two known domains. Used for daily health monitoring.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "example.com",
    "https://www.wikipedia.org/"
  ],
  "checkRegistration": true,
  "checkDns": true,
  "checkEmailSecurity": true,
  "maxConcurrency": 10,
  "selfTest": false
}
```

# Actor output Schema

## `overview` (type: `string`):

One row per domain with registration (RDAP/WHOIS) data, expiry, availability, DNS and email security (SPF, DMARC).

## `results` (type: `string`):

Complete rows with every field, CSV-ready.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "example.com",
        "https://www.wikipedia.org/"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("michael80/domain-intelligence-rdap-dns-email-security").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "example.com",
        "https://www.wikipedia.org/",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("michael80/domain-intelligence-rdap-dns-email-security").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "example.com",
    "https://www.wikipedia.org/"
  ]
}' |
apify call michael80/domain-intelligence-rdap-dns-email-security --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,michael80/domain-intelligence-rdap-dns-email-security"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/PmfJNfdN9fX0ff9U6/builds/mmGiZXT3cIkfYA3lg/openapi.json