Bulk Domain Lookup: WHOIS/RDAP, DNS & SSL Checker

Check a domain portfolio in one run. Each row includes registration dates, DNS records, email-policy records, TLS expiry and HTTP status, plus section-level errors. Disable checks you don't need; no account with a data provider is required.

Use this bulk domain lookup for an RDAP lookup, DNS records, SSL certificate expiry, SPF lookup, DMARC lookup or a domain portfolio audit. As a WHOIS alternative and domain expiration checker, it uses RDAP only; it has no port-43 WHOIS fallback and does not validate email deliverability.

$0.001 per delivered domain row, including partial/error diagnostics, plus a start event of $0.00005 per GB (one-GB minimum). No API key or proxy is required.

Quick start

{
  "domains": [
    "example.com",
    "cloudflare.com"
  ],
  "rdap": true,
  "dns": true,
  "tls": true,
  "http": true,
  "availability": false,
  "concurrency": 2,
  "maxChargedResults": 2
}

Two rows cost $0.0022 at a 4 GB start, or $0.00205 at ≤1 GB, before any separately applicable platform usage. Inspect OUTPUT for run errors/counts and each row's errors for section failures.

Illustrative flattened excerpt (actual rows retain nested objects):

{"domain":"example.com","rdap.registrar":"Example Registrar","rdap.expires_at":"2027-01-01T00:00:00Z","tls.days_to_expiry":60,"http.status":200,"errors":{}}

For a DNS-only email-policy inventory:

{
  "domains": [
    "example.com"
  ],
  "rdap": false,
  "tls": false,
  "http": false,
  "availability": false,
  "dns": true,
  "concurrency": 1,
  "maxChargedResults": 1
}

Enter bare domains, without a scheme, path or port. Domains are lowercased, a trailing dot is removed, international names are converted to ASCII/Punycode, and duplicates are skipped. IP addresses and malformed inputs fail validation before upstream work.

Use dns: true with the other sections disabled for email-policy checks. Availability alone still makes an internal RDAP request; set rdap: false to hide the registration section from output.

What you get

• Registration: registrar and IANA ID, created/updated/expiry dates, registry statuses and nameservers through RDAP. The Actor discovers registry endpoints through the IANA DNS RDAP bootstrap. Registrant names, addresses and contact details are omitted.
• DNS: A, AAAA, MX, NS, TXT and CAA records, including TTLs. Raw MX/CAA data is preserved. TXT chunks are joined to parse SPF mechanisms and the all policy. _dmarc TXT records are parsed into tag/value pairs. Queries use Cloudflare DNS JSON with Google DNS as fallback.
• TLS: certificate issuer and subject, validity, whole days to expiry, DNS SANs, negotiated protocol and certificate validation status, directly on port 443 with SNI. Expired/untrusted certificates remain inspectable with authorized: false.
• HTTP: HTTPS GET status, up to 10 redirects, final URL, server header and HSTS header. The response body is canceled, rather than scraped. Redirects may lead to HTTP.
• Availability: registered for RDAP success, likely_available only for registry RDAP 404, and unknown when RDAP cannot establish an answer.

Each section can be disabled. Errors in one section or domain do not prevent the other checks. Dataset rows include an errors object and a success, partial or failed status. DNS record-level errors remain visible even when other record types work.

Inputs

Input	Default	Description
domains	Required	1–100,000 bare domain names
rdap, dns, tls, http, availability	true each	Enable at least one section
concurrency	4	1–20 domains in flight; each domain can make parallel section requests
timeoutSecs	15	1–120 seconds per fetch attempt and TLS connection
maxChargedResults	100000	Delivered rows for the run; 0 performs no upstream work

Registry requests are serialized per registry origin and spaced at least 250 ms apart. HTTP 429/5xx and transient network failures get at most three retries. Exponential backoff starts at 500 ms, honors Retry-After seconds or dates, and is capped at 60 seconds. A registry's retry wait holds that registry's queue; other registries continue.

Output

One dataset item per unique domain checked. Disabled or failed sections are null; errors explain failed sections. Here is an abbreviated example, with full detail objects available in the dataset:

{
  "domain": "example.com",
  "checked_at": "2026-10-15T00:00:00.000Z",
  "status": "success",
  "rdap": {
    "source_url": "https://registry.example/rdap/domain/example.com",
    "http_status": 200,
    "registrar": "Example Registrar",
    "registrar_iana_id": "123",
    "created_at": "2000-01-01T00:00:00Z",
    "updated_at": "2025-01-01T00:00:00Z",
    "expires_at": "2027-01-01T00:00:00Z",
    "status": ["active"],
    "nameservers": ["ns1.example.com"]
  },
  "availability": {
    "guess": "registered",
    "reason": "Registry RDAP returned HTTP 200; not a purchase guarantee"
  },
  "errors": {}
}

The full row also contains:

Object	Fields
dns	records (six record types), dmarc_records, spf, dmarc, response_codes, resolvers, errors
tls	issuer, subject, valid_from, valid_to, days_to_expiry, sans, authorized, authorization_error, protocol
http	status, redirect_chain (each hop's URL/status/location), final_url, server, hsts

Use the Domain overview and All check details dataset views. Export JSON for nested data; CSV/Excel works well for overview fields. The default key-value store's OUTPUT record includes status, attempted, pushed, task errors and stopped_reason. Section errors are in their dataset rows. A budget stop reports limited; a fully completed set with section failures reports partial.

Pricing and limits

The custom domain-checked event costs $0.001 per delivered row, including partial or failed checks with diagnostic results. Every enabled check is included in that price. Duplicate domains, invalid input and rows omitted because of a budget limit incur no custom event. The default Actor start event is charged automatically by Apify; this code does not charge it again.

The Actor checks the charging manager's remaining capacity and the strict dollar budget before every dataset write, then invokes Actor.charge() after the write succeeds. Writes and charges share one serialized gate across all workers. It accounts for prior events, including the Actor start fee, and stops if a write or charge fails. An output write and the platform charge cannot be atomic; a rejected charge can leave one delivered row, then the run fails rather than continuing to emit.

Limits include maxChargedResults, ACTOR_MAX_TOTAL_CHARGE_USD, ACTOR_MAX_CHARGED_RESULTS, ACTOR_MAX_PAID_DATASET_ITEMS and APIFY_MAX_PAID_DATASET_ITEMS, plus the SDK's platform budget. Local runs apply the same configured caps. In-flight checks can finish after a cap is reached, but their rows are not delivered or charged beyond the cap. Event limits do not establish platform-cost allocation. Check the Store pricing and Console for any separately applicable platform usage.

Limitations

• Availability is a hint, not an authoritative registration or purchase decision. Reserved, premium, restricted or unsupported names can return misleading 404s. Confirm with a registrar.
• Names are checked exactly as supplied. A subdomain is not automatically reduced to its registrable parent. Suffixes without an HTTPS endpoint in the IANA bootstrap return RDAP errors; there is no port-43 WHOIS fallback or hosting ASN lookup.
• Registration date availability and event meanings vary by registry. RDAP 404 is a valid check result with empty registration fields.
• DNS results reflect the selected public resolver/cache and are not authoritative propagation checks. NXDOMAIN and no-data are valid responses. SPF and DMARC parsing does not recursively expand includes, evaluate messages or validate policy semantics. DMARC is queried at the supplied domain, without organizational-domain fallback. CAA inheritance is not evaluated.
• TLS checks the supplied host on port 443. DNS SANs are returned; IP, URI and email SANs are omitted. Negative expiry days indicate expiration. HTTP certificate validation stays enabled and can fail independently of TLS inspection.
• HTTP begins with HTTPS and does not automatically retry over HTTP after TLS failure. Geo-routing, target policy and rate limits can affect results. There are no browsers or proxies and no JavaScript rendering.

Local development and publishing

source ~/.nvm/nvm.sh
nvm use 22
npm ci
npm run build
npm test
npm run smoke

Run commands inside this Actor directory (Node 22). npm run smoke builds and runs the real SDK entrypoint with INPUT.json in isolated .smoke-storage, verifies both domains and every enabled section against the dataset schema, and prints a single JSON summary. Failures exit non-zero. Unit tests use representative synthetic fixtures and injected transports, with no network access or credentials.

For a local run, place input at storage/key_value_stores/default/INPUT.json and use npm start after building, or use the Apify CLI. .actor/actor.json points to the Dockerfile, Store README, input schema, output links and dataset schema/views. The multi-stage Dockerfile builds TypeScript and installs production dependencies without a browser image.

Before publishing a paid Actor, configure the event prices from .actor/pay_per_event.json in Apify's pricing configuration. The file is a deployment manifest matching the reference Actor; it does not activate pricing by itself. Disable apify-default-dataset-item charging to prevent duplicate billing. The Actor fails closed if its custom PPE event is missing or a synthetic dataset-item price is active. Production event prices come from the charging manager, while local budget simulation uses the listed price.