Domain RDAP WHOIS, DNS & SSL Expiry Lookup

What does Domain RDAP WHOIS, DNS & SSL Expiry Lookup do?

Domain RDAP WHOIS, DNS & SSL Expiry Lookup checks a list of domains and returns one row per domain that combines three sources:

• Registration data from the official registry RDAP server. RDAP is the ICANN successor of WHOIS (the "modern WHOIS"). You get the registrar and its IANA ID, the created, updated and domain expiry dates, days to expiry, EPP status codes, DNSSEC and the nameservers on file at the registry.
• Live DNS: delegation, A/AAAA, NS, MX and the mail provider, CAA issuers, an SPF summary and the DMARC policy.
• The SSL certificate on port 443: issuer, validity window, days to SSL expiry, whether the certificate is valid for the domain, and the number of names on it.

It works like a bulk domain expiry checker and WHOIS API alternative for technical monitoring. No contact data, no proxies: the Actor never outputs registrant, admin, tech or abuse contacts, and it never rotates IP addresses to get around registry limits.

Purpose and allowed use

This Actor is built for technical domain health and expiry monitoring:

• tracking domain and SSL certificate expiry for your own or your clients' domains,
• security and email-deliverability audits (SPF, DMARC, CAA, DNSSEC),
• vendor due diligence (domain age, registrar, hosting and mail facts).

Not allowed: marketing, solicitation, building lead lists, or bulk harvesting of registry data. The registries' own terms apply to every user. For example, Verisign's RDAP terms forbid "high volume, automated, electronic processes" except as reasonably necessary to register domain names, and Public Interest Registry notes that "data mining is mitigated by detecting and limiting bulk query access from single sources". That is why the Actor paces its registry requests, caps a run at 10,000 domains and has no proxy option.

Why use Domain RDAP WHOIS, DNS & SSL Expiry Lookup?

• 📅 Domain and SSL expiry monitoring in one row. Both daysToExpiry and tlsDaysToExpiry, plus ready-made warnings such as domainExpiresSoon and tlsExpiresSoon.
• 🛡️ Email security audit. SPF presence and its final all qualifier, DMARC policy, CAA issuers and DNSSEC for every domain in your list.
• 🏛️ Official registry data. RDAP answers come straight from the registry (Verisign, Public Interest Registry, Identity Digital), not from a reseller's WHOIS mirror.
• 🔍 Honest statuses. notFoundInRegistry is never presented as "available", and every row says where its registration data came from (registrationSource) and, for DNS-only TLDs, why (dnsOnlyReason).
• 🙈 No personal data. Registrar name and IANA ID only. No WHOIS contacts, no DMARC report addresses, no raw TXT records.
• ⚙️ Apify platform extras. Schedules (weekly checks), API access, integrations (Slack, email, webhooks, Make, Zapier), datasets in JSON/CSV/Excel, and use from AI agents through the Apify MCP server.

What data do you get?

Field	Example	Description
domain	apify.com	Registered domain (subdomains and URLs are reduced to it)
rdapStatus	registered	registered, notFoundInRegistry, dns-only, throttled or error
registrar / registrarIanaId	Amazon Registrar, Inc. / 468	Sponsoring registrar from the registry RDAP
createdAt / expiresAt	2009-06-02T17:14:10Z / 2035-06-02T17:14:10Z	Registry dates (ISO 8601 UTC)
daysToExpiry / domainAgeDays	3154 / 6341	Whole days to domain expiry and since registration
eppStatus	["clientTransferProhibited"]	EPP status codes (camelCase)
dnssecSigned	true	Registry says the delegation is DNSSEC-signed
dnsDelegated / nameservers	true / ["ns-449.awsdns-56.com", …]	Live DNS delegation and NS records
mxHosts / mailProvider	["aspmx.l.google.com", …] / Google Workspace	Mail servers and who operates them
hasSpf / spfAll	true / -all	SPF presence and its final all qualifier
dmarcPolicy	reject	DMARC policy (none, quarantine, reject)
caaIssuers	["letsencrypt.org"]	Certificate authorities allowed by CAA
tlsStatus / tlsIssuerOrg	valid / Amazon	SSL certificate status and issuer
tlsValidTo / tlsDaysToExpiry	2027-01-16T23:59:59Z / 95	SSL expiry date and days left
warnings	["dmarcNone"]	Problems found (see the warnings list below)
rdapUrl	https://rdap.verisign.com/com/v1/domain/apify.com	Source URL of the registration data
charged	true	Whether this row was billed

Every row has the same 47 fields. Never included: registrant, admin, tech or abuse contacts, DMARC report addresses (rua/ruf), raw TXT records, certificate subjects or SAN values.

RDAP coverage: which TLDs get registration data?

Registration data	TLDs
Registry RDAP (Verisign)	.com, .net, .cc, .name and Verisign's IDN/brand TLDs
Registry RDAP (Public Interest Registry)	.org, .ngo, .ong, .charity, .foundation and other PIR TLDs
Registry RDAP (Identity Digital)	.info, .ai, .io, .me, .pro, .mobi, .live and about 450 more gTLDs
DNS + SSL only (nominet-commercial-reuse-ban)	.uk and other Nominet TLDs (registry terms ban commercial reuse)
DNS + SSL only (google-registry-hard-rule-2)	Google Registry TLDs such as .app, .dev, .page
DNS + SSL only (centralnic-robots-disallow)	CentralNic TLDs such as .xyz, .art, .fm (robots.txt disallows all)
DNS + SSL only (denic-purpose-clause)	.de (use limited to technical/administrative needs; no dates published)
DNS + SSL only (switch-aup-commercial-ban)	.ch, .li
DNS + SSL only (godaddy-registry-redistribution-ban)	.us, .biz
DNS + SSL only (afnic-reproduction-ban)	.fr, .re, .pm, .tf, .wf, .yt
DNS + SSL only (sidn-purpose-limited)	.nl
DNS + SSL only (registro-br-redistribution-ban)	.br
DNS + SSL only (no-rdap-service)	ccTLDs without a public registry RDAP, e.g. .eu, .it, .es, .at, .be, .se, .jp, .co
DNS + SSL only (terms-not-reviewed)	All other TLDs until their registry terms have been reviewed (e.g. .pl, .cz, .ca, .au, .online)

For DNS-only TLDs you still get DNS, email security and the SSL certificate, and dnsDelegated tells you whether the domain is live in DNS (a good registration proxy, because a domain needs nameservers to resolve).

How to check domain expiry in bulk

1. Open the Actor and paste your domains, one per line. URLs and subdomains are fine; they are reduced to the registered domain and duplicates are removed.
2. Choose the checks: Registration data (RDAP), DNS and email security, SSL/TLS certificate (all on by default).
3. Set Expiry warning (days) (default 30).
4. Click Start and download the results as JSON, CSV, Excel or HTML, or read them through the API.
5. For monitoring, create a weekly schedule and add a Slack, email or webhook integration that alerts you when a row has warnings.

How much does it cost to check domains?

The Actor uses pay-per-event pricing. You pay per domain checked, plus a tiny start fee per run:

Apify plan	Price per domain	Per 1,000 domains
Free	$0.0020	$2.00
Bronze	$0.0016	$1.60
Silver	$0.0013	$1.30
Gold, Platinum, Diamond	$0.0010	$1.00

Plus $0.00005 per run (the standard Actor start event).

Examples on the Free plan:

• the 3-domain test input: about $0.006,
• a weekly check of 200 domains: about $0.40 per week,
• 10,000 domains: about $20.

Free of charge: invalid entries, duplicates, throttled rows and rows where every check failed. You can cap the cost of a run with the maximum cost setting; the Actor stops cleanly when it is reached.

How fast is it?

Registry RDAP requests are paced per registry (Verisign 5 requests per second, the others 4), and we never use proxies to go faster. That gives about 3.5 minutes per 1,000 .com/.net domains and about 4–4.5 minutes per 1,000 .org/.info/.io domains. Different registries run in parallel. Domains on DNS-only TLDs, and runs with registration data turned off, need only the DNS and SSL checks: about 45 seconds to 1 minute per 1,000 domains. The prefill test input finishes in a few seconds. A run checks at most 10,000 domains.

These times are for the default memory of 1 GB. With less memory the Actor gets less CPU: at 256 MB the DNS and SSL checks take about 3 minutes per 1,000 domains, and .com lists slow down to about 5.5 minutes per 1,000.

Input

See the Input tab for all options. Two examples:

Portfolio expiry check (all checks, warn 60 days ahead):

{
    "domains": ["apify.com", "https://www.wikipedia.org/wiki/Main_Page", "example.com"],
    "expiryWarningDays": 60
}

DNS and SSL audit only (no registry lookups, works for every TLD):

{
    "domains": ["heise.de", "bbc.co.uk", "example.com"],
    "checkRdap": false
}

Field	Default	Description
domains	required	Domains or URLs, one per line. Up to 10,000.
checkRdap	true	Registration data from the registry RDAP
checkDns	true	DNS and email security
checkTls	true	SSL/TLS certificate
expiryWarningDays	30	Days before domain or SSL expiry that trigger a warning (1–365)
maxDomains	1000	Extra domains are skipped with a warning (hard limit 10,000)

At least one of the three checks must be on.

Output

You can download the dataset in various formats such as JSON, HTML, CSV or Excel. The dataset has three views: Overview, Registration (RDAP) and Email security & SSL. A RUN_SUMMARY record in the key-value store counts the statuses and billed domains.

A registry RDAP row (real output for apify.com, 2026-10-13):

{
    "input": "apify.com",
    "domain": "apify.com",
    "domainUnicode": "apify.com",
    "tld": "com",
    "rdapStatus": "registered",
    "registrationSource": "rdap",
    "dnsOnlyReason": null,
    "rdapError": null,
    "rdapServer": "rdap.verisign.com",
    "rdapUrl": "https://rdap.verisign.com/com/v1/domain/apify.com",
    "registrar": "Amazon Registrar, Inc.",
    "registrarIanaId": 468,
    "createdAt": "2009-06-02T17:14:10Z",
    "updatedAt": "2026-05-16T16:53:04Z",
    "expiresAt": "2035-06-02T17:14:10Z",
    "daysToExpiry": 3154,
    "domainAgeDays": 6341,
    "eppStatus": ["clientTransferProhibited"],
    "dnssecSigned": true,
    "rdapNameservers": [
        "ns-1225.awsdns-25.org",
        "ns-1928.awsdns-49.co.uk",
        "ns-449.awsdns-56.com",
        "ns-839.awsdns-40.net"
    ],
    "dnsStatus": "ok",
    "dnsDelegated": true,
    "nameservers": ["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net"],
    "ipv4": ["18.66.102.102", "18.66.102.115", "18.66.102.34", "18.66.102.61"],
    "ipv6": ["2600:9000:223c:400:9:a03e:6540:93a1", "…"],
    "mxHosts": [
        "aspmx.l.google.com",
        "alt1.aspmx.l.google.com",
        "alt2.aspmx.l.google.com",
        "aspmx2.googlemail.com",
        "aspmx3.googlemail.com"
    ],
    "nullMx": false,
    "mailProvider": "Google Workspace",
    "caaIssuers": ["amazonaws.com", "digicert.com", "letsencrypt.org"],
    "hasSpf": true,
    "spfAll": "-all",
    "spfIncludeCount": 4,
    "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
    "dmarcPolicy": "reject",
    "dmarcSubdomainPolicy": "reject",
    "tlsStatus": "valid",
    "tlsHost": "apify.com",
    "tlsChainValid": true,
    "tlsError": null,
    "tlsIssuerOrg": "Amazon",
    "tlsValidFrom": "2026-07-03T00:00:00Z",
    "tlsValidTo": "2027-01-16T23:59:59Z",
    "tlsDaysToExpiry": 95,
    "tlsSanCount": 4,
    "warnings": [],
    "charged": true,
    "checkedAt": "2026-10-13T00:43:46.654Z"
}

A DNS-only row (heise.de, shortened):

{
    "domain": "heise.de",
    "rdapStatus": "dns-only",
    "registrationSource": "dns-only",
    "dnsOnlyReason": "denic-purpose-clause",
    "registrar": null,
    "expiresAt": null,
    "dnsStatus": "ok",
    "dnsDelegated": true,
    "mxHosts": [
        "mx01.hornetsecurity.com",
        "mx02.hornetsecurity.com",
        "mx03.hornetsecurity.com",
        "mx04.hornetsecurity.com"
    ],
    "mailProvider": "Hornetsecurity",
    "spfAll": "~all",
    "dmarcPolicy": "none",
    "tlsStatus": "valid",
    "tlsIssuerOrg": "Let's Encrypt",
    "tlsDaysToExpiry": 49,
    "warnings": ["dmarcNone"],
    "charged": true
}

Status glossary

rdapStatus	Meaning	Charged?
registered	The registry RDAP returned the domain object.	yes
notFoundInRegistry	The registry RDAP returned 404. This is not the same as "available": reserved, premium, blocked and recently deleted names also return 404.	yes
dns-only	RDAP is not queried for this TLD (see dnsOnlyReason and the coverage table). DNS and SSL still run.	yes, if DNS or SSL returned data
throttled	The registry asked us to wait (Retry-After over 60 seconds) or its circuit breaker tripped.	no
error	Invalid entry (rdapError: "invalid-domain"), unexpected HTTP status, or failure after one retry.	only if DNS or SSL returned data; invalid entries never

dnsStatus is ok, nxdomain (the domain does not exist in DNS), error or skipped. tlsStatus is valid, invalid (expired, untrusted or wrong host), unreachable (no TLS on port 443 at the domain or www.) or skipped.

Warnings: domainExpired, domainExpiresSoon, redemptionPeriod, pendingDelete, clientHold, serverHold, notDelegated, tlsInvalid, tlsExpiresSoon, noSpf, spfPassAll (SPF ends in +all), noDmarc, dmarcNone.

Tips

• Faster audits: turn off Registration data (RDAP) when you only need DNS, email security and SSL. These checks take about 45 seconds to 1 minute per 1,000 domains at the default memory.
• Monitoring: schedule the Actor weekly with your domain list and filter the dataset for rows where warnings is not empty.
• Large lists: split very large portfolios into runs of up to 10,000 domains.

FAQ

Is it legal to look up domains with this Actor?

RDAP is the official, ICANN-mandated lookup service for domain registration data, and the Actor only queries domains you supply, at a pace below the registries' limits. It returns no contact data: only the registrar (an accredited organisation), registry dates and status, public DNS records and the public SSL certificate. Registries whose terms forbid reuse or limit the purpose are not queried at all (see the coverage table). You remain responsible for using the data within the registries' terms, which forbid marketing and bulk harvesting.

Our Actors are ethical and do not extract any private user data, such as email addresses, gender, or location. They only extract what the user has chosen to share publicly. We therefore believe that our Actors, when used for ethical purposes by Apify users, are safe. However, you should be aware that your results could contain personal data. Personal data is protected by the GDPR in the European Union and by other regulations around the world. You should not scrape personal data unless you have a legitimate reason to do so. If you're unsure whether your reason is legitimate, consult your lawyers.

Why is my TLD DNS-only?

Either the registry has no public RDAP service, or its terms forbid commercial reuse or limit the purpose, or we have not reviewed its terms yet. dnsOnlyReason on each row tells you which. More registries will be added after their terms are reviewed.

Why is there no WHOIS fallback?

Port-43 WHOIS is being retired in favour of RDAP, returns free-form text with contact data, and many registries forbid automated bulk use. We use RDAP only, and only on registries whose terms we have read.

Can it tell me if a domain is available?

No. A notFoundInRegistry answer only means the registry RDAP has no object for that name. Reserved, premium, blocked and recently deleted names also return 404. Check availability with a registrar.

Why does .de have no expiry date?

DENIC limits the use of its data to technical and administrative needs and does not publish dates in RDAP, so .de domains are DNS-only. dnsDelegated: true shows the domain is registered and live.

What does "throttled" mean, and am I charged?

A registry asked us to slow down for more than a minute, or kept failing. The Actor stops querying that registry for a while (never switching IP addresses to get around it) and marks the rows throttled. Throttled rows are not charged. DNS and SSL results are still included.

Where are the RDAP data coming from?

From the registry's own RDAP server, found through the IANA RDAP bootstrap file and checked against our list of reviewed registries. Each row links to its source in rdapUrl.

Support and changelog

Found a problem or need a TLD added? Open an issue in the Issues tab. To run the Actor from your own code, see the API tab.

Changelog

• 1.0 (2026-10-13): first release. Registry RDAP for Verisign, Public Interest Registry and Identity Digital TLDs; live DNS with SPF, DMARC, CAA and mail provider; SSL certificate expiry; warnings; pay-per-event pricing.