Domain Intelligence Scraper — WHOIS + DNS Posture

Get complete domain registration data AND live DNS posture in one run — no API key, no proxy, no monthly fee. Built on keyless official RDAP (the structured JSON successor to WHOIS) and DNS-over-HTTPS.

Built by Prime Sieve — the team behind the Remote Signal newsletter: https://remotesignal.substack.com

What you get per domain

Registration (RDAP — official IANA/Verisign, not scraped text):

• Registrar name
• Created / updated / expires dates (ISO 8601)
• Days until expiry + expiry_soon flag (≤60 days)
• Domain status codes (clientTransferProhibited, etc.)
• Nameservers
• DNSSEC status (signed/unsigned) from RDAP
• Registrar abuse contact emails

DNS posture (DNS-over-HTTPS via dns.google):

• A / AAAA (IPv4 / IPv6)
• MX (mail servers)
• TXT (SPF, domain-verification tokens)
• NS / SOA / CNAME / CAA
• SPF record extracted
• DMARC record extracted (separate _dmarc. query)
• DS presence (DNSSEC at delegation)
• Privacy-protection flag (domain behind Google/Cloudflare/Workplace privacy when a verification TXT is present)

Why it's different

Most "WHOIS scraper" actors return only raw registrant text. This actor gives you:

1. Structured RDAP fields — registrar, dates, nameservers, DNSSEC — not mangled WHOIS text.
2. DNS posture in the same dataset — SPF/DMARC/CAA/privacy mean you can actually run compliance and security scans (email spoofing risk, DNSSEC coverage, expiry risk) without a second tool.
3. Bulk-ready — paste hundreds or thousands of domains; one row per domain.

Who pays for this

• Security teams — phishing-domain watchlists, expired-or-soon-to-expire infrastructure, SPF/DMARC posture audits, DNSSEC coverage checks
• DevOps / SRE — DNS change detection, nameserver/registrar tracking across a fleet
• Domain investors / portfolio managers — expiry alerts, registrar comparison
• Compliance / brand protection — impersonation domains, abuse-contact collection
• SEO / digital PR — expired-domain discovery, backlink-domain vetting

Input

{
  "domains": ["example.com", "google.com", "stripe.com"],
  "includeDns": true,
  "normalizeDomains": true
}

• domains: array of domains (auto-strips https:// and www.)
• includeDns: set false for WHOIS-only (fewer calls, cheaper)
• normalizeDomains: validation + normalization

Sample Output

{
  "domain": "google.com",
  "registrar": "MarkMonitor Inc.",
  "created": "1997-09-15T04:00:00Z",
  "expires": "2028-09-14T04:00:00Z",
  "days_to_expiry": 792,
  "expiry_soon": false,
  "nameservers": ["ns1.google.com", "ns2.google.com"],
  "rdap_dnssec": null,
  "spf": "v=spf1 include:_spf.google.com ~all",
  "dmarc": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
  "privacy_protection": false
}

Pricing

Pay per domain lookup (domain-lookup event). WHOIS (RDAP) is always included; DNS adds two requests per domain. Competitors charge $1–10 per 1K raw WHOIS rows — we ship structured fields plus DNS posture for less, and you pay only for domains we actually resolve.

No API keys. No proxies. No monthly fees. Built on the public keyless IANA RDAP ecosystem and dns.google DNS-over-HTTPS.

Example use cases:

• Watchlist of 10K phishing candidates → 10K rows, full posture, one run
• Fleet DNS audit → exports straight to CSV/JSON

Remote Signal

We built this actor to power our own domain-spoofing watchlist. Get the newsletter with tools, signals and data tips: https://remotesignal.substack.com