Domain WHOIS, DNS, Email Security & TLS Checker

What it does

Give this Actor a list of domains and it returns one enriched JSON record per domain with everything a sales, security or IT team usually has to collect from four different tools:

• WHOIS via RDAP — registrar, registration / expiration / last-changed dates, days until the domain expires, EPP status codes, nameservers, DNSSEC, and registrant organisation / country when the registry publishes them (redacted fields stay null; nothing is guessed).
• DNS records — A, AAAA, MX (sorted by priority), NS, TXT, CAA and SOA over DNS-over-HTTPS, plus a mail-provider guess (Google, Microsoft, Zoho, Proton, Fastmail, Mimecast, Proofpoint, other).
• Email security — SPF record and syntax check (lookup count, -all / ~all / ?all), DMARC policy, subdomain policy, pct, aggregate/forensic reporting addresses, DKIM selectors found (18 common selectors probed, plus your own), MTA-STS record and policy mode, BIMI record, and an email security score 0–100.
• TLS certificate — subject CN, issuer, valid-from / valid-to, days until expiry, SAN count, protocol version and whether the chain actually verifies.
• HTTP — final URL, status code, full redirect chain, server / x-powered-by, security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), page title, meta generator and tech stack hints (Shopify, WordPress, Wix, Squarespace, Webflow, HubSpot, Cloudflare, Next.js, Nuxt, Drupal, Ghost, Framer, Vercel, Netlify, Google Tag Manager, Google Analytics, Intercom, Stripe).

Every section is independent: if a registry is slow or a site is down, the other sections are still filled in and the problem is recorded in errors. It only uses public RDAP, public DNS resolvers and the domain's own public endpoints — no API keys, no proxies, no browser — which is why it costs $0.0015 per domain. Results are available as JSON, CSV, Excel, via API, webhooks or the Apify MCP server, like any Apify dataset.

Typical uses: lead enrichment and segmentation by tech stack and mail provider, email deliverability audits (SPF/DMARC/DKIM gaps), certificate and domain expiry monitoring, M&A / vendor due diligence, and competitor technology research.

How to use

1. Paste your Domains (one per line). URLs such as https://www.example.com/pricing and email addresses such as jane@example.com are fine — the registrable domain is extracted and duplicates are merged.
2. Optionally untick Sections you do not need, add Extra DKIM selectors your ESP uses, and set Max concurrency.
3. Click Start. Each domain is written to the dataset as soon as it is finished; download the table or connect it to your CRM, spreadsheet or agent via the API.

Input

Field	Type	Required	Description
domains	string[]	yes	Domains, URLs or email addresses to check. Deduplicated by registrable domain.
sections	string[]	no	Any of whois, dns, tls, http. Default: all four.
dkimSelectors	string[]	no	Extra DKIM selectors to probe in addition to the built-in 18.
maxConcurrency	integer	no	Domains checked in parallel (1–20, default 5).
webhookUrl	string	no	POST target for the run summary (counts, charges, finish time).

Output example

{
  "domain": "github.com",
  "input": "https://github.com/apify",
  "fetchedAt": "2026-10-16T12:00:00.000Z",
  "sections": ["whois", "dns", "tls", "http"],
  "whois": {
    "status": "ok",
    "source": "rdap.markmonitor.com",
    "registrar": "MarkMonitor Inc.",
    "registrarIanaId": "292",
    "registrationDate": "2007-10-09T18:20:50.000Z",
    "expirationDate": "2026-10-09T18:20:50.000Z",
    "lastChangedDate": "2024-09-07T09:16:33.000Z",
    "daysUntilExpiry": 358,
    "registered": true,
    "domainStatus": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
    "nameservers": ["dns1.p08.nsone.net", "dns2.p08.nsone.net", "ns-1283.awsdns-32.org", "ns-1707.awsdns-21.co.uk"],
    "dnssecSigned": false,
    "registrantOrg": "GitHub, Inc.",
    "registrantCountry": "US"
  },
  "dns": {
    "status": "ok",
    "resolver": "cloudflare",
    "nxdomain": false,
    "a": ["140.82.121.4"],
    "aaaa": [],
    "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }, { "priority": 5, "exchange": "alt1.aspmx.l.google.com" }],
    "ns": ["dns1.p08.nsone.net", "dns2.p08.nsone.net"],
    "txt": ["v=spf1 ip4:192.30.252.0/22 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com include:spf.protection.outlook.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ip4:167.89.101.2 ip4:167.89.101.192/28 ip4:192.254.112.60 ip4:192.254.112.98/31 ip4:192.254.113.10 ip4:192.254.113.101 ip4:192.254.114.176 ip4:62.253.227.114 ~all"],
    "caa": [{ "flags": 0, "tag": "issue", "value": "digicert.com" }],
    "soa": { "mname": "dns1.p08.nsone.net", "rname": "hostmaster.nsone.net", "serial": 1718097213, "refresh": 43200, "retry": 7200, "expire": 1209600, "minimum": 3600 },
    "hasMx": true,
    "mxProviderGuess": "google",
    "spfRecord": "v=spf1 ip4:192.30.252.0/22 include:_netblocks.google.com ... ~all",
    "spfValid": true,
    "spfAllQualifier": "~all",
    "spfLookupCount": 7,
    "spfIssues": [],
    "dmarcRecord": "v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@github.com",
    "dmarcPolicy": "reject",
    "dmarcSubdomainPolicy": null,
    "dmarcPct": 100,
    "hasRua": true,
    "hasRuf": false,
    "dmarcIssues": [],
    "dkimSelectorsProbed": 18,
    "dkimSelectorsFound": ["google", "pm"],
    "mtaStsPresent": true,
    "mtaStsRecord": "v=STSv1; id=20230901",
    "mtaStsPolicyMode": "enforce",
    "bimiRecord": null
  },
  "tls": {
    "status": "ok",
    "protocol": "TLSv1.3",
    "authorized": true,
    "authorizationError": null,
    "subjectCN": "github.com",
    "issuerOrg": "Sectigo Limited",
    "issuerCN": "Sectigo ECC Domain Validation Secure Server CA",
    "validFrom": "2026-02-05T00:00:00.000Z",
    "validTo": "2027-02-05T23:59:59.000Z",
    "daysUntilExpiry": 112,
    "sanCount": 2,
    "fingerprint256": "A1:B2:..."
  },
  "http": {
    "status": "ok",
    "finalUrl": "https://github.com/",
    "statusCode": 200,
    "redirectChain": [],
    "server": "github.com",
    "poweredBy": null,
    "contentType": "text/html; charset=utf-8",
    "securityHeaders": {
      "hsts": "max-age=31536000; includeSubdomains; preload",
      "csp": "default-src 'none'; base-uri 'self'; ...",
      "xFrameOptions": "deny",
      "xContentTypeOptions": "nosniff",
      "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin"
    },
    "pageTitle": "GitHub · Build and ship software on a single, collaborative platform",
    "metaGenerator": null,
    "techHints": ["Stripe"]
  },
  "registrar": "MarkMonitor Inc.",
  "expirationDate": "2026-10-09T18:20:50.000Z",
  "mxProviderGuess": "google",
  "dmarcPolicy": "reject",
  "tlsDaysUntilExpiry": 112,
  "httpStatusCode": 200,
  "techHints": ["Stripe"],
  "emailSecurityScore": 95,
  "summary": "github.com: registered via MarkMonitor Inc., expires in 358 days; MX google, SPF ok (~all), DMARC reject, DKIM google/pm, MTA-STS; email security 95/100; TLS valid, cert 112 days left, by Sectigo Limited; HTTP 200, server github.com, tech: Stripe",
  "errors": {}
}

The values above are illustrative; live records reflect what the registry, resolvers and the site return at run time. The top-level registrar, expirationDate, mxProviderGuess, dmarcPolicy, tlsDaysUntilExpiry, httpStatusCode, techHints, emailSecurityScore and summary columns are flattened copies so the Console table and CSV export stay readable.

Each section has a status: ok, error (reached the source, got a bad answer), unavailable (could not reach the source at all — for example a domain with no web server on port 443) or skipped (not requested). When a section fails, errors holds the reason, e.g. { "tls": "ECONNREFUSED: connect ECONNREFUSED 93.184.216.34:443" }, and the remaining sections are still returned.

Inputs that are not a domain at all produce { "input": "not a domain", "error": "INVALID_DOMAIN", "errorMessage": "..." } and are charged at the same rate, because the work to classify them was done.

Email security score

Check	Points
SPF record present and syntactically valid (≤ 10 lookups, no unknown terms, single record)	25
DMARC policy reject / quarantine / none	35 / 20 / 5
At least one DKIM selector found	25
MTA-STS record present	10
BIMI record present	5

Pricing

Pay per event. You only pay for records the Actor produces; set a maximum cost per run in the run options to cap spend.

Event	Price	Notes
Domain enriched	$0.0015	Per domain record written to the dataset, including error records
Actor start	$0.00005	Apify platform event

Example: 1,000 domains ≈ $1.50. Running fewer sections does not change the price per domain, it only makes the run faster.

Limits and fair use

• Each domain triggers roughly 30 small requests: one RDAP lookup, about 28 DNS-over-HTTPS queries (7 record types, DMARC, MTA-STS, BIMI, 18 DKIM selectors), one TLS handshake and one HTTP GET (≤ 5 redirects, body capped at 512 KB). Public DNS resolvers are built for this volume; registries and target sites receive at most one request per domain.
• Timeouts: 15 s for RDAP and HTTP, 8 s per DNS query and for the TLS handshake. A slow source marks its section error/unavailable; it never blocks the other sections.
• DKIM can only be discovered, not enumerated: a domain whose selector is not in the probed list shows dkimSelectorsFound: [] even though DKIM is configured. Add your selectors in dkimSelectors.
• The SPF lookup count covers the top-level record only (includes are not recursed), so it is a lower bound.
• Registrable-domain extraction uses a curated list of common multi-label suffixes (co.uk, com.au, github.io, …) rather than the full Public Suffix List; exotic suffixes may be reduced one label too far.
• Tech hints are header/HTML fingerprints of the landing page only and are meant as a signal, not an audit.
• Subdomains are reduced to their registrable domain (mail.example.com → example.com). To inspect a specific host's certificate, run the host through a dedicated TLS scanner.

Related Actors

Other pay-per-event Actors from the same account, all limited-permission and agent-friendly:

• Website Change Monitor — Sitemap & Page Content Diff — watch the pages behind these domains for new, removed and changed content.
• Shopify Store Products Scraper & Price Change Monitor — when the tech hints say Shopify, pull the store's full catalog or monitor its prices.
• Company Job Boards Scraper & Hiring Signals (ATS) — add open roles and hiring velocity from the company's public job board.

FAQ

Does this need proxies or an API key? No. RDAP, DNS-over-HTTPS (Cloudflare, with Google as fallback) and the domains' own public endpoints are all free and open; the Actor runs on Apify's standard datacenter infrastructure.

How is cost controlled? Every domain is charged the moment its record is saved, and the Actor stops cleanly when the run's maximum total charge is reached. Deduplication means you never pay twice for www.example.com and example.com.

Why is a WHOIS field empty? Most registries redact personal data under GDPR/ICANN rules, and some ccTLDs do not offer RDAP at all. The Actor reports exactly what the registry returns and never fills gaps with guesses; whois.source tells you which server answered.

Why does dkimSelectorsFound say nothing when I know DKIM is set up? DKIM selectors are not discoverable from the outside; the Actor probes 18 common ones. Add your provider's selector in dkimSelectors (for example fm1, fm2, fm3 for Fastmail or krs for Klaviyo).

What is tls.status: "unavailable"? Nothing answered on port 443 (no web server, firewall, or DNS does not resolve). It is a finding about the domain, not an Actor error; the other sections are still filled.

Can I run it on a schedule or call it from an AI agent? Yes — use Apify Schedules, the API, or the Apify MCP server; this Actor is pay-per-event and uses limited permissions, so agents can discover and call it. Example prompts: "Check SPF, DMARC and DKIM for these 50 customer domains and flag any without a reject policy", "Which of these competitor domains run on Shopify and use Google Workspace for email?", "List domains in this sheet whose TLS certificate or registration expires in the next 30 days".

Legal

The Actor reads only public registration data (RDAP), public DNS, public TLS certificates and the public landing page of each domain, at a rate of one request per domain per source. Use the data in compliance with the registries' terms and applicable law. This Actor is not a consumer reporting agency and its output must not be used for employment, credit, insurance, or tenant screening decisions.