Domain Health Checker — WHOIS/RDAP, SSL & DNS

Bulk domain intelligence from official sources only: registrar, age, expiry dates and EPP statuses via RDAP (the registries' structured successor to WHOIS), SSL certificate expiry and trust from a direct TLS handshake, and DNS records (A/AAAA/MX/NS/TXT) — plus clear machine-readable warnings such as domain_expires_in_30_days and ssl_expired. No credentials or API keys needed.

Privacy by design: registrant, admin and tech contact entities in RDAP responses are deliberately never read. The output contains no names, emails, phone numbers or addresses of domain owners — only registry facts (registrar company, dates, statuses, nameservers) and technical data. This tool cannot be used for contact harvesting.

What it does

Give it a list of domains (full URLs accepted — hostnames are extracted, and subdomains are resolved to their registrable domain for registration lookups: www.example.co.uk → example.co.uk). For each domain you get one dataset item with:

• registered — true, false (available), or null when the TLD has no RDAP service
• registrar, createdAt, updatedAt, expiresAt — with computed ageDays and expiresInDays
• statuses (EPP), nameservers, dnssec, and the rdapSource URL for transparency
• ssl — issuer, subject, validity window, expiresInDays, and whether the chain is trusted (expiry is read even from untrusted/expired certificates)
• dns — A, AAAA, MX (with priority), NS and TXT records
• warnings[] — domain_expires_in_30_days, ssl_expires_in_14_days, ssl_expired, ssl_not_trusted, ssl_unreachable, domain_unregistered, rdap_not_supported, rdap_error, dns_error, invalid_domain

Invalid inputs produce a failed item with a clear error instead of crashing the run.

Input

Field	Type	Default	Description
domains	array	—	Domains or URLs to check (duplicates removed)
includeDns	boolean	true	Resolve A/AAAA/MX/NS/TXT records
includeSsl	boolean	true	Check the SSL certificate on port 443
timeoutSecs	integer	10	Timeout per network operation

Example output (abridged)

{
    "domain": "www.apify.com",
    "registrableDomain": "apify.com",
    "status": "success",
    "registered": true,
    "registrar": "Amazon Registrar, Inc.",
    "createdAt": "2015-06-02T17:14:10Z",
    "expiresAt": "2035-06-02T17:14:10Z",
    "ageDays": 4096,
    "expiresInDays": 3210,
    "statuses": ["client transfer prohibited"],
    "nameservers": ["ns-1.awsdns-00.com", "ns-2.awsdns-11.net"],
    "dnssec": false,
    "ssl": {"trusted": true, "issuer": "R13", "notAfter": "2027-01-17T00:00:00Z", "expiresInDays": 152},
    "dns": {"a": ["1.2.3.4"], "mx": [{"host": "aspmx.l.google.com", "priority": 1}]},
    "warnings": [],
    "checkedAt": "2026-08-18T09:30:00Z"
}

Typical uses

• Monitor your domain portfolio: expiry dates, SSL health, DNSSEC — schedule it and alert on warnings
• Pre-purchase checks: is a domain registered, how old is it, when does it lapse
• Security/IT hygiene: find expired or soon-to-expire certificates across all company domains
• Enrich datasets with domain age and registrar (fraud/quality signals) — without touching anyone's personal data

Limitations

• Some ccTLDs (e.g. .jp, .de) have no RDAP service yet → registered: null with rdap_not_supported; SSL and DNS still work for them
• Registrant identity/contact fields are out of scope by design and will not be added
• SSL is checked on port 443 of the domain itself (not subdomain wildcards or other ports)

Development (local)

cd actors/domain-health-checker
uv venv --python 3.13 .venv && uv pip install -p .venv/bin/python -r requirements.txt

.venv/bin/python tests/run_local_test.py           # end-to-end test (apify run equivalent), exit 0 = ALL PASS
../../node_modules/.bin/apify run                  # real apify CLI local run (input: storage/key_value_stores/default/INPUT.json)

The test spins up a local RDAP server (whose fixture deliberately contains registrant contact data, proving it never leaks into output) and a local TLS server with a 5-day self-signed certificate; expected results live in tests/expected_output.json. Publishing → ../../docs/publishing.md.