Domain Intel — WHOIS Lookups, DNS Record Enumeration, and SSL Certificate Validation

What does it do?

Domain Intel is an enterprise domain intelligence tool that performs WHOIS lookups, DNS record enumeration, and SSL certificate validation for one or more domains — all in a single run. Never get caught by an expired certificate, a misconfigured MX record, or a domain that's about to expire. It gives you the full picture of any domain's ownership, infrastructure, and security posture, letting you monitor, audit, and troubleshoot your domain portfolio from one endpoint.

Who is it for?

Persona	What they use it for
System Administrator	Checking DNS records after a migration and verifying SSL certificates before deployment
Security Analyst	Investigating domain ownership, enumerating DNS records, and discovering subdomains during reconnaissance
DevOps Engineer	Automating certificate expiry monitoring and DNS configuration validation across all company domains
IT Manager	Keeping track of domain renewal dates and ensuring all corporate domains have valid SSL
Web Developer	Debugging DNS resolution issues, checking CNAME targets, verifying SPF/DKIM/DMARC records
Site Reliability Engineer	Monitoring DNS health, detecting configuration drift, and alerting on certificate expiry
Penetration Tester	Gathering domain intelligence during reconnaissance — WHOIS data, DNS records, SSL SANs

Why use this?

• Three domain checks in one call — WHOIS (registrar, expiry, creation dates, name servers), DNS enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA), and SSL certificate validation (issuer, validity, days remaining, SANs). No more juggling between whois, dig, nslookup, and openssl commands.
• Batch domain support — Submit multiple domains in a single request and get a unified report. Monitor your entire domain portfolio — from main site to microsites to campaign landing pages — in one run.
• Never miss a domain expiration — WHOIS output includes the registration expiry date so you know exactly when to renew. Avoid the scramble of a last-minute renewal or, worse, losing a domain to a squatter or auction.
• SSL certificate intelligence — Check validity dates, issuer name, subject details, and days until expiry. Spot certificates about to expire before they cause browser warnings, service outages, or security audit failures.
• Full DNS record inventory — Enumerate all common record types. Use it to audit SPF records for email deliverability, verify DMARC configurations for anti-phishing, confirm load balancer DNS targets, or validate CNAME chains for CDN setups.
• Early warning for expiring infrastructure — By checking expiry dates for both domains and SSL certificates, you get a consolidated view of everything that needs renewal. Run it monthly, weekly, or daily via a scheduled task.

Input Parameters

Field	Type	Required	Default	Description
domains	array	yes	—	An array of domain names to query. Each domain should be a bare domain or fully qualified hostname (e.g., example.com, www.example.com, sub.domain.com).

Example Input

{
  "domains": [
    "example.com",
    "google.com",
    "github.com"
  ]
}

Output Structure

Field	Type	Description
results	array	Array of per-domain intelligence reports
totalCount	integer	Number of domains submitted
successCount	integer	Number of domains successfully queried

Per-domain result structure

Field	Type	Description
domain	string	The domain name that was queried
whois	object	WHOIS lookup results (registrar, dates, name servers, registrant info)
dns	object	DNS record enumeration results, grouped by record type
ssl	object	SSL certificate details (issuer, subject, validity, SANs, self-signed flag)
ip	string	Resolved IPv4 address(es) for the domain
error	string	Present only if the domain query failed

WHOIS sub-fields

Field	Type	Description
registrar	string	The domain registrar name (e.g., GoDaddy, Namecheap, Cloudflare)
creationDate	string	Domain registration date in ISO 8601 format
expiryDate	string	Domain expiration date in ISO 8601 format
nameServers	array	List of authoritative name servers
registrantName	string	Registrant contact name (may be redacted under GDPR)
registrantOrganization	string	Registrant organization name (may be visible even when personal data is redacted)

DNS sub-fields

Field	Type	Description
A	array of strings	IPv4 address records
AAAA	array of strings	IPv6 address records
MX	array of objects	Mail exchange records with priority and exchange fields
NS	array of strings	Name server records
TXT	array of strings	Text records (SPF, DKIM, DMARC, domain verification strings)
CNAME	string	Canonical name record (alias target)
SOA	object	Start of Authority record with mname, rname, serial, refresh, retry, expire, and minimum TTL

SSL sub-fields

Field	Type	Description
valid	boolean	Whether the certificate is currently valid (not expired and within its validity period)
issuer	object	Certificate issuer details (common name, organization)
subject	object	Certificate subject details (common name, organization)
validFrom	string	Certificate validity start date in ISO 8601 format
validTo	string	Certificate expiry date in ISO 8601 format
daysRemaining	integer	Number of days until the certificate expires (negative if already expired)
subjectAltNames	array	All Subject Alternative Names listed on the certificate (domains and hostnames)
selfSigned	boolean	Whether the certificate is self-signed (not issued by a trusted CA)

Example Output

{
  "results": [
    {
      "domain": "example.com",
      "whois": {
        "registrar": "RESERVED-Internet Assigned Numbers Authority",
        "creationDate": "1992-01-01T00:00:00Z",
        "expiryDate": "2030-01-01T00:00:00Z",
        "nameServers": ["a.iana-servers.net", "b.iana-servers.net"],
        "registrantOrganization": "Internet Assigned Numbers Authority"
      },
      "dns": {
        "A": ["93.184.216.34"],
        "AAAA": ["2606:2800:220:1:248:1893:25c8:1946"],
        "MX": [],
        "NS": ["a.iana-servers.net", "b.iana-servers.net"],
        "TXT": ["v=spf1 -all"],
        "SOA": {
          "mname": "a.iana-servers.net",
          "rname": "hostmaster.example.com",
          "serial": 2025071901,
          "refresh": 3600,
          "retry": 900,
          "expire": 604800,
          "minimum": 3600
        }
      },
      "ssl": {
        "valid": true,
        "issuer": {
          "CN": "DigiCert TLS RSA SHA256 2020 CA1",
          "organization": "DigiCert Inc"
        },
        "subject": {
          "CN": "www.example.org",
          "organization": "Internet Assigned Numbers Authority"
        },
        "validFrom": "2025-06-15T00:00:00Z",
        "validTo": "2026-07-15T23:59:59Z",
        "daysRemaining": 361,
        "subjectAltNames": [
          "www.example.org",
          "example.org",
          "example.net",
          "example.com"
        ],
        "selfSigned": false
      },
      "ip": "93.184.216.34"
    }
  ],
  "totalCount": 3,
  "successCount": 1
}

API Usage

cURL

# Single domain lookup
curl -X POST "https://api.apify.com/v2/acts/perryay~domain-intel/runs" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
    "domains": ["example.com"]
  }'

# Batch domain monitoring
curl -X POST "https://api.apify.com/v2/acts/perryay~domain-intel/runs" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
    "domains": [
      "example.com",
      "mycompany.com",
      "mycompany.io",
      "blog.mycompany.com",
      "app.mycompany.com"
    ]
  }'

Python

import requests
from datetime import datetime

API_TOKEN = "YOUR_API_TOKEN"
ACTOR_URL = "https://api.apify.com/v2/acts/perryay~domain-intel/runs"

# Monitor SSL certificate expiry and domain renewal across your portfolio
domains = [
    "example.com",
    "yourdomain.com",
    "anotherdomain.org",
    "app.yourdomain.com"
]

response = requests.post(
    ACTOR_URL,
    headers={"Content-Type": "application/json",
             "Authorization": f"Bearer {API_TOKEN}"},
    json={"domains": domains}
)

print(f"{'Domain':<25} {'SSL Status':<20} {'Domain Expires':<20}")
print("-" * 65)

for domain_report in response.json()["results"]:
    if domain_report.get("error"):
        print(f"{domain_report['domain']:<25} ❌ ERROR: {domain_report['error']}")
        continue

    # SSL certificate health
    ssl = domain_report.get("ssl", {})
    if ssl.get("valid") and ssl["daysRemaining"] > 30:
        ssl_status = f"✅ {ssl['daysRemaining']} days"
    elif ssl.get("valid"):
        ssl_status = f"⚠️  {ssl['daysRemaining']} days (expiring!)"
    else:
        ssl_status = "❌ Invalid/missing"

    # Domain renewal
    whois = domain_report.get("whois", {})
    if whois.get("expiryDate"):
        expiry = datetime.fromisoformat(whois["expiryDate"].replace("Z", "+00:00"))
        days_left = (expiry - datetime.now()).days
        domain_expiry = f"{days_left} days ({expiry.date()})"
    else:
        domain_expiry = "N/A"

    print(f"{domain_report['domain']:<25} {ssl_status:<20} {domain_expiry:<20}")

# Send alerts for domains with expiring certificates or domains
alerts = []
for r in response.json()["results"]:
    if r.get("error"):
        continue
    domain = r["domain"]
    ssl_days = r.get("ssl", {}).get("daysRemaining", 999)
    whois_days = 999
    if r.get("whois", {}).get("expiryDate"):
        expiry = datetime.fromisoformat(r["whois"]["expiryDate"].replace("Z", "+00:00"))
        whois_days = (expiry - datetime.now()).days

    if ssl_days < 30:
        alerts.append(f"  ⚠️ {domain}: SSL expires in {ssl_days} days")
    if whois_days < 60:
        alerts.append(f"  ⚠️ {domain}: Domain expires in {whois_days} days")

if alerts:
    print("\n🚨 ALERTS:")
    for alert in alerts:
        print(alert)

Use Cases

1. Certificate Expiry Monitoring — Schedule regular Domain Intel runs to check SSL certificate expiry across all your company domains. Get alerted 30, 14, and 7 days before expiry so you never face a browser security warning, failed HTTPS handshake, or compliance audit finding. The daysRemaining field makes it easy to script alerts.

2. DNS Migration Verification — After switching DNS providers, changing hosting, updating load balancer targets, or migrating to a CDN, run all your domains through Domain Intel. Verify that A records, AAAA records, MX records, and NS records are pointing exactly where you expect. Catch misconfigurations before they affect email delivery, site availability, or API connectivity.

3. Domain Portfolio Management — If you manage multiple domains — corporate main site, country-specific TLDs, product landing pages, campaign microsites, redirect domains — run them all through Domain Intel monthly. Track renewal dates, registrar info, DNS consistency, and SSL health from a single report. Know at a glance which domains need attention.

4. Security Reconnaissance — During a security assessment or penetration test, enumerate DNS records for target domains to discover mail servers (MX), web servers (A/CNAME), and SPF/DMARC configurations (TXT). Check SSL certificate SANs for additional hostnames that extend the attack surface. WHOIS data reveals the registrant and registrar, useful for social engineering surface or domain ownership disputes.

5. Pre-Deployment Checklist — Before a new site launch, server migration, or infrastructure change, run the domain through Domain Intel as part of your deployment checklist. Verify DNS propagation (A record points to the new IP), SSL certificate is issued and valid, and WHOIS data is up to date — all automated in one step.

6. Email Infrastructure Audit — Use the MX and TXT record data to verify your email infrastructure. Check that MX records point to your mail provider, SPF records authorize all sending IPs, DKIM records exist with correct selectors, and DMARC policies are configured correctly for anti-phishing protection.

7. Acquisition Due Diligence — When evaluating a domain for purchase or acquisition, run a full intelligence check. WHOIS shows ownership and expiry date, DNS reveals the current hosting infrastructure, and SSL certs indicate what services are running. All of this informs your negotiation and migration planning.

FAQ

Q: How long does a batch query take? A: Each domain query involves fetching WHOIS data, enumerating 7 DNS record types, and connecting over TLS for SSL certificate inspection. Expect 3–10 seconds per domain depending on network conditions, WHOIS server responsiveness, and DNS resolver speed. The actor processes domains in sequence, so a batch of 10 domains typically completes in 30–90 seconds.

Q: What DNS record types does Domain Intel enumerate? A: All seven common record types: A (IPv4), AAAA (IPv6), MX (mail exchange with priority), NS (name server), TXT (text/SPF/DKIM/DMARC), CNAME (canonical name), and SOA (start of authority). Every type is queried for each domain — no skips.

Q: Does WHOIS lookup return personal registrant contact information? A: It returns whatever the WHOIS server provides. Due to GDPR and ICANN policies, most registrars now redact personal information — names, addresses, phone numbers — showing "Redacted for Privacy" or "Data Protected" instead. Organization-level information is often still visible if the domain is registered to a company.

Q: Can I monitor SSL certificates for multiple domains automatically? A: Yes. Schedule Domain Intel to run daily or weekly via Apify's scheduler, a cron job, or a CI/CD pipeline. The Python example above shows how to flag domains with expiring certificates. Combine with a notification service (email, Slack, PagerDuty) for automated alerting.

Q: Why might a domain fail to return WHOIS data? A: WHOIS lookups can fail if: the TLD registry doesn't provide public WHOIS access, the WHOIS server is temporarily unavailable, the domain uses a registrar that rate-limits WHOIS queries, or the domain doesn't exist. Check the error field in the per-domain result for the specific reason.

Q: Does Domain Intel check SSL certificates on all resolved IPs? A: Domain Intel connects to the domain's A record (IPv4) on port 443 to inspect the SSL certificate. If the domain resolves to multiple A records, the first one is used. For hostnames that only serve HTTPS on non-standard ports or behind CDNs that terminate TLS early, the certificate presented may be the CDN's, not the origin server's.

Q: How does the SSL check handle wildcard certificates? A: Wildcard certificates (e.g., *.example.com) are detected and reported. The subject field shows *.example.com and the SANs list includes the wildcard entry along with any other names. The valid flag still correctly reflects whether the certificate is within its validity period.

Q: What is the SOA serial number used for? A: The SOA serial is a version number that increments whenever DNS zone data changes. It's useful for verifying DNS propagation — if the serial hasn't changed after you made a DNS update, the change hasn't been applied yet. Domain Intel reports it so you can confirm zone updates.

Related Tools

• Meta Mate — Extract Open Graph, Twitter Cards, and JSON-LD metadata from URLs
• UUID Lab — Generate UUIDs, nanoids, short IDs, and ULIDs
• QR Craft — Generate high-quality QR codes in PNG or SVG format
• JSON Studio — Format, validate, diff, and transform JSON documents

SEO Keywords

WHOIS lookup, DNS enumeration, SSL certificate checker, domain intelligence, DNS record checker, SSL expiry monitor, domain expiry checker, DNS A record, MX record lookup, TXT record checker, domain portfolio management, SSL certificate validator, SPF record checker, DMARC record checker, domain reconnaissance, WHOIS API, DNS API, SSL checker API, domain health check, certificate expiry monitoring, DNS propagation checker