Domain Intelligence — WHOIS/RDAP, DNS, TLS & Email Security in One Call

Check any domain against every official source at once and get back one clean JSON: who registered it and until when, its full DNS, whether its email can be spoofed, whether its HTTPS certificate is actually valid, what it tells crawlers, and how far back the archive goes.

No scraping, no captchas, no proxies. Every field comes from a registry or an internet protocol — RDAP, DNS-over-HTTPS, a real TLS handshake, robots.txt, and the Wayback Machine CDX index. That is why this Actor does not break when a website changes its markup.

Why one Actor instead of five

Domain checks are normally spread across a WHOIS lookup, a DNS tool, an SSL checker and a sitemap finder — four runs, four schemas, four things to stitch together. This Actor does the whole set concurrently and returns a single record per domain, with a one-word verdict you can branch on and a flags array where every finding names the source that produced it.

What you get per domain

Section	Contents
registration	Registrar and its IANA ID, abuse contact, registration / expiry / last-changed dates, registry status codes, nameservers, DNSSEC. Read over RDAP, the IETF replacement for WHOIS.
dns	A, AAAA, MX, NS, TXT, SOA, CAA records, the detected mail provider, and the mail-security posture: SPF (with its policy) and DMARC (with p=).
tls	Issuer, subject, validity window, days until expiry, every subject alternative name, whether the certificate really covers the domain, negotiated protocol.
robots	Declared sitemaps, number of disallow rules, whether the site blocks all crawlers.
archive	First and last successful Wayback snapshot — real evidence of age, independent of the registration date. Optional.
flags	Explicit findings, each with code, severity, message and source.
verdict	clean, notice, warning or alert — the worst severity found.

Flags it raises

domainExpired · domainExpiringSoon · newlyRegistered (under 90 days — a standard phishing signal) · domainNotRegistered · registryHold · transferLockMissing · dnssecUnsigned · doesNotResolve · noMailRecords · spfMissing · dmarcMissing · dmarcPolicyNone · parkedDomain · httpsUnavailable · certificateExpired · certificateExpiringSoon · certificateHostnameMismatch · certificateNotTrusted · robotsBlocksAllCrawlers · noSitemapDeclared · noArchiveHistory

Input

Paste domains in any shape. URLs and email addresses are cleaned up automatically, so https://www.example.com/pricing and info@example.com both become example.com.

{
  "domains": ["apify.com", "https://www.example.com/pricing", "info@example.org"],
  "includeRegistration": true,
  "includeDns": true,
  "includeTls": true,
  "includeRobots": true,
  "includeWayback": false,
  "maxResults": 100,
  "minExpectedResults": 0
}

Turn off any section you do not need — each one you skip makes the run faster and cheaper. includeWayback is off by default because the archive index is the slowest source.

Sample output (trimmed)

{
  "domain": "apify.com",
  "checkedOn": "2026-08-08",
  "verdict": "clean",
  "flagCount": 0,
  "flags": [],
  "registration": {
    "available": true,
    "registrar": "Amazon Registrar, Inc.",
    "registeredOn": "2009-06-02T17:14:10Z",
    "expiresOn": "2035-06-02T17:14:10Z",
    "statuses": ["client transfer prohibited"],
    "dnssec": true,
    "registrantRedacted": true,
    "source": "https://rdap.verisign.com/com/v1/domain/apify.com"
  },
  "dns": {
    "ipv4": ["18.66.26.11"],
    "mx": ["aspmx.l.google.com"],
    "mailProvider": "Google Workspace",
    "spf": "v=spf1 include:_spf.google.com -all",
    "spfPolicy": "-",
    "dmarcPolicy": "reject",
    "resolves": true
  },
  "tls": {
    "available": true,
    "issuer": "Amazon",
    "validTo": "2027-01-16",
    "daysUntilExpiry": 161,
    "coversDomain": true,
    "authorized": true
  }
}

Built for AI agents

• One small JSON per domain, no nested crawl output to post-process.
• Fast — every source is queried concurrently; a domain typically finishes in a few seconds.
• Idempotent — same domain, same answer. No sessions, no cookies, no login.
• Honest failure — when a source cannot answer, you get available: false and a plain-language reason instead of a silently missing field. A subdomain is looked up at its registered parent, and that parent is reported in registeredDomain.

Typical uses

• Vendor and counterparty due diligence — how old is this supplier's domain, does it expire next month, is it parked?
• Phishing and fraud triage — a domain registered 11 days ago with no DMARC and a mismatched certificate.
• Email deliverability audits — find every domain in a portfolio missing SPF or running DMARC p=none.
• Certificate expiry monitoring — schedule it daily and alert on certificateExpiringSoon.
• Lead and account enrichment — mail provider, hosting, and registrar for a list of company domains.

Scheduling and health checks

Set minExpectedResults to the number of domains you expect. If the run produces fewer, it fails loudly instead of quietly returning less — so a scheduled monitor tells you when something upstream changed. Pair it with a Schedule and Apify's failure notifications.

Coverage and limits

• RDAP covers all gTLDs (.com, .net, .org, and the new ones) plus many ccTLDs. Some ccTLDs — .eu and .io among them — publish no RDAP service in the IANA bootstrap; the Actor says so explicitly in registration.reason and still returns DNS, TLS and the rest.
• Registrant identity is redacted by most registries under the GDPR. This Actor reports that a redaction is in place (registrantRedacted) and never attempts to unmask a private individual. It returns registrar and abuse contacts, which are company data.
• Wayback history is best-effort. The archive index is slow and inconsistent — on domains with very large archives it can exceed the 20-second budget. When that happens you get archive.available: false with the reason, and every other section is unaffected. This is why the section is off by default.
• Rate limits are the public ones of each source; the Actor retries transient failures with backoff.

Pricing

Pay per event: a small charge to start the run, then a per-domain charge. You pay for domains checked, not for compute time.