Domain RDAP Lookup - Free Beta

Look up public domain-registration metadata from authoritative RDAP services without WHOIS scraping, browser automation, logins, API keys, or proxies. The Actor accepts 1-25 bare domains, discovers each TLD's service through IANA's bootstrap registry, and returns normalized registrar, lifecycle, status, nameserver, entity, DNSSEC, notice, and source fields.

Official basis and usage boundary

• IANA publishes the official RDAP bootstrap registry for the domain name space and links its machine-readable dns.json. The registry references RFC 9224 for authoritative service discovery.
• IANA's linked licensing terms place applicable protocol-registry rights under CC0, while explicitly preserving third-party, trademark, patent, privacy, and data-protection rights and providing the registry without warranty.
• ICANN describes RDAP as the definitive gTLD registration-data source since 28 January 2025 and explains that responses come from registry operators and registrars. Its RDAP lookup FAQ warns that public fields vary, personal data can be redacted, and returned data can be inaccurate or unavailable.
• Most importantly, ICANN's Using Domain Name Registration Data page says RDDS may be used for legal purposes, but not to enable mass unsolicited commercial advertising or solicitation, and not for high-volume automated registry/registrar queries except as needed to manage domains.

This is therefore a low-volume metadata lookup tool, not a lead-list generator, contact harvester, bulk monitoring service, or permission to bypass a registry's notices. A commercial use is not automatically prohibited, but it must be lawful, low-volume, compatible with the specific authoritative service's notices, and unrelated to unsolicited solicitation. The Actor deliberately omits vCard names, email addresses, phone numbers, and postal addresses from generic entities.

Live source verification

Verified on 18 July 2026:

• IANA bootstrap returned HTTP 200, application/json, a 24-hour cache directive, and publication timestamp 2026-07-14T22:00:03Z.
• IANA mapped .com to https://rdap.verisign.com/com/v1/ and .org to https://rdap.publicinterestregistry.org/rdap/.
• Authoritative lookups for example.com and iana.org both returned HTTP 200 with application/rdap+json, registrars, registration/expiration dates, statuses, nameservers, and signed DNSSEC delegation data.

Availability and returned fields can change. Each output includes the bootstrap publication timestamp and exact final RDAP URL for provenance.

Input

{
  "domains": ["example.com", "iana.org", "bücher.de"]
}

domains is required and accepts 1-25 unique names. The Actor:

• normalizes case, a single trailing root dot, and Unicode IDNs to ASCII A-labels;
• rejects URLs, paths, query strings, fragments, credentials, ports, IP addresses, single-label names, invalid labels, control characters, and duplicates after normalization;
• rejects unknown input fields instead of silently ignoring them.

Dataset output

Each successful lookup produces one domain_rdap_record:

{
  "type": "domain_rdap_record",
  "domain": "example.com",
  "unicodeName": "example.com",
  "handle": "2336799_DOMAIN_COM-VRSN",
  "registrar": {
    "name": "RESERVED-Internet Assigned Numbers Authority",
    "handle": "376",
    "ianaId": "376",
    "rdapUrl": null
  },
  "createdAt": "1995-08-14T04:00:00.000Z",
  "updatedAt": "2026-01-16T18:26:50.000Z",
  "expiresAt": "2026-08-13T04:00:00.000Z",
  "status": ["client delete prohibited", "client transfer prohibited"],
  "nameservers": ["elliott.ns.cloudflare.com", "hera.ns.cloudflare.com"],
  "entities": [
    {
      "handle": "376",
      "roles": ["registrar"],
      "publicIds": [{ "type": "IANA Registrar ID", "identifier": "376" }]
    }
  ],
  "secureDNS": {
    "zoneSigned": null,
    "delegationSigned": true,
    "maxSigLife": null,
    "dsData": [{ "keyTag": 2371, "algorithm": 13, "digestType": 2, "digest": "..." }],
    "keyData": []
  },
  "notices": [],
  "bootstrapUrl": "https://data.iana.org/rdap/dns.json",
  "bootstrapPublication": "2026-07-14T22:00:03.000Z",
  "rdapBaseUrl": "https://rdap.verisign.com/com/v1/",
  "rdapUrl": "https://rdap.verisign.com/com/v1/domain/example.com",
  "fetchedAt": "2026-07-18T13:55:47.000Z"
}

Lifecycle dates use only the exact RDAP event actions registration, last changed, and expiration; the server's separate “last update of RDAP database” event is not misreported as a domain update. Missing or redacted values remain null or empty arrays.

Network and abuse boundaries

• The only bootstrap URL is the fixed IANA HTTPS URL. It is fetched once per process and safely cached in memory for at most 24 hours.
• A TLD service must come from that validated bootstrap document and use HTTPS. HTTP-only entries fail with NO_SECURE_RDAP_SERVICE; the Actor never downgrades to plaintext.
• Dynamic service and redirect URLs reject credentials, non-443 ports, fragments, unexpected domain paths, IP literals, and DNS resolutions to loopback, private, link-local, carrier-grade NAT, documentation, multicast, or reserved addresses.
• Redirects are manual, revalidated, and capped at three.
• Global domain concurrency is three. Requests to the same authority are serialized with at least one second between starts.
• Bootstrap responses are capped at 1 MB and 15 seconds. RDAP responses are capped at 2 MB and 20 seconds.
• Each request has at most one retry. HTTP 429 honors Retry-After with a conservative five-second fallback; network, 408, and 5xx failures use bounded backoff. A 404 is not retried.
• Entity traversal, public IDs, DNSSEC arrays, notices, notice text, and error messages are all bounded before storage.

These controls reduce accidental load and SSRF exposure; they do not authorize repeated schedules or bulk extraction. Respect notices returned in every record.

Partial failures

Successful domains are stored even when another domain fails. OUTPUT contains success, partial, or failed, bootstrap provenance, requested/succeeded/failed counts, effective limits, and bounded failures such as:

• UNSUPPORTED_TLD
• NO_SECURE_RDAP_SERVICE
• DOMAIN_NOT_FOUND
• RDAP_LOOKUP_FAILED
• BOOTSTRAP_FAILED

If every lookup fails, the summary is written and the Actor run fails.

Local verification

Node.js 22 or newer is required.

npm ci
npm test
npm run check
npm run live-smoke

The live smoke fetches the current IANA bootstrap and independently verifies .com (example.com) and .org (iana.org) against their authoritative RDAP services.

Guarded FREE release

The default command is a local dry run and never calls Apify:

$npm run release

The exact executing command is:

APIFY_TOKEN='apify_api_...' \
CONFIRM_PUBLISH_FREE_BETA='domain-rdap-lookup-free-beta' \
npm run release:execute

The executing script creates or updates only the private Actor domain-rdap-lookup-free-beta, enforces LIMITED_PERMISSIONS, builds without cache, runs and validates the two-TLD cloud smoke while private, rechecks the exact build and FREE state, and only then makes it public. It refuses to replace an already-public target. Publication verification failures trigger a best-effort, verified rollback to private.

Every outgoing API body is recursively blocked if it contains a pricingInfos key. The script never creates or updates pricing information; any observed non-FREE pricing stops the release.