Domain Analyzer: DNS, Email Auth and WHOIS

One run, up to 1,000 domains, one report each: DNS records, mail routing, graded SPF/DMARC/DKIM, registration data from the registry, and whether the name is taken. Ask for all four facets or only the ones you need.

What you get

One dataset item per domain you send. Here is one of them, for input example.com with all facets:

{
  "domain": "example.com",
  "checks": ["dns", "email-auth", "registration", "availability"],
  "dns": {
    "a": ["104.20.23.154", "172.66.147.243"],
    "aaaa": ["2606:4700:10::ac42:93f3", "2606:4700:10::6814:179a"],
    "ns": ["hera.ns.cloudflare.com", "elliott.ns.cloudflare.com"],
    "txt": ["v=spf1 -all", "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"],
    "cname": [],
    "soa": "elliott.ns.cloudflare.com. dns.cloudflare.com. 2413856909 10000 2400 604800 1800",
    "caa": [],
    "mx": { "found": true, "nullMx": true, "implicit": false, "hosts": [] },
    "dnssec": true,
    "nxdomain": false
  },
  "emailAuth": {
    "spf": {
      "found": true,
      "record": "v=spf1 -all",
      "all": "-all",
      "grade": "strict",
      "lookupCount": 0,
      "overflow": false,
      "multipleRecords": false
    },
    "dmarc": {
      "found": true,
      "policy": "reject",
      "pct": 100,
      "rua": [],
      "grade": "enforced",
      "multipleRecords": false,
      "inheritedFrom": null
    },
    "dkim": {
      "checked": ["google", "selector1", "selector2", "k1", "default", "dkim"],
      "found": [],
      "confidence": "selector-guess"
    }
  },
  "registration": {
    "source": "rdap",
    "inconclusiveReason": null,
    "registrar": "RESERVED-Internet Assigned Numbers Authority",
    "createdAt": "1995-08-14T04:00:00Z",
    "expiresAt": "2027-08-13T04:00:00Z",
    "statuses": [
      "client delete prohibited",
      "client transfer prohibited",
      "client update prohibited"
    ],
    "nameservers": ["ELLIOTT.NS.CLOUDFLARE.COM", "HERA.NS.CLOUDFLARE.COM"],
    "registrantRedacted": true
  },
  "availability": { "registered": true, "indicator": "rdap-200" },
  "reasonCode": "ok"
}

Use it when

• You are auditing email authentication across the domains you own or sell to, and need SPF and DMARC graded rather than dumped.
• You are qualifying inbound signups or leads, where mail setup and domain age say a lot about who you are dealing with.
• You are checking mail routing before a send: whether a domain accepts mail at all, which hosts take it, and at what priority.
• You are migrating DNS and want the before and after state of a domain in one structured record.
• An agent is enriching a list of domains and would otherwise fire eight DNS queries plus an RDAP call per row.

Input

Field	Type	Required	What it does
domains	array of strings	yes	The domains to analyze, up to 1,000 per run. A URL or an email address is reduced to its host name (a leading www. is dropped, other subdomains are kept), and internationalized names are converted to punycode. Each distinct name gets one dataset item and one charge: inputs that normalize to the same name count once.
checks	array	no	Any of dns, email-auth, registration, availability. Defaults to all four. The price is the same per report whichever facets you ask for; asking for fewer only skips work you don't need.
dkimSelectors	array	no	Up to 10 DKIM selectors to probe. Without this, a common-selector guess list is used and the result is marked as a guess.

checks and dkimSelectors are run-wide settings: they apply to every domain in the batch, not to one of them. If different domains need different facets or different selectors, split them across runs.

email-auth reads SPF from the domain's root TXT records, so it runs the DNS lookup whether or not you asked for the dns facet. availability is derived from the same RDAP call as registration.

What each facet answers

dns returns A, AAAA, NS, TXT, CNAME, SOA and CAA records, plus DNSSEC presence and an nxdomain flag when the name has no DNS presence at all. Mail routing is classified, not listed raw. nullMx marks an RFC 7505 0 . record, which means the domain refuses all mail, and implicit marks a domain with no MX record but an A record, which under RFC 5321 still receives mail at its own address. Hosts come back sorted by priority.

email-auth grades what it finds. SPF is strict for -all, moderate for ~all, weak for ?all or +all, and none when there is no usable policy. Terms are tokenized, so a hostname like include:spf.mailall.com is not mistaken for +all, and lookupCount counts the DNS-lookup terms in the domain's own SPF record, with overflow set when that alone exceeds RFC 7208's 10-lookup limit. Nested include: records are not followed, so the count is a lower bound: overflow: true means the record will fail at receivers, false does not prove it stays under the limit. DMARC is enforced for p=reject, partial for p=quarantine, unprotected for p=none. Publishing two SPF or two DMARC records makes both RFCs discard the whole set, so that case comes back as no policy with multipleRecords: true rather than a grade the domain does not actually have. A subdomain with no _dmarc record of its own is covered by its organizational domain's policy (RFC 7489 §6.6.3), so it is graded on that policy. The grade uses the parent's sp= tag when it has one, and its p= tag otherwise. inheritedFrom names the domain the policy came from. inheritedFrom: null means the record is published at the name you asked about. DKIM has no discovery mechanism, so found is only ever a statement about the selectors in checked.

registration returns registrar, creation and expiry dates, EPP statuses and registry nameservers from RDAP. Registrant contact data is redacted at the registries, and registrantRedacted says so rather than implying the field is empty for some other reason.

availability gives a registered flag backed by the RDAP response, and appears only when the registry answered conclusively. registered: false means the registry has no registration record, not that the name can be bought: reserved, blocked and premium names often have none.

Pricing

Pay per event, $5.00 per 1,000 domains reported ($0.005 each), charged once on the domain-analyzed event.

A report is charged when at least one requested facet answered and none failed. A conclusive negative counts as an answer: domain_not_found means the checks came back and the domain is not there, which is what you asked. What you do not pay for is a report that our side of the transaction failed to produce.

The price is per report, not per facet. Some registries, .de among them, publish no public registration data. A report for such a domain still carries its DNS and email-authentication results, so it comes back partial and is charged like any other report, without the registration facet. If registration data is the only thing you need, use domain-whois, which charges nothing when no registry can answer.

reasonCode	Meaning	Charged
ok	Every requested facet answered.	yes
partial	Something answered, and a facet came back with "no registry can answer this".	yes
domain_not_found	The lookups succeeded and the domain does not exist.	yes
inconclusive	Everything resolved, nothing conclusive came back.	no
unsupported_tld	The TLD publishes no RDAP service.	no
resolve_error	An upstream lookup failed.	no
rate_limited	We were throttled upstream, which is our problem, not yours.	no
invalid_domain	Not a registrable name: an IP, a bare TLD, localhost, a malformed label.	no

If you set a maximum total charge for a run, the Actor stops as soon as that limit is reached instead of working for free. Items after that point are left out of the dataset and not charged, and the run log says how many; submit them in a new run.

What this does not do

It does not send mail or connect to any MX host, so it reports how a domain is configured to receive mail, not whether a given address exists.

DKIM absence at the probed selectors is not proof that a domain has no DKIM. Supply your own selectors when you know them, and confidence switches to caller-provided.

Registrant names, emails and addresses are not available from RDAP and are not returned.

How it works

DNS runs over DNS-over-HTTPS against Cloudflare's 1.1.1.1 JSON API, and answers are filtered to the record type actually asked for, so a CNAME in the chain does not contaminate the A or MX results. Registration data comes from RDAP over HTTPS. Both retry on 429, 5xx and transport failures with exponential backoff, honor Retry-After, and enforce a per-attempt deadline. Availability is checked against IANA's RFC 9224 list of TLDs that publish RDAP, so an ambiguous 404 is never read as "this name is free". Subdomains are caught against the public suffix list before any RDAP call is made.

One report per domain

Domains are analyzed in the order you send them, each written as its own dataset item. There is no start fee, so a list of 1,000 domains pays one container start for the whole run instead of one per name:

const run = await client.actor('pontio/analyze-domain').call({
  domains: ['example.com', 'example.org'],
  checks: ['dns', 'email-auth'],
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();

If you set a maximum charge for the run and the batch reaches it, the run stops there rather than carrying on with work it cannot charge for. A run that reaches its timeout stops the same way. Either way the items already written stay in the dataset, and each names what it answers, so you can re-run the remainder.

Only need registrar and expiry? Domain WHOIS / RDAP Lookup does that one lookup on its own.