WHOIS & DNS Domain Lookup (RDAP) - SPF, DMARC, SSL

Check hundreds of domains in one run: registration data (WHOIS via RDAP), DNS records, mail provider, SPF, DMARC and SSL certificate expiry, returned as clean JSON, CSV or Excel.

• RDAP-native. RDAP is the official successor of WHOIS. Since January 2025, gTLD registries are no longer required to run port-43 WHOIS, so WHOIS-based tools return more and more empty records. This Actor queries the official RDAP server of each registry, found through the IANA bootstrap file. It covers 1,200+ TLDs, including .com, .net, .org, .io, .co, .ai, .app, .dev, .fr, .uk, .de, .ch, .nl, .us, .ca and .au.
• Everything in one call. You get the registrar, creation and expiry dates, days to expiry, statuses, nameservers and DNSSEC, plus A/AAAA/MX/NS/TXT/CAA records, the detected mail provider (Google Workspace, Microsoft 365, Zoho, OVHcloud...), SPF, DMARC policy, and the SSL issuer and days left.
• GDPR-safe output. Registrant, administrative and technical contacts are never returned, even when a registry publishes them. E-mail addresses found in DNS records (DMARC report addresses, TXT) are masked to their domain (***@example.com). You only get registrar-level data, so the dataset holds no personal contact data.
• No result, no charge. Invalid inputs and domains where every check failed are returned for transparency, but they are not billed.

What can I use it for?

• Domain portfolio monitoring: schedule a daily run and alert when daysToExpiry or ssl.daysToExpiry drops below 30.
• Email deliverability and security audits: find domains with no DMARC, p=none, a missing SPF record or duplicate SPF records.
• IT and M&A due diligence: see the registrar, hosting, mail provider and certificate authority of a list of companies.
• Brand protection: check whether lookalike domains are registered and who their registrar is.
• AI agents: give an agent a reliable whois + dns tool through the Apify MCP server (see below).

Input

Domains, URLs or subdomains, one per line. Each value is reduced to its registered domain: https://blog.example.co.uk/page becomes example.co.uk. Duplicates are removed.

{
    "domains": ["apify.com", "https://www.google.fr/search", "bbc.co.uk"],
    "includeDns": true,
    "includeEmailSecurity": true,
    "includeSsl": true
}

Turn off the sections you don't need to get smaller rows. The price is the same.

Output

One row per domain. The example below is shortened.

{
    "domain": "apify.com",
    "host": "apify.com",
    "registered": true,
    "registeredSource": "rdap",
    "rdapSupported": true,
    "registrar": "Amazon Registrar, Inc.",
    "registrarIanaId": "468",
    "registrarAbuseEmail": "trustandsafety@support.aws.com",
    "createdAt": "2009-06-02T17:14:10Z",
    "updatedAt": "2026-05-16T16:53:04Z",
    "expiresAt": "2035-06-02T17:14:10Z",
    "domainAgeDays": 6338,
    "daysToExpiry": 3157,
    "statuses": ["client transfer prohibited"],
    "nameservers": ["ns-1225.awsdns-25.org", "ns-449.awsdns-56.com"],
    "dnssec": true,
    "dns": {
        "a": ["52.222.169.23"],
        "aaaa": ["2600:9000:218f:b800:9:a03e:6540:93a1"],
        "ns": ["ns-1225.awsdns-25.org", "ns-449.awsdns-56.com"],
        "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }],
        "txt": ["v=spf1 a mx include:_spf.google.com -all"],
        "caa": ["0 issue \"letsencrypt.org\""]
    },
    "mailProvider": "Google Workspace",
    "spf": "v=spf1 a mx include:_spf.google.com -all",
    "spfMultipleRecords": false,
    "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:***@apify.com",
    "dmarcPolicy": "reject",
    "ssl": {
        "valid": true,
        "error": null,
        "issuer": "Amazon",
        "validFrom": "2026-07-03T00:00:00.000Z",
        "validTo": "2027-01-16T23:59:59.000Z",
        "daysToExpiry": 98
    },
    "errors": [],
    "checkedAt": "2026-10-10T00:26:02.800Z"
}

Field	Meaning
registered	true or false from RDAP. For TLDs without a public RDAP server (e.g. .eu, .it, .es, .be), true when the domain has NS records, otherwise null.
registeredSource	rdap or dns: tells you how registered was decided.
daysToExpiry	Days until the domain expires. Negative means expired.
ssl.valid	false for expired, self-signed or mismatched certificates. The reason is in ssl.error, e.g. CERT_HAS_EXPIRED.
errors	Checks that failed for this domain, e.g. a registry timeout.

Some registries publish less data than others. DENIC (.de) and SWITCH (.ch), for example, do not publish registrar names or dates over RDAP, so those fields are null for these TLDs.

Pricing

$0.002 per domain checked ($2 per 1,000 domains), plus Apify's small run-start fee. There is no subscription and no proxy cost. Invalid inputs and fully failed lookups are free.

Speed and fair use

Registry RDAP terms (Verisign, Public Interest Registry...) forbid high-volume automated querying. This Actor therefore sends at most one request per second to each registry. Domains on different registries are checked in parallel (10 at a time). In practice, that means about 3,600 .com domains per hour, and mixed lists go faster. DNS and SSL checks are not throttled. The throttle also keeps your runs from being blocked with HTTP 429 errors.

Use the data for lawful purposes only: domain management, security, research or legal matters. Registry terms prohibit using it for unsolicited advertising.

Use it from AI agents (MCP)

This Actor works as a tool in the Apify MCP server. Add whois-dns-domain-lookup to your MCP client (Claude, Cursor, VS Code...), and your agent can call it with a list of domains and get compact JSON back.

Integrations

Run it through the Apify API, on a schedule, or from Make, Zapier, n8n and webhooks. Export results as JSON, CSV, Excel or HTML.

FAQ

Is this a WHOIS lookup? Yes. RDAP is the standardized, JSON-based replacement for WHOIS, run by the same registries. It returns the same registration data in a structured form.

Why are registrant names and emails missing? On purpose. Most registries redact them under GDPR, and this Actor never outputs personal contact data, so the results stay safe to store and share. You still get the registrar and its abuse contact.

Can it check whether a domain is available? It reports registered: false when the registry has no record of the domain. A dedicated bulk availability checker is coming.

Something wrong or missing? Open an issue on the Issues tab.