Domain Intelligence: WHOIS (RDAP), DNS, SPF, DMARC and TLS in one run

Paste a list of domains and get one structured row per domain: who registered it and when, where it expires, its DNS records, which mail provider it uses, whether SPF / DMARC / DKIM / MTA-STS are set up, how long its TLS certificate has left, and a 0-100 email-authentication score. No API keys, no proxies, no browser. It uses open protocols only (RDAP, DNS, a TLS handshake).

What you get per domain

• Registration (RDAP): registrar and IANA ID, created / updated / expires dates, domain age in days, days to expiry, EPP status codes, nameservers, DNSSEC flag. Registrant contact details are not returned (they are redacted by most registries and we do not collect them).
• DNS: A, AAAA, MX (sorted by priority), NS, TXT, CAA.
• Email setup: mail provider detected from MX (Google Workspace, Microsoft 365, Proofpoint, Zoho, ...), SPF record with parsed policy and DNS-lookup count, DMARC record with policy / pct / rua, DKIM selectors found at common names, MTA-STS, TLS-RPT, BIMI.
• Email-authentication score (0-100): transparent weights plus plain-English notes such as "DMARC p=none (monitor only)". It measures DNS hygiene, not deliverability or reputation.
• TLS certificate: issuer, subject, valid from / to, days remaining, subject alternative names, negotiated protocol, and whether the chain validated.

Use cases

Monitoring your own domain portfolio and expiries, checking your own or your clients' SPF/DMARC/CAA setup, security and compliance sweeps, vendor due diligence, and spotting freshly registered domains. Do not use the output to build marketing or solicitation lists (see "Registry terms" below).

Input

Field	Meaning
domains	Domains, URLs or emails; the domain is extracted (lowercased, scheme/path/user part and a leading www. removed), then de-duplicated, so you are billed once per distinct domain
includeRegistration, includeDns, includeEmailAuth, includeTls	Switch sections off for speed
concurrency	1-10 domains in parallel (default 5)

Example input: { "domains": ["github.com", "https://www.apify.com/pricing", "bbc.co.uk"] }

Pricing

Pay per event: $0.002 per domain analysed. Invalid inputs are not charged and are not written to the dataset (they are listed in the run log and in the INVALID_INPUTS key-value record). Domains where nothing at all is found (unregistered, no DNS, no TLS) are also not charged and not output. The run stops cleanly when your max-charge limit is reached. You also pay normal Apify platform usage (typically a fraction of a cent per domain).

Notes and limits

• RDAP servers are queried directly via the IANA bootstrap file with a descriptive User-Agent, a 10 s timeout, up to 3 retries with backoff (honouring Retry-After) and a minimum 300 ms gap per registry host. If a registry still refuses, the row carries registrationError while DNS/TLS sections still return.
• Maximum 500 distinct domains per run (extras are dropped and logged); split larger lists into several runs.
• Internationalised (unicode) domain names are not supported; pass the punycode (xn--) form. Unicode input is reported as invalid.
• DNS uses the resolver of the machine the Actor runs on; an empty DNS section can mean a resolver failure as well as "no records".
• Not every TLD publishes RDAP data (some ccTLDs have no RDAP server): you get registrationError.
• DKIM can only be found by guessing selector names; "none found" does not prove DKIM is absent.
• This Actor does not log in anywhere, bypass anything, or send email.

Registry terms (please read)

Registration data comes from public RDAP servers, which publish their own terms. For example, Verisign (.com/.net) states in its RDAP terms of service that the data may not be used to "allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail, telephone, or facsimile", nor to "enable high volume, automated, electronic processes" that send queries to registry or registrar systems (full text: https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml). Other registries have their own terms. You are responsible for using the output within them. This Actor keeps load low (batch cap, per-host spacing) and does not collect registrant contact data, but it cannot make a use that the terms forbid acceptable. Turn off "Registration (RDAP)" if you only need DNS/TLS data.

Built by Northpine Studio. Questions or a missing field? Open an issue on the Actor page.