Domain WHOIS, DNS & SSL Checker – Bulk Expiry & Email Security

Paste a list of domains (or URLs) and get one row per domain with everything you normally check in five different tools:

• Registration (WHOIS / RDAP): registered or not, registrar, creation date, expiry date and days left, last change, domain status, name servers, DNSSEC
• DNS records: A, AAAA, MX, NS, TXT, CAA (also CNAME and SOA on request)
• Email security: SPF record, DMARC record and policy (none / quarantine / reject)
• SSL certificate: valid or not, issuer, valid from / to, days until expiry, alternative names, TLS version
• Website: HTTP status, final URL, HTTPS redirect, HSTS, server header, response time
• issues[]: plain-English warnings such as "Domain expires in 12 days", "SSL certificate invalid: certificate has expired", "No DMARC record" or "Website does not redirect to HTTPS"

No API key, no proxy and no browser needed. Registration data comes from the official registry RDAP services (the modern, structured successor of WHOIS), so there is no fragile WHOIS-text parsing and no third-party WHOIS API.

What you can use it for

• Domain portfolio monitoring: run it on a schedule and get warned before a domain or certificate expires.
• Agency / IT client checks: audit all client domains at once for expiring certificates, missing HTTPS redirects, and missing SPF or DMARC.
• Email deliverability audits: since Google and Yahoo require SPF and DMARC from bulk senders, find the domains without them.
• Lead enrichment and qualification: domain age, registrar, mail provider (MX), hosting (A / NS) and whether the website is live.
• Domain research: check whether domains are still unregistered (registered: false).

Input

Field	Description
domains	Domains, subdomains or URLs, e.g. example.com, shop.example.de, https://www.example.co.uk/page
checkWhois	Registration data from RDAP (default true)
checkDns / dnsRecordTypes	DNS records and which types (default A, AAAA, MX, NS, TXT, CAA)
checkEmailSecurity	SPF + DMARC (default true)
checkSsl	SSL certificate on port 443 (default true)
checkHttp	Homepage status / redirects / HSTS (default true)
expiryWarningDays	Flag domains expiring within N days (default 30)
maxItems, maxConcurrency, timeoutSecs	Limits

{"domains": ["github.com", "bbc.co.uk", "tchibo.de"], "expiryWarningDays": 60}

Registration data is always looked up for the registrable domain (shop.example.co.uk → example.co.uk, using the Public Suffix List). DNS A/AAAA records, the SSL certificate and the HTTP check use the host you entered. Internationalised domains (e.g. münchen.de) are converted to punycode.

Output (real example, shortened)

{
  "input": "github.com",
  "host": "github.com",
  "domain": "github.com",
  "tld": "com",
  "rdapServer": "https://rdap.verisign.com/com/v1/",
  "registered": true,
  "registrar": "MarkMonitor Inc.",
  "registrarIanaId": "292",
  "createdAt": "2007-10-09T18:20:50+00:00",
  "updatedAt": "2026-09-07T09:22:52+00:00",
  "expiresAt": "2028-10-09T18:20:50+00:00",
  "domainStatus": [
    "client delete prohibited",
    "client transfer prohibited",
    "client update prohibited"
  ],
  "nameservers": [
    "dns1.p08.nsone.net",
    "dns2.p08.nsone.net",
    "dns3.p08.nsone.net",
    "dns4.p08.nsone.net",
    "ns-1283.awsdns-32.org",
    "ns-1707.awsdns-21.co.uk",
    "ns-421.awsdns-52.com",
    "ns-520.awsdns-01.net"
  ],
  "dnssec": false,
  "domainAgeDays": 6965,
  "daysUntilExpiry": 706,
  "dns": {
    "A": [
      "140.82.114.4"
    ],
    "AAAA": [],
    "MX": [
      {
        "priority": 0,
        "host": "github-com.mail.protection.outlook.com"
      }
    ],
    "NS": [
      "dns1.p08.nsone.net",
      "dns2.p08.nsone.net",
      "dns3.p08.nsone.net",
      "dns4.p08.nsone.net",
      "ns-1283.awsdns-32.org",
      "ns-1707.awsdns-21.co.uk",
      "ns-421.awsdns-52.com",
      "ns-520.awsdns-01.net"
    ],
    "TXT": [
      "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all",
      "calendly-site-verification=at0DQARi7IZvJtXQAWhMqpmIzpvoBNF7aam5VKKxP"
    ],
    "CAA": [
      "0 issue \"digicert.com\"",
      "0 issue \"globalsign.com\"",
      "0 issue \"letsencrypt.org\"",
      "0 issue \"sectigo.com\"",
      "0 issuewild \"digicert.com\"",
      "0 issuewild \"letsencrypt.org\"",
      "0 issuewild \"sectigo.com\""
    ]
  },
  "dnsResolves": true,
  "registeredSource": "rdap",
  "emailSecurity": {
    "spf": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.co … ~all",
    "spfRecordCount": 1,
    "dmarc": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
    "dmarcPolicy": "quarantine",
    "hasMx": true
  },
  "ssl": {
    "host": "github.com",
    "valid": true,
    "issuer": "Sectigo Limited",
    "subject": "github.com",
    "validFrom": "2026-10-30T00:00:00+00:00",
    "validTo": "2027-01-27T23:59:59+00:00",
    "daysUntilExpiry": 85,
    "subjectAltNames": [
      "github.com",
      "www.github.com"
    ],
    "tlsVersion": "TLSv1.3",
    "error": null
  },
  "http": {
    "url": "https://github.com/",
    "statusCode": 200,
    "finalUrl": "https://github.com/",
    "redirectsToHttps": true,
    "server": "github.com",
    "hsts": true,
    "responseTimeMs": 77,
    "error": null
  },
  "issues": [],
  "errors": [],
  "checkedAt": "2026-11-03T13:24:18+00:00"
}

The run also writes a SUMMARY record to the key-value store (domains checked, registered / not registered, with issues, expiring soon, SSL problems, without DMARC). Export the results as JSON, CSV or Excel, or read them through the Apify API.

Coverage and limitations (please read)

• RDAP coverage depends on the registry. All generic TLDs (.com, .net, .org, .info, .shop, .dev, …) and many ccTLDs (.uk, .fr, .nl, .pl, .cz, .no, .fi, .ca, .au, .br, .ch, …) publish RDAP with full dates and registrar.
  • .de (DENIC) publishes only the status, name servers and last change: no creation or expiry date and no registrar.
  • Some ccTLDs have no public RDAP service at all (e.g. .at, .eu, .io, .it, .es, .co). For those, registered is derived from DNS (registeredSource: "dns"), and a note is added to errors.
• Domain holder contact data is never collected. Most registries redact it under the GDPR anyway.
• registered: false means the registry answered "not found". This usually means available, but premium, reserved or blocked names can still not be registrable.
• DNS is resolved via DNS-over-HTTPS (Google, with Cloudflare as fallback), so you see public DNS as the internet sees it.
• The SSL check uses the system trust store. Self-signed or incomplete certificate chains are reported as valid: false with the reason.
• Respect the registries' terms of use. For example, DENIC permits use of its RDAP data only for technical or administrative purposes, not for advertising. Requests per registry are rate-limited by the Actor.

Pricing

Free to use. You only pay for the Apify platform usage of your run, which is very low: in our test run, 20 domains with all checks took 29 seconds (including start-up) at 256 MB memory and used less than $0.0001 of platform credit.

---

Deutsch: Kurzbeschreibung

Domain WHOIS, DNS & SSL Checker: Liste von Domains rein, pro Domain eine Zeile raus:

• Registrierung (RDAP/WHOIS): Registrar, Erstellungs- und Ablaufdatum, Status, Nameserver
• DNS-Einträge
• SPF und DMARC
• SSL-Zertifikat mit Restlaufzeit
• HTTPS-Weiterleitung
• verständliche Warnungen in issues

Ideal für Agenturen, IT-Dienstleister und Domain-Portfolios, z. B. als regelmäßiger Zeitplan, der vor ablaufenden Zertifikaten oder fehlendem DMARC warnt. Hinweis: DENIC (.de) veröffentlicht per RDAP keine Ablaufdaten und keinen Registrar; für .de-Domains liefert der Actor Status, Nameserver, DNS, E-Mail-Sicherheit und SSL.