# WHOIS & DNS Domain Lookup (RDAP) - SPF, DMARC, SSL (`propped_cloak/whois-dns-domain-lookup`) Actor

Bulk WHOIS lookup via RDAP plus DNS records, mail provider, SPF, DMARC and SSL certificate expiry for any list of domains. GDPR-safe: no personal contact data. Pay per domain, no result no charge.

- **URL**: https://apify.com/propped_cloak/whois-dns-domain-lookup.md
- **Developed by:** [Emmanuel Vingadassalon](https://apify.com/propped_cloak) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.60 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## WHOIS & DNS Domain Lookup (RDAP) - SPF, DMARC, SSL

Check hundreds of domains in one run: **registration data (WHOIS via RDAP), DNS records, mail provider, SPF, DMARC and SSL certificate expiry**, returned as clean JSON, CSV or Excel.

- **RDAP-native.** RDAP is the official successor of WHOIS. Since January 2025, gTLD registries are no longer required to run port-43 WHOIS, so WHOIS-based tools return more and more empty records. This Actor queries the official RDAP server of each registry, found through the IANA bootstrap file. It covers 1,200+ TLDs, including .com, .net, .org, .io, .co, .ai, .app, .dev, .fr, .uk, .de, .ch, .nl, .us, .ca and .au.
- **Everything in one call.** You get the registrar, creation and expiry dates, days to expiry, statuses, nameservers and DNSSEC, plus A/AAAA/MX/NS/TXT/CAA records, the detected mail provider (Google Workspace, Microsoft 365, Zoho, OVHcloud...), SPF, DMARC policy, and the SSL issuer and days left.
- **GDPR-safe output.** Registrant, administrative and technical contacts are never returned, even when a registry publishes them. E-mail addresses found in DNS records (DMARC report addresses, TXT) are masked to their domain (`***@example.com`). You only get registrar-level data, so the dataset holds no personal contact data.
- **No result, no charge.** Invalid inputs and domains where every check failed are returned for transparency, but they are not billed.

### What can I use it for?

- **Domain portfolio monitoring:** schedule a daily run and alert when `daysToExpiry` or `ssl.daysToExpiry` drops below 30.
- **Email deliverability and security audits:** find domains with no DMARC, `p=none`, a missing SPF record or duplicate SPF records.
- **IT and M\&A due diligence:** see the registrar, hosting, mail provider and certificate authority of a list of companies.
- **Brand protection:** check whether lookalike domains are registered and who their registrar is.
- **AI agents:** give an agent a reliable `whois` + `dns` tool through the Apify MCP server (see below).

### Input

Domains, URLs or subdomains, one per line. Each value is reduced to its registered domain: `https://blog.example.co.uk/page` becomes `example.co.uk`. Duplicates are removed.

```json
{
    "domains": ["apify.com", "https://www.google.fr/search", "bbc.co.uk"],
    "includeDns": true,
    "includeEmailSecurity": true,
    "includeSsl": true
}
```

Turn off the sections you don't need to get smaller rows. The price is the same.

### Output

One row per domain. The example below is shortened.

```json
{
    "domain": "apify.com",
    "host": "apify.com",
    "registered": true,
    "registeredSource": "rdap",
    "rdapSupported": true,
    "registrar": "Amazon Registrar, Inc.",
    "registrarIanaId": "468",
    "registrarAbuseEmail": "trustandsafety@support.aws.com",
    "createdAt": "2009-06-02T17:14:10Z",
    "updatedAt": "2026-05-16T16:53:04Z",
    "expiresAt": "2035-06-02T17:14:10Z",
    "domainAgeDays": 6338,
    "daysToExpiry": 3157,
    "statuses": ["client transfer prohibited"],
    "nameservers": ["ns-1225.awsdns-25.org", "ns-449.awsdns-56.com"],
    "dnssec": true,
    "dns": {
        "a": ["52.222.169.23"],
        "aaaa": ["2600:9000:218f:b800:9:a03e:6540:93a1"],
        "ns": ["ns-1225.awsdns-25.org", "ns-449.awsdns-56.com"],
        "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }],
        "txt": ["v=spf1 a mx include:_spf.google.com -all"],
        "caa": ["0 issue \"letsencrypt.org\""]
    },
    "mailProvider": "Google Workspace",
    "spf": "v=spf1 a mx include:_spf.google.com -all",
    "spfMultipleRecords": false,
    "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:***@apify.com",
    "dmarcPolicy": "reject",
    "ssl": {
        "valid": true,
        "error": null,
        "issuer": "Amazon",
        "validFrom": "2026-07-03T00:00:00.000Z",
        "validTo": "2027-01-16T23:59:59.000Z",
        "daysToExpiry": 98
    },
    "errors": [],
    "checkedAt": "2026-10-10T00:26:02.800Z"
}
```

| Field | Meaning |
|---|---|
| `registered` | `true` or `false` from RDAP. For TLDs without a public RDAP server (e.g. .eu, .it, .es, .be), `true` when the domain has NS records, otherwise `null`. |
| `registeredSource` | `rdap` or `dns`: tells you how `registered` was decided. |
| `daysToExpiry` | Days until the domain expires. Negative means expired. |
| `ssl.valid` | `false` for expired, self-signed or mismatched certificates. The reason is in `ssl.error`, e.g. `CERT_HAS_EXPIRED`. |
| `errors` | Checks that failed for this domain, e.g. a registry timeout. |

Some registries publish less data than others. DENIC (.de) and SWITCH (.ch), for example, do not publish registrar names or dates over RDAP, so those fields are `null` for these TLDs.

### Pricing

**$0.002 per domain checked ($2 per 1,000 domains)**, plus Apify's small run-start fee. There is no subscription and no proxy cost. Invalid inputs and fully failed lookups are free.

### Speed and fair use

Registry RDAP terms (Verisign, Public Interest Registry...) forbid high-volume automated querying. This Actor therefore sends **at most one request per second to each registry**. Domains on different registries are checked in parallel (10 at a time). In practice, that means about 3,600 .com domains per hour, and mixed lists go faster. DNS and SSL checks are not throttled. The throttle also keeps your runs from being blocked with HTTP 429 errors.

Use the data for lawful purposes only: domain management, security, research or legal matters. Registry terms prohibit using it for unsolicited advertising.

### Use it from AI agents (MCP)

This Actor works as a tool in the [Apify MCP server](https://mcp.apify.com). Add `whois-dns-domain-lookup` to your MCP client (Claude, Cursor, VS Code...), and your agent can call it with a list of domains and get compact JSON back.

### Integrations

Run it through the Apify API, on a schedule, or from Make, Zapier, n8n and webhooks. Export results as JSON, CSV, Excel or HTML.

### FAQ

**Is this a WHOIS lookup?** Yes. RDAP is the standardized, JSON-based replacement for WHOIS, run by the same registries. It returns the same registration data in a structured form.

**Why are registrant names and emails missing?** On purpose. Most registries redact them under GDPR, and this Actor never outputs personal contact data, so the results stay safe to store and share. You still get the registrar and its abuse contact.

**Can it check whether a domain is available?** It reports `registered: false` when the registry has no record of the domain. A dedicated bulk availability checker is coming.

**Something wrong or missing?** Open an issue on the Issues tab.

# Actor input Schema

## `domains` (type: `array`):

Domain names or URLs, one per line. Subdomains and URLs are reduced to the registered domain (blog.example.co.uk becomes example.co.uk). Duplicates are removed.

## `includeDns` (type: `boolean`):

Return A, AAAA, MX, NS, TXT and CAA records.

## `includeEmailSecurity` (type: `boolean`):

Detect the mail provider from MX records (Google Workspace, Microsoft 365...) and return the SPF record, the DMARC record and the DMARC policy.

## `includeSsl` (type: `boolean`):

Connect to port 443 and return the certificate issuer, validity and days to expiry.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "example.org",
    "bbc.co.uk"
  ],
  "includeDns": true,
  "includeEmailSecurity": true,
  "includeSsl": true
}
```

# Actor output Schema

## `results` (type: `string`):

One row per domain: registration (RDAP), DNS, mail provider, SPF, DMARC and SSL.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "example.org",
        "bbc.co.uk"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("propped_cloak/whois-dns-domain-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "example.org",
        "bbc.co.uk",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("propped_cloak/whois-dns-domain-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "example.org",
    "bbc.co.uk"
  ]
}' |
apify call propped_cloak/whois-dns-domain-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,propped_cloak/whois-dns-domain-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/SKQiUgak5tCQ6CRzH/builds/zGmpuLlAQNNHDRhf3/openapi.json