# Domain RDAP WHOIS, DNS & SSL Expiry Lookup (`openfeeds/domain-rdap-whois-dns-lookup`) Actor Bulk domain health check: registrar, expiry and EPP status from official registry RDAP (modern WHOIS), plus DNS, MX, SPF, DMARC policy and SSL expiry. One row per domain, no contact data. - **URL**: https://apify.com/openfeeds/domain-rdap-whois-dns-lookup.md - **Developed by:** [OpenFeeds](https://apify.com/openfeeds) (community) - **Categories:** Developer tools, SEO tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $1.00 / 1,000 domain checkeds This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ### What does Domain RDAP WHOIS, DNS & SSL Expiry Lookup do? **Domain RDAP WHOIS, DNS & SSL Expiry Lookup** checks a list of domains and returns **one row per domain** that combines three sources: - **Registration data from the official registry RDAP server.** RDAP is the ICANN successor of WHOIS (the "modern WHOIS"). You get the registrar and its IANA ID, the created, updated and **domain expiry** dates, days to expiry, EPP status codes, DNSSEC and the nameservers on file at the registry. - **Live DNS:** delegation, A/AAAA, NS, MX and the mail provider, CAA issuers, an SPF summary and the DMARC policy. - **The SSL certificate on port 443:** issuer, validity window, **days to SSL expiry**, whether the certificate is valid for the domain, and the number of names on it. It works like a **bulk domain expiry checker and WHOIS API alternative** for technical monitoring. **No contact data, no proxies:** the Actor never outputs registrant, admin, tech or abuse contacts, and it never rotates IP addresses to get around registry limits. ### Purpose and allowed use This Actor is built for **technical domain health and expiry monitoring**: - tracking domain and SSL certificate expiry for your own or your clients' domains, - security and email-deliverability audits (SPF, DMARC, CAA, DNSSEC), - vendor due diligence (domain age, registrar, hosting and mail facts). **Not allowed:** marketing, solicitation, building lead lists, or bulk harvesting of registry data. The registries' own terms apply to every user. For example, Verisign's RDAP terms forbid "high volume, automated, electronic processes" except as reasonably necessary to register domain names, and Public Interest Registry notes that "data mining is mitigated by detecting and limiting bulk query access from single sources". That is why the Actor paces its registry requests, caps a run at 10,000 domains and has no proxy option. ### Why use Domain RDAP WHOIS, DNS & SSL Expiry Lookup? - 📅 **Domain and SSL expiry monitoring in one row.** Both `daysToExpiry` and `tlsDaysToExpiry`, plus ready-made `warnings` such as `domainExpiresSoon` and `tlsExpiresSoon`. - 🛡️ **Email security audit.** SPF presence and its final `all` qualifier, DMARC policy, CAA issuers and DNSSEC for every domain in your list. - 🏛️ **Official registry data.** RDAP answers come straight from the registry (Verisign, Public Interest Registry, Identity Digital), not from a reseller's WHOIS mirror. - 🔍 **Honest statuses.** `notFoundInRegistry` is never presented as "available", and every row says where its registration data came from (`registrationSource`) and, for DNS-only TLDs, why (`dnsOnlyReason`). - 🙈 **No personal data.** Registrar name and IANA ID only. No WHOIS contacts, no DMARC report addresses, no raw TXT records. - ⚙️ **Apify platform extras.** Schedules (weekly checks), API access, integrations (Slack, email, webhooks, Make, Zapier), datasets in JSON/CSV/Excel, and use from AI agents through the Apify MCP server. ### What data do you get? | Field | Example | Description | | -------------------------------- | --------------------------------------------------- | ---------------------------------------------------------------------- | | `domain` | `apify.com` | Registered domain (subdomains and URLs are reduced to it) | | `rdapStatus` | `registered` | `registered`, `notFoundInRegistry`, `dns-only`, `throttled` or `error` | | `registrar` / `registrarIanaId` | `Amazon Registrar, Inc.` / `468` | Sponsoring registrar from the registry RDAP | | `createdAt` / `expiresAt` | `2009-06-02T17:14:10Z` / `2035-06-02T17:14:10Z` | Registry dates (ISO 8601 UTC) | | `daysToExpiry` / `domainAgeDays` | `3154` / `6341` | Whole days to domain expiry and since registration | | `eppStatus` | `["clientTransferProhibited"]` | EPP status codes (camelCase) | | `dnssecSigned` | `true` | Registry says the delegation is DNSSEC-signed | | `dnsDelegated` / `nameservers` | `true` / `["ns-449.awsdns-56.com", …]` | Live DNS delegation and NS records | | `mxHosts` / `mailProvider` | `["aspmx.l.google.com", …]` / `Google Workspace` | Mail servers and who operates them | | `hasSpf` / `spfAll` | `true` / `-all` | SPF presence and its final `all` qualifier | | `dmarcPolicy` | `reject` | DMARC policy (`none`, `quarantine`, `reject`) | | `caaIssuers` | `["letsencrypt.org"]` | Certificate authorities allowed by CAA | | `tlsStatus` / `tlsIssuerOrg` | `valid` / `Amazon` | SSL certificate status and issuer | | `tlsValidTo` / `tlsDaysToExpiry` | `2027-01-16T23:59:59Z` / `95` | SSL expiry date and days left | | `warnings` | `["dmarcNone"]` | Problems found (see the warnings list below) | | `rdapUrl` | `https://rdap.verisign.com/com/v1/domain/apify.com` | Source URL of the registration data | | `charged` | `true` | Whether this row was billed | Every row has the same 47 fields. **Never included:** registrant, admin, tech or abuse contacts, DMARC report addresses (`rua`/`ruf`), raw TXT records, certificate subjects or SAN values. ### RDAP coverage: which TLDs get registration data? | Registration data | TLDs | | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | | **Registry RDAP (Verisign)** | .com, .net, .cc, .name and Verisign's IDN/brand TLDs | | **Registry RDAP (Public Interest Registry)** | .org, .ngo, .ong, .charity, .foundation and other PIR TLDs | | **Registry RDAP (Identity Digital)** | .info, .ai, .io, .me, .pro, .mobi, .live and about 450 more gTLDs | | DNS + SSL only (`nominet-commercial-reuse-ban`) | .uk and other Nominet TLDs (registry terms ban commercial reuse) | | DNS + SSL only (`google-registry-hard-rule-2`) | Google Registry TLDs such as .app, .dev, .page | | DNS + SSL only (`centralnic-robots-disallow`) | CentralNic TLDs such as .xyz, .art, .fm (robots.txt disallows all) | | DNS + SSL only (`denic-purpose-clause`) | .de (use limited to technical/administrative needs; no dates published) | | DNS + SSL only (`switch-aup-commercial-ban`) | .ch, .li | | DNS + SSL only (`godaddy-registry-redistribution-ban`) | .us, .biz | | DNS + SSL only (`afnic-reproduction-ban`) | .fr, .re, .pm, .tf, .wf, .yt | | DNS + SSL only (`sidn-purpose-limited`) | .nl | | DNS + SSL only (`registro-br-redistribution-ban`) | .br | | DNS + SSL only (`no-rdap-service`) | ccTLDs without a public registry RDAP, e.g. .eu, .it, .es, .at, .be, .se, .jp, .co | | DNS + SSL only (`terms-not-reviewed`) | All other TLDs until their registry terms have been reviewed (e.g. .pl, .cz, .ca, .au, .online) | For DNS-only TLDs you still get DNS, email security and the SSL certificate, and `dnsDelegated` tells you whether the domain is live in DNS (a good registration proxy, because a domain needs nameservers to resolve). ### How to check domain expiry in bulk 1. Open the Actor and paste your **domains**, one per line. URLs and subdomains are fine; they are reduced to the registered domain and duplicates are removed. 2. Choose the checks: **Registration data (RDAP)**, **DNS and email security**, **SSL/TLS certificate** (all on by default). 3. Set **Expiry warning (days)** (default 30). 4. Click **Start** and download the results as JSON, CSV, Excel or HTML, or read them through the API. 5. For monitoring, create a **weekly schedule** and add a Slack, email or webhook integration that alerts you when a row has `warnings`. ### How much does it cost to check domains? The Actor uses **pay-per-event** pricing. You pay per **domain checked**, plus a tiny start fee per run: | Apify plan | Price per domain | Per 1,000 domains | | ----------------------- | ---------------- | ----------------- | | Free | $0.0020 | $2.00 | | Bronze | $0.0016 | $1.60 | | Silver | $0.0013 | $1.30 | | Gold, Platinum, Diamond | $0.0010 | $1.00 | Plus **$0.00005 per run** (the standard Actor start event). Examples on the Free plan: - the 3-domain test input: about **$0.006**, - a weekly check of 200 domains: about **$0.40 per week**, - 10,000 domains: about **$20**. **Free of charge:** invalid entries, duplicates, `throttled` rows and rows where every check failed. You can cap the cost of a run with the maximum cost setting; the Actor stops cleanly when it is reached. ### How fast is it? Registry RDAP requests are paced per registry (Verisign 5 requests per second, the others 4), and we never use proxies to go faster. That gives about **3.5 minutes per 1,000 .com/.net domains** and about 4–4.5 minutes per 1,000 .org/.info/.io domains. Different registries run in parallel. Domains on DNS-only TLDs, and runs with registration data turned off, need only the DNS and SSL checks: about **45 seconds to 1 minute per 1,000 domains**. The prefill test input finishes in a few seconds. A run checks at most 10,000 domains. These times are for the default memory of 1 GB. With less memory the Actor gets less CPU: at 256 MB the DNS and SSL checks take about 3 minutes per 1,000 domains, and .com lists slow down to about 5.5 minutes per 1,000. ### Input See the **Input** tab for all options. Two examples: **Portfolio expiry check** (all checks, warn 60 days ahead): ```json { "domains": ["apify.com", "https://www.wikipedia.org/wiki/Main_Page", "example.com"], "expiryWarningDays": 60 } ``` **DNS and SSL audit only** (no registry lookups, works for every TLD): ```json { "domains": ["heise.de", "bbc.co.uk", "example.com"], "checkRdap": false } ``` | Field | Default | Description | | ------------------- | -------- | --------------------------------------------------------------- | | `domains` | required | Domains or URLs, one per line. Up to 10,000. | | `checkRdap` | `true` | Registration data from the registry RDAP | | `checkDns` | `true` | DNS and email security | | `checkTls` | `true` | SSL/TLS certificate | | `expiryWarningDays` | `30` | Days before domain or SSL expiry that trigger a warning (1–365) | | `maxDomains` | `1000` | Extra domains are skipped with a warning (hard limit 10,000) | At least one of the three checks must be on. ### Output You can download the dataset in various formats such as JSON, HTML, CSV or Excel. The dataset has three views: **Overview**, **Registration (RDAP)** and **Email security & SSL**. A `RUN_SUMMARY` record in the key-value store counts the statuses and billed domains. A registry RDAP row (real output for apify.com, 2026-10-13): ```json { "input": "apify.com", "domain": "apify.com", "domainUnicode": "apify.com", "tld": "com", "rdapStatus": "registered", "registrationSource": "rdap", "dnsOnlyReason": null, "rdapError": null, "rdapServer": "rdap.verisign.com", "rdapUrl": "https://rdap.verisign.com/com/v1/domain/apify.com", "registrar": "Amazon Registrar, Inc.", "registrarIanaId": 468, "createdAt": "2009-06-02T17:14:10Z", "updatedAt": "2026-05-16T16:53:04Z", "expiresAt": "2035-06-02T17:14:10Z", "daysToExpiry": 3154, "domainAgeDays": 6341, "eppStatus": ["clientTransferProhibited"], "dnssecSigned": true, "rdapNameservers": [ "ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net" ], "dnsStatus": "ok", "dnsDelegated": true, "nameservers": ["ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net"], "ipv4": ["18.66.102.102", "18.66.102.115", "18.66.102.34", "18.66.102.61"], "ipv6": ["2600:9000:223c:400:9:a03e:6540:93a1", "…"], "mxHosts": [ "aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "aspmx2.googlemail.com", "aspmx3.googlemail.com" ], "nullMx": false, "mailProvider": "Google Workspace", "caaIssuers": ["amazonaws.com", "digicert.com", "letsencrypt.org"], "hasSpf": true, "spfAll": "-all", "spfIncludeCount": 4, "spfRecord": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all", "dmarcPolicy": "reject", "dmarcSubdomainPolicy": "reject", "tlsStatus": "valid", "tlsHost": "apify.com", "tlsChainValid": true, "tlsError": null, "tlsIssuerOrg": "Amazon", "tlsValidFrom": "2026-07-03T00:00:00Z", "tlsValidTo": "2027-01-16T23:59:59Z", "tlsDaysToExpiry": 95, "tlsSanCount": 4, "warnings": [], "charged": true, "checkedAt": "2026-10-13T00:43:46.654Z" } ``` A DNS-only row (heise.de, shortened): ```json { "domain": "heise.de", "rdapStatus": "dns-only", "registrationSource": "dns-only", "dnsOnlyReason": "denic-purpose-clause", "registrar": null, "expiresAt": null, "dnsStatus": "ok", "dnsDelegated": true, "mxHosts": [ "mx01.hornetsecurity.com", "mx02.hornetsecurity.com", "mx03.hornetsecurity.com", "mx04.hornetsecurity.com" ], "mailProvider": "Hornetsecurity", "spfAll": "~all", "dmarcPolicy": "none", "tlsStatus": "valid", "tlsIssuerOrg": "Let's Encrypt", "tlsDaysToExpiry": 49, "warnings": ["dmarcNone"], "charged": true } ``` ### Status glossary | `rdapStatus` | Meaning | Charged? | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | | `registered` | The registry RDAP returned the domain object. | yes | | `notFoundInRegistry` | The registry RDAP returned 404. **This is not the same as "available":** reserved, premium, blocked and recently deleted names also return 404. | yes | | `dns-only` | RDAP is not queried for this TLD (see `dnsOnlyReason` and the coverage table). DNS and SSL still run. | yes, if DNS or SSL returned data | | `throttled` | The registry asked us to wait (Retry-After over 60 seconds) or its circuit breaker tripped. | **no** | | `error` | Invalid entry (`rdapError: "invalid-domain"`), unexpected HTTP status, or failure after one retry. | only if DNS or SSL returned data; invalid entries never | `dnsStatus` is `ok`, `nxdomain` (the domain does not exist in DNS), `error` or `skipped`. `tlsStatus` is `valid`, `invalid` (expired, untrusted or wrong host), `unreachable` (no TLS on port 443 at the domain or `www.`) or `skipped`. **Warnings:** `domainExpired`, `domainExpiresSoon`, `redemptionPeriod`, `pendingDelete`, `clientHold`, `serverHold`, `notDelegated`, `tlsInvalid`, `tlsExpiresSoon`, `noSpf`, `spfPassAll` (SPF ends in `+all`), `noDmarc`, `dmarcNone`. ### Tips - **Faster audits:** turn off **Registration data (RDAP)** when you only need DNS, email security and SSL. These checks take about 45 seconds to 1 minute per 1,000 domains at the default memory. - **Monitoring:** schedule the Actor weekly with your domain list and filter the dataset for rows where `warnings` is not empty. - **Large lists:** split very large portfolios into runs of up to 10,000 domains. ### FAQ #### Is it legal to look up domains with this Actor? RDAP is the official, ICANN-mandated lookup service for domain registration data, and the Actor only queries domains you supply, at a pace below the registries' limits. It returns no contact data: only the registrar (an accredited organisation), registry dates and status, public DNS records and the public SSL certificate. Registries whose terms forbid reuse or limit the purpose are not queried at all (see the coverage table). You remain responsible for using the data within the registries' terms, which forbid marketing and bulk harvesting. Our Actors are ethical and do not extract any private user data, such as email addresses, gender, or location. They only extract what the user has chosen to share publicly. We therefore believe that our Actors, when used for ethical purposes by Apify users, are safe. However, you should be aware that your results could contain personal data. Personal data is protected by the GDPR in the European Union and by other regulations around the world. You should not scrape personal data unless you have a legitimate reason to do so. If you're unsure whether your reason is legitimate, consult your lawyers. #### Why is my TLD DNS-only? Either the registry has no public RDAP service, or its terms forbid commercial reuse or limit the purpose, or we have not reviewed its terms yet. `dnsOnlyReason` on each row tells you which. More registries will be added after their terms are reviewed. #### Why is there no WHOIS fallback? Port-43 WHOIS is being retired in favour of RDAP, returns free-form text with contact data, and many registries forbid automated bulk use. We use RDAP only, and only on registries whose terms we have read. #### Can it tell me if a domain is available? No. A `notFoundInRegistry` answer only means the registry RDAP has no object for that name. Reserved, premium, blocked and recently deleted names also return 404. Check availability with a registrar. #### Why does .de have no expiry date? DENIC limits the use of its data to technical and administrative needs and does not publish dates in RDAP, so .de domains are DNS-only. `dnsDelegated: true` shows the domain is registered and live. #### What does "throttled" mean, and am I charged? A registry asked us to slow down for more than a minute, or kept failing. The Actor stops querying that registry for a while (never switching IP addresses to get around it) and marks the rows `throttled`. Throttled rows are **not charged**. DNS and SSL results are still included. #### Where are the RDAP data coming from? From the registry's own RDAP server, found through the IANA RDAP bootstrap file and checked against our list of reviewed registries. Each row links to its source in `rdapUrl`. ### Support and changelog Found a problem or need a TLD added? Open an issue in the **Issues** tab. To run the Actor from your own code, see the **API** tab. #### Changelog - **1.0 (2026-10-13):** first release. Registry RDAP for Verisign, Public Interest Registry and Identity Digital TLDs; live DNS with SPF, DMARC, CAA and mail provider; SSL certificate expiry; warnings; pay-per-event pricing. # Actor input Schema ## `domains` (type: `array`): Domains or URLs to check, one per line (`apify.com`, `https://www.example.org/page`). Subdomains are reduced to the registered domain. Duplicates are removed. ## `checkRdap` (type: `boolean`): Registrar, created, updated and expiry dates, EPP status and DNSSEC from the official registry. Some TLDs are DNS-only (see the coverage table in the README). ## `checkDns` (type: `boolean`): Nameservers, A/AAAA, MX and mail provider, CAA, SPF and DMARC policy. ## `checkTls` (type: `boolean`): Issuer, validity, days to expiry and whether the certificate is valid for the domain. At least one of the three checks must be on. ## `expiryWarningDays` (type: `integer`): Adds `domainExpiresSoon` or `tlsExpiresSoon` to `warnings` when the domain or SSL certificate expires within this many days. ## `maxDomains` (type: `integer`): Extra domains are skipped with a warning. Hard limit 10,000. ## Actor input object example ```json { "domains": [ "apify.com", "wikipedia.org", "example.com" ], "checkRdap": true, "checkDns": true, "checkTls": true, "expiryWarningDays": 30, "maxDomains": 1000 } ``` # Actor output Schema ## `dataset` (type: `string`): One row per domain: registrar and domain expiry from registry RDAP, DNS, MX, SPF, DMARC, CAA, SSL certificate expiry and warnings. ## `runSummary` (type: `string`): Counts per RDAP status, DNS and SSL outcome, DNS-only reasons, per-registry request statistics and the number of billed domains. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "apify.com", "wikipedia.org", "example.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("openfeeds/domain-rdap-whois-dns-lookup").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "apify.com", "wikipedia.org", "example.com", ] } # Run the Actor and wait for it to finish run = client.actor("openfeeds/domain-rdap-whois-dns-lookup").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "apify.com", "wikipedia.org", "example.com" ] }' | apify call openfeeds/domain-rdap-whois-dns-lookup --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,openfeeds/domain-rdap-whois-dns-lookup" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/gKrYCOvE8BQqidaJw/builds/L0UAFwPpb4lDNbWo2/openapi.json