Domain WHOIS, DNS & SSL Checker: Expiry, SPF & DMARC

Give it a list of domains and get back one row per domain with everything you'd otherwise look up in five different tools: registration and expiry (registrar, created, expires, status codes, DNSSEC), DNS records, email authentication (SPF, DMARC, DKIM, MTA-STS, BIMI), the SSL certificate and HTTPS redirects, plus a plain-English list of issues such as "expires in 12 days", "no DMARC record" or "certificate is for another name".

You pay only for domains where at least one check returned data. A "not registered" answer counts as data, since that's often exactly what you want to know. Entries that aren't domains, and domains where nothing answered at all, still get a row but cost nothing.

Who it's for

• Agencies and IT teams watching a portfolio of client or company domains for expiring registrations and certificates.
• Email deliverability and security work: find domains with no DMARC, a weak SPF (+all, ?all), too many SPF lookups, or missing DKIM.
• Sales and research: check lead or vendor domains in bulk (is it registered, who's the registrar, does the website work, is email set up).
• Domain investors: registration dates, expiry and status codes (on hold, redemption period, pending delete) for a list of names.

What makes it different

	This tool	A typical WHOIS, DNS or SSL tool in the Store
Checks in one row	Registration, DNS, SPF/DMARC/DKIM, SSL, HTTP	Usually one of these
Registration data	RDAP, the registries' official structured service, with dates in one format	Often parsed WHOIS text, which differs per registry
Issues list	Yes: code, severity and a plain message per problem	Usually raw data only
Input	Domains, hosts, web addresses or email addresses	Usually bare domains
Personal data	Registrant, admin and tech contacts are always dropped	Varies
Price	$1.50 per 1,000 domains, only for domains that answered	About $1 to $3 per 1,000

What each check does

• Registration (RDAP). Finds each TLD's official RDAP server in the IANA list (rdap.org for TLDs not listed) and reads: registered or not, registrar name and IANA id, created, expires and last-changed dates, days until expiry, status codes (like client transfer prohibited or redemption period), nameservers and whether DNSSEC is signed. For TLDs with no public RDAP service (some country domains), "registered or not" is read from DNS instead and source says dns.
• DNS. A, AAAA, NS, MX, TXT, CAA (from the host up to the domain), SOA serial and primary nameserver, the host's CNAME and the CNAME of www. Uses the normal resolver, and switches to DNS over HTTPS (Cloudflare, then Google) once per run if plain DNS is blocked.
• Email authentication (DNS only, no mail server is ever contacted). SPF record and its all ending, includes, the total DNS lookups it needs with nested includes followed (over 10 breaks SPF), and multiple records. DMARC policy (p, sp, pct), whether reports are requested and to which domains, found on the host or inherited from the main domain. DKIM keys at common selectors (google, selector1, selector2, k1, k2, s1, s2, default, dkim, mail) plus any you add. MX, null MX, MTA-STS and BIMI presence.
• SSL. A TLS handshake on port 443 with the host's name (10 second timeout): certificate name and alternative names, issuer, valid from and to, days left, whether the name matches, whether the chain is trusted (and why not), and the TLS version negotiated.
• HTTP. Requests https://host/ and http://host/, follows up to 10 redirects by hand, and reports the final address and status, the HSTS header and whether http moves to https. Only status codes and headers are read.

Input

Field	What it does
Domains	One per line: acme.com, shop.acme.co.uk, https://www.acme.com/about or jane@acme.com. Registration is looked up for the registrable domain (acme.co.uk); the other checks use the host as given. Repeats are checked once.
Checks	Any of registration, dns, email, ssl, http. All on by default.
Extra DKIM selectors	Selectors to check on top of the common ones, e.g. the s= value from a DKIM-Signature header.
Domains at once	Parallel domains (default 10, max 50).

{
  "domains": ["acme.com", "https://www.acme.co.uk/shop", "billing@acme.de"],
  "checks": ["registration", "dns", "email", "ssl", "http"],
  "dkimSelectors": ["mandrill"]
}

Output

One row per domain (shortened, values illustrative):

{
  "input": "https://acme.com/about",
  "domain": "acme.com",
  "host": "acme.com",
  "status": "ok",
  "registration": {
    "registered": true, "source": "rdap", "registrar": "Example Registrar, Inc.", "registrarIanaId": "1234",
    "createdAt": "2012-03-14T17:02:11Z", "expiresAt": "2026-11-24T17:02:11Z", "updatedAt": "2025-10-25T09:13:40Z",
    "daysUntilExpiry": 20, "statuses": ["client transfer prohibited"],
    "nameservers": ["ns1.dnshost.net", "ns2.dnshost.net"], "dnssecSigned": false, "rdapServer": "rdap.verisign.com"
  },
  "dns": {
    "a": ["93.184.215.14"], "aaaa": [], "ns": ["ns1.dnshost.net", "ns2.dnshost.net"],
    "mx": [{"priority": 10, "host": "mx1.mailhost.com"}], "txt": ["v=spf1 include:_spf.mailhost.com ~all"],
    "caa": [{"flags": 0, "tag": "issue", "value": "letsencrypt.org"}], "soaSerial": 2025110301, "wwwCname": "acme.com"
  },
  "email": {
    "mxPresent": true,
    "spf": {"present": true, "all": "~all", "includeCount": 1, "dnsLookups": 4, "tooManyLookups": false},
    "dmarc": {"present": false, "policy": null},
    "dkim": {"found": ["google"]},
    "mtaSts": false, "bimi": false
  },
  "ssl": {
    "host": "acme.com", "tlsVersion": "TLSv1.3", "subjectCN": "acme.com", "sans": ["acme.com", "www.acme.com"],
    "issuerOrg": "Let's Encrypt", "notAfter": "2026-11-12T08:00:00Z", "daysLeft": 8,
    "hostnameMatches": true, "chainValid": true
  },
  "http": {
    "finalUrl": "https://www.acme.com/", "finalStatus": 200, "hsts": null, "httpToHttps": true
  },
  "issues": [
    {"code": "domain_expires_soon", "severity": "warning", "message": "acme.com expires in 20 days (2026-11-24)."},
    {"code": "dmarc_missing", "severity": "warning", "message": "No DMARC record at _dmarc.acme.com: spoofed mail is not blocked."},
    {"code": "ssl_expires_soon", "severity": "warning", "message": "The SSL certificate of acme.com expires in 8 days."},
    {"code": "no_hsts", "severity": "info", "message": "https://www.acme.com/ sends no Strict-Transport-Security (HSTS) header."}
  ],
  "issueCount": 4,
  "worstSeverity": "warning",
  "error": null,
  "checkedAt": "2026-11-04T10:12:01+00:00"
}

status is one of:

• ok: at least one check returned data. Charged.
• not_registered: the registry says the domain doesn't exist (or, for TLDs without RDAP, it isn't in the TLD's DNS zone). Charged. The other checks are skipped.
• invalid_domain: the entry isn't a usable public domain (an IP address, localhost, co.uk on its own, a made-up TLD). Free.
• error: nothing answered (error says what failed). Free.

Issue codes (severity in brackets): domain_expired (critical), domain_expires_soon under 30 days (warning), domain_status_client_hold, _server_hold, _redemption_period, _pending_delete (critical), domain_not_in_dns (critical), not_registered (critical), dnssec_unsigned (info), host_not_found (critical), no_address, single_nameserver (warning), no_caa (info), spf_missing (warning, info if the domain gets no mail), spf_plus_all, spf_multiple_records (critical), spf_neutral_all, spf_too_many_lookups (warning), spf_no_all (info), dmarc_missing (warning), dmarc_multiple_records (critical), dmarc_invalid (warning), dmarc_policy_none, dmarc_no_reports, dkim_not_found, no_mx (info), ssl_expired, ssl_not_yet_valid, ssl_hostname_mismatch, ssl_chain_invalid (critical), ssl_expires_soon under 14 days, ssl_unavailable, tls_outdated (warning), https_not_working (critical), https_redirect_problem, https_error_status, no_https_redirect, private_address (warning), no_hsts (info).

The dataset has three views: an Overview table, an Issues table and a Registration table. Download as JSON, CSV or Excel, or send results to Google Sheets, Zapier, Make or n8n. The run also saves a SUMMARY record with counts per status, issues by severity, and what was charged.

Pricing

Pay per event: $0.0015 per domain checked ($1.50 per 1,000), for every row with status ok or not_registered. No start fee, and the price is the same however many checks you turn on. Invalid entries and domains where nothing answered are free. Set a maximum charge per run in the run options and the Actor stops cleanly when it's reached.

Good to know

• RDAP coverage. Nearly all generic TLDs (.com, .net, .org, .io, .app, .dev...) and many country TLDs have RDAP. A few country registries don't offer public RDAP; for those you get registered or not and the nameservers from DNS, but no registrar or dates. Some registries also leave out or redact fields.
• Registries limit request rates. At most 2 requests at a time go to one RDAP server, and a "too many requests" answer pauses that server before trying again. Very large lists on one TLD take longer.
• DKIM can only be checked by name. There is no way to list a domain's DKIM keys, so "not found" means none of the selectors checked exist, not that the domain has no DKIM.
• SSL and HTTP use the host you give. For a bare domain with no address of its own, www. is checked instead (the ssl.host field says which). Hosts that resolve to private or internal addresses are never contacted.
• robots.txt is respected. If a site's robots.txt asks tools to stay off its home page, the HTTP check is skipped for it (http.skipped says so). The SSL check is a TLS handshake only.
• No mail server is ever contacted. A domain's own servers get only the TLS handshake, its robots.txt, and the home page over https and http (plus any redirects), read for status and headers only.

Responsible use

• Only public registration facts are kept. Registrant, admin, tech, billing and abuse contacts, and every vCard in the RDAP answer, are dropped before anything is saved, so no names, emails, phone numbers or postal addresses of people end up in the output. DMARC report addresses are reduced to their domain.
• Requests name the tool in their User-Agent (DomainHealthChecker).

This Actor isn't affiliated with or endorsed by IANA, any registry, registrar, DNS provider or certificate authority.

More tools from the same developer

• Broken Link Checker: 404s, Redirects & Dead Links
• SEO Audit Tool: On-Page Checks, Crawl & Broken Links
• Sitemap URL Extractor: All Site URLs, Lastmod & News
• Bulk URL Status Checker: Redirect Chain & Response Time
• Wayback Machine Scraper: Snapshots, Changes & Page Text
• Website Screenshot & PDF: Full Page, Mobile, Batch URLs