Bulk Domain Lookup: DNS, WHOIS, SPF, DMARC & SSL

Bulk domain lookup for any list of domains: DNS records, WHOIS (registrar and expiry date), email provider, SPF, DMARC, DKIM and SSL in one row per domain. Paste 10 or 10,000 domains and get a clean table with an A-F security grade and fixes for $1.50 per 1,000 domains. No API key, no setup.

What you get

• DNS and WHOIS lookup: A, AAAA, MX, NS, TXT and CAA records, registrar, creation date, expiry date, days to expiry and domain age.
• Email provider detection: Google Workspace, Microsoft 365, Zoho, Proton, GoDaddy and 30+ more from MX records, plus the security gateway (Mimecast, Proofpoint, Barracuda, Cisco) when one sits in front.
• Email and web security check: SPF, DMARC, DKIM, DNSSEC, MTA-STS, BIMI, SSL certificate expiry, HTTP security headers and the HTTPS redirect, scored A to F with a fix for every finding.

Sample rows from the prefilled run (Overview view):

Domain	Grade	Email provider	Email gateway	MX	Registrar	Domain expires	SPF	DMARC	SSL days left
apify.com	A	Google Workspace		aspmx.l.google.com	Amazon Registrar, Inc.	2035-06-02	-all	reject	103
github.com	A	Microsoft 365		github-com.mail.protection.outlook.com	MarkMonitor Inc.	2028-10-09	~all	quarantine	55
bbc.co.uk	B	Unknown (behind gateway)	Broadcom (Symantec) Email Security	cluster1.eu.messagelabs.com	British Broadcasting Corporation	2034-12-13	~all	reject	110

Use it for lead enrichment (which companies run Google Workspace or Microsoft 365, which domains expire soon), email deliverability checks (SPF, DKIM and DMARC for Gmail and Yahoo sender rules), SSL certificate expiry monitoring, MSP client audits and vendor risk checks. It runs on the Apify platform with API access, scheduling, webhooks and integrations for Make, Zapier, n8n, Google Sheets and Slack.

Quick start

1. Open the Input tab.
2. Paste domains into Domains, one per line. example.com, https://www.example.com/page and jane@example.com all work.
3. Press Start. The prefilled example (apify.com, github.com, google.com, bbc.co.uk) finishes in a few seconds.
4. Open the Output tab and pick a view: Overview, DNS & WHOIS, Email security, Web and TLS or Findings.
5. Download the results as CSV, Excel, JSON or HTML, or fetch them with the API.

Input example

Only domains is needed. Everything else has a sensible default.

{
    "domains": ["apify.com", "github.com", "google.com", "bbc.co.uk"],
    "includeWhois": true,
    "maxWhoisLookups": 1000,
    "dkimSelectors": ["mandrill"],
    "checks": ["dns", "spf", "dmarc", "dkim", "dnssec", "mtaSts", "bimi", "ssl", "headers", "redirect"],
    "maxConcurrency": 10,
    "timeoutSecs": 10
}

Field	Default	What it does
domains		Domains, URLs or email addresses. Duplicates and a leading www. are removed. IDN names work.
includeWhois	true	Registrar, created, expires, days to expiry and domain age. Free.
maxWhoisLookups	1000	Safety cap per run (1 to 10,000). Domains past the cap are still audited, only without WHOIS data.
dkimSelectors	[]	Extra DKIM selectors. Always checked: google, selector1, selector2, default, k1, s1, mail, dkim.
checks	all	Any of dns, spf, dmarc, dkim, dnssec, mtaSts, bimi, ssl, headers, redirect. Only these affect grade.
maxConcurrency	10	Domains processed in parallel (1 to 50).
timeoutSecs	10	Timeout per TLS, HTTP or WHOIS connection (3 to 60). A whole domain is capped at 45 s.

Output sample

One item per domain. Shortened:

{
    "domain": "github.com",
    "grade": "A",
    "score": 90,
    "summary": { "critical": 0, "high": 0, "medium": 0, "low": 5, "info": 4 },
    "emailProvider": "Microsoft 365",
    "emailGateway": null,
    "emailProviderSource": "mx",
    "mxHosts": ["github-com.mail.protection.outlook.com"],
    "dns": {
        "a": ["140.82.121.3"],
        "mx": [{ "exchange": "github-com.mail.protection.outlook.com", "priority": 0 }],
        "ns": ["dns1.p08.nsone.net", "dns2.p08.nsone.net", "ns-421.awsdns-52.com"],
        "txt": ["MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805"]
    },
    "whois": {
        "domain": "github.com",
        "registrar": "MarkMonitor Inc.",
        "created": "2007-10-09T18:20:50.000Z",
        "expires": "2028-10-09T18:20:50.000Z",
        "daysToExpiry": 735,
        "domainAgeDays": 6935,
        "status": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
        "source": "rdap",
        "server": "rdap.verisign.com",
        "error": null
    },
    "spf": { "found": true, "all": "~all", "dnsLookups": 10, "voidLookups": 0 },
    "dmarc": { "found": true, "policy": "quarantine", "pct": 100, "rua": ["mailto:dmarc@github.com"] },
    "dkim": [
        { "selector": "google", "keyType": "rsa", "keyBits": 2048 },
        { "selector": "selector1", "keyType": "rsa", "keyBits": 1024 }
    ],
    "ssl": {
        "issuer": "Sectigo Limited / Sectigo Public Server Authentication CA DV E36",
        "validTo": "2026-11-29T23:59:59.000Z",
        "daysLeft": 55,
        "protocol": "TLSv1.3",
        "chainOk": true
    },
    "redirect": { "redirectsToHttps": true, "status": 301, "location": "https://github.com/" },
    "findings": [
        {
            "severity": "low",
            "check": "spf",
            "message": "SPF uses 10 of 10 allowed DNS lookups.",
            "recommendation": "Leave headroom. Adding one more provider may break SPF."
        },
        {
            "severity": "low",
            "check": "dmarc",
            "message": "DMARC policy is p=quarantine.",
            "recommendation": "Move to p=reject for full protection."
        }
    ],
    "checkedAt": "2026-10-05T13:05:42.410Z",
    "error": null
}

Data fields

Field	What it contains
grade, score	A to F grade and 0-100 score. See How the grade is calculated.
emailProvider	Mailbox provider from MX. No MX when the domain takes no email, Self-hosted / other when unknown.
emailGateway	Inbound security gateway in front of the mailbox, or null.
emailProviderSource	mx, or spf when the MX shows only a gateway and SPF reveals the mailbox provider.
mxHosts	MX hosts, most preferred first.
dns	A, AAAA, MX, NS, TXT and CAA records. nullMx marks a "0 ." MX.
whois	Registrar, created, updated, expires, daysToExpiry, domainAgeDays, status, source, server, error.
spf	Record, mechanisms, all qualifier, recursive DNS lookup count, void lookups, includes.
dmarc	Record, policy, subdomain policy, pct, rua and ruf. Falls back to the parent domain.
dkim	Keys found per selector with key type, RSA key size, test mode and revoked flag.
dnssec, mtaSts, bimi	DNSSEC status, MTA-STS policy and TLS-RPT, BIMI logo and certificate URLs.
ssl	Issuer, validFrom, validTo, daysLeft, SANs, TLS version, cipher, chain and hostname check.
headers, redirect	HSTS, CSP, X-Frame-Options and other headers. Whether http:// redirects to https://.
findings	severity, check, message and recommendation, worst first.
error, errorCode	Set when the domain could not be checked, for example it has no DNS records. Such rows are free.

Pricing

Pay per event. You pay only for domains that return a result. Platform usage is included.

Apify plan	Price per domain	Per 1,000 domains
Free	$0.0015	$1.50
Bronze	$0.00135	$1.35
Silver	$0.0012	$1.20
Gold and above	$0.00105	$1.05
Start fee	$0.001 per run

WHOIS, DNS, email provider and every check are included in the per-domain price. Invalid names and domains without DNS records are not charged. The prefilled 4-domain example costs under one cent. Set Maximum cost per run in the run options to cap spending. The run stops cleanly at the limit and the status message says how many domains were skipped.

How the grade is calculated

Every domain starts at 100 points. Each finding subtracts points by severity:

Severity	Points	Examples
critical	-30	SPF +all, expired certificate, expired domain registration
high	-15	no SPF, no DMARC, SPF over 10 lookups, certificate for the wrong name, domain expires soon
medium	-7	DMARC p=none or partial quarantine, no DKIM key found, no HSTS, no HTTPS redirect
low	-2	no CAA, no DNSSEC, no MTA-STS, missing CSP or nosniff, DMARC p=quarantine, 1024-bit DKIM
info	0	no BIMI, no Referrer-Policy, SPF ~all while DMARC enforces

Low findings are hygiene items, so they count at most 6 points per check. High and critical findings are never capped.

Score	Grade	Meaning
90+	A	Strong. Only hygiene items left.
80-89	B	Good. One real gap or several hygiene items.
65-79	C	Needs work. Usually a missing SPF, DMARC or HTTPS protection.
50-64	D	Weak. Several real gaps. Any critical finding also caps the grade at D.
< 50	F	Spoofable or broken. Fix the high and critical findings first.

Context rules keep the grade fair:

• A domain without MX, or with a null MX (0 .), is treated as a non-mail domain. Missing DKIM, MTA-STS and BIMI are not penalised. SPF -all and DMARC p=reject are still expected, because spoofing does not need an MX.
• SPF ~all is only info when DMARC is at quarantine or reject with pct=100.
• Certificate expiry warnings scale with the certificate lifetime. A 90-day certificate is flagged below 14 days (high) and 30 days (medium).
• If TLS works but the homepage times out, the site most likely blocks data-center traffic. That is info, not a penalty.

FAQ

How do I look up DNS records and WHOIS for a list of domains?

Paste the list into Domains and press Start. Open the DNS & WHOIS view for A, AAAA, MX, NS, TXT and CAA records next to registrar, creation date and expiry date. Export it as CSV or Excel.

How do I find which email provider a company uses?

Every row has emailProvider, read from the MX records: Google Workspace, Microsoft 365, Zoho Mail, Proton Mail, Fastmail, iCloud, Yahoo, Amazon WorkMail, GoDaddy, IONOS, OVHcloud, Namecheap, Rackspace, Yandex, Mail.ru and more. When a gateway such as Mimecast or Proofpoint hides the mailbox, emailGateway names it and the Actor tries the SPF record for the provider behind it.

How do I check SPF, DKIM and DMARC for many domains at once?

Run the Actor on your list and open the Email security view. Missing or weak records show up as findings with a fix, for example "No DMARC record" with the record to publish.

How do I monitor SSL certificate and domain expiry?

Schedule a daily or weekly run in Apify and add a Slack, email or webhook integration. Filter on ssl.daysLeft < 14 or whois.daysToExpiry < 30.

Which TLDs have WHOIS data?

All TLDs with a registry RDAP service (.com, .net, .org, .uk, .fr, .nl, .app, .dev, .info, .au, .ca, .pl, .no, .fi, .br and many more), plus port-43 WHOIS for TLDs without RDAP (.io, .co, .me, .it, .lt, .ee, .se, .dk, .at, .ru, .us and others). Some registries publish little or nothing: .de shows only the status, .ch and .es show no data. The whois.error field then says why.

Are there WHOIS limits for big lists?

Registries rate limit WHOIS. The Actor throttles each registry server, caches results per run (subdomains share one lookup) and stops WHOIS after maxWhoisLookups (default 1,000). A list of thousands of domains on the same TLD therefore takes longer. For very large lists, raise the cap step by step or set includeWhois to false. DNS and security checks are not limited.

Why does DKIM say "not found" when I sign my mail?

DKIM keys can only be found if you know the selector. Open an email you sent, find s= in its DKIM-Signature header and add it to dkimSelectors.

What happens if my input is invalid?

The run still ends SUCCEEDED and you pay only the start fee. The dataset gets one free help row, and the status message says the same:

{
    "error": true,
    "errorCode": "EMPTY_INPUT",
    "message": "No domains in input.",
    "howToFix": "Add at least one domain to \"domains\", e.g. [\"apify.com\"]. URLs and email addresses work too."
}

INVALID_INPUT means none of the entries is a public domain name. In a list that mixes good and bad entries, the good ones are checked and each bad one gets a free row with errorCode INVALID_DOMAIN or NO_DNS_RECORDS.

Is this legal?

Yes. The Actor reads public DNS and registry data, does one normal TLS handshake and fetches the homepage headers, like any mail server or browser. It does not scan ports, guess passwords or send email.

Known limits

No SMTP connection to MX servers, no port scan and no blacklist lookup. Registrant names are not collected: most registries redact them. The registrable-domain logic is a heuristic, so rare public suffixes may resolve to the wrong parent.

Found a bug or need another field? Open an issue on the Issues tab.

Related Actors

More tools from the same developer, built with the same pricing and output style.

Actor	What it does
Website Content Crawler to Markdown for RAG & LLMs	Crawl whole websites into clean Markdown, RAG chunks and llms.txt
PDF to Markdown & Text Extractor with OCR	PDF, Word, Excel and PowerPoint files to Markdown and text, with OCR
SEO Audit Tool: Site Crawler, Broken Links & Score	Crawl a site and find broken links and on-page SEO issues
PageSpeed Insights & Lighthouse Bulk Checker	Lighthouse scores and Core Web Vitals for many URLs at once
Tech Stack Detector: Wappalyzer & BuiltWith Alternative	Detect the CMS, frameworks, analytics and hosting of any website
Speech to Text: Audio, Video & Podcast Transcriber	Whisper transcripts, SRT and VTT subtitles from audio, video and podcast feeds
Email Validator & Verifier: Bulk MX & Disposable Check	Check email lists for syntax, MX records and disposable domains
Website Contact Scraper: Emails, Phones & Social Links	Find emails, phone numbers and social profiles on company websites
VIES VAT Checker & EU Company Registry Lookup	Validate EU VAT numbers and look up company registry data
Companies House Scraper: UK Company Search & Officers	Search UK companies and get profiles and officers
EU TED Tenders Scraper & Alerts: Public Procurement	EU public tenders and contract awards with daily alerts
Greenhouse, Lever & Ashby Job Scraper: 7 ATS in One Feed	Job postings from 7 applicant tracking systems in one schema
GitHub Scraper: Repo Stats, Stars, Trending & Search	Repository stats, stars, trending repos and search results