# Bulk Domain Lookup: WHOIS/RDAP, DNS & SSL Checker (`rovnaki/domain-intel`) Actor

Check domain registration, DNS, SPF/DMARC, SSL expiry and HTTP status in one JSON row per domain. Bulk portfolio checks with no API key or proxy.

- **URL**: https://apify.com/rovnaki/domain-intel.md
- **Developed by:** [rovnaki](https://apify.com/rovnaki) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk Domain Lookup: WHOIS/RDAP, DNS & SSL Checker

Check a domain portfolio in one run. Each row includes registration dates, DNS records, email-policy records, TLS expiry and HTTP status, plus section-level errors. Disable checks you don't need; no account with a data provider is required.

Use this bulk domain lookup for an RDAP lookup, DNS records, SSL certificate expiry, SPF lookup, DMARC lookup or a domain portfolio audit. As a WHOIS alternative and domain expiration checker, it uses RDAP only; it has no port-43 WHOIS fallback and does not validate email deliverability.

**$0.001 per delivered domain row**, including partial/error diagnostics, plus a start event of $0.00005 per GB (one-GB minimum). No API key or proxy is required.

### Quick start

```json
{
  "domains": [
    "example.com",
    "cloudflare.com"
  ],
  "rdap": true,
  "dns": true,
  "tls": true,
  "http": true,
  "availability": false,
  "concurrency": 2,
  "maxChargedResults": 2
}
```

Two rows cost **$0.0022 at a 4 GB start**, or **$0.00205 at ≤1 GB**, before any separately applicable platform usage. Inspect **`OUTPUT`** for run errors/counts and each row's `errors` for section failures.

Illustrative flattened excerpt (actual rows retain nested objects):

```json
{"domain":"example.com","rdap.registrar":"Example Registrar","rdap.expires_at":"2027-01-01T00:00:00Z","tls.days_to_expiry":60,"http.status":200,"errors":{}}
```

For a DNS-only email-policy inventory:

```json
{
  "domains": [
    "example.com"
  ],
  "rdap": false,
  "tls": false,
  "http": false,
  "availability": false,
  "dns": true,
  "concurrency": 1,
  "maxChargedResults": 1
}
```

Enter bare domains, without a scheme, path or port. Domains are lowercased, a trailing dot is removed, international names are converted to ASCII/Punycode, and duplicates are skipped. IP addresses and malformed inputs fail validation before upstream work.

Use `dns: true` with the other sections disabled for email-policy checks. Availability alone still makes an internal RDAP request; set `rdap: false` to hide the registration section from output.

### What you get

- **Registration:** registrar and IANA ID, created/updated/expiry dates, registry statuses and nameservers through RDAP. The Actor discovers registry endpoints through the [IANA DNS RDAP bootstrap](https://data.iana.org/rdap/dns.json). Registrant names, addresses and contact details are omitted.
- **DNS:** A, AAAA, MX, NS, TXT and CAA records, including TTLs. Raw MX/CAA data is preserved. TXT chunks are joined to parse SPF mechanisms and the `all` policy. `_dmarc` TXT records are parsed into tag/value pairs. Queries use [Cloudflare DNS JSON](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/) with Google DNS as fallback.
- **TLS:** certificate issuer and subject, validity, whole days to expiry, DNS SANs, negotiated protocol and certificate validation status, directly on port 443 with SNI. Expired/untrusted certificates remain inspectable with `authorized: false`.
- **HTTP:** HTTPS GET status, up to 10 redirects, final URL, server header and HSTS header. The response body is canceled, rather than scraped. Redirects may lead to HTTP.
- **Availability:** `registered` for RDAP success, `likely_available` only for registry RDAP 404, and `unknown` when RDAP cannot establish an answer.

Each section can be disabled. Errors in one section or domain do not prevent the other checks. Dataset rows include an `errors` object and a `success`, `partial` or `failed` status. DNS record-level errors remain visible even when other record types work.

### Inputs

| Input | Default | Description |
|---|---|---|
| `domains` | Required | 1–100,000 bare domain names |
| `rdap`, `dns`, `tls`, `http`, `availability` | `true` each | Enable at least one section |
| `concurrency` | `4` | 1–20 domains in flight; each domain can make parallel section requests |
| `timeoutSecs` | `15` | 1–120 seconds per fetch attempt and TLS connection |
| `maxChargedResults` | `100000` | Delivered rows for the run; `0` performs no upstream work |

Registry requests are serialized per registry origin and spaced at least 250 ms apart. HTTP 429/5xx and transient network failures get at most three retries. Exponential backoff starts at 500 ms, honors `Retry-After` seconds or dates, and is capped at 60 seconds. A registry's retry wait holds that registry's queue; other registries continue.

### Output

One dataset item per unique domain checked. Disabled or failed sections are `null`; errors explain failed sections. Here is an abbreviated example, with full detail objects available in the dataset:

```json
{
  "domain": "example.com",
  "checked_at": "2026-10-15T00:00:00.000Z",
  "status": "success",
  "rdap": {
    "source_url": "https://registry.example/rdap/domain/example.com",
    "http_status": 200,
    "registrar": "Example Registrar",
    "registrar_iana_id": "123",
    "created_at": "2000-01-01T00:00:00Z",
    "updated_at": "2025-01-01T00:00:00Z",
    "expires_at": "2027-01-01T00:00:00Z",
    "status": ["active"],
    "nameservers": ["ns1.example.com"]
  },
  "availability": {
    "guess": "registered",
    "reason": "Registry RDAP returned HTTP 200; not a purchase guarantee"
  },
  "errors": {}
}
```

The full row also contains:

| Object | Fields |
|---|---|
| `dns` | `records` (six record types), `dmarc_records`, `spf`, `dmarc`, `response_codes`, `resolvers`, `errors` |
| `tls` | `issuer`, `subject`, `valid_from`, `valid_to`, `days_to_expiry`, `sans`, `authorized`, `authorization_error`, `protocol` |
| `http` | `status`, `redirect_chain` (each hop's URL/status/location), `final_url`, `server`, `hsts` |

Use the **Domain overview** and **All check details** dataset views. Export JSON for nested data; CSV/Excel works well for overview fields. The default key-value store's `OUTPUT` record includes `status`, `attempted`, `pushed`, task errors and `stopped_reason`. Section errors are in their dataset rows. A budget stop reports `limited`; a fully completed set with section failures reports `partial`.

### Pricing and limits

The custom `domain-checked` event costs **$0.001 per delivered row**, including partial or failed checks with diagnostic results. Every enabled check is included in that price. Duplicate domains, invalid input and rows omitted because of a budget limit incur no custom event. The default Actor start event is charged automatically by Apify; this code does not charge it again.

The Actor checks the charging manager's remaining capacity and the strict dollar budget before every dataset write, then invokes `Actor.charge()` after the write succeeds. Writes and charges share one serialized gate across all workers. It accounts for prior events, including the Actor start fee, and stops if a write or charge fails. An output write and the platform charge cannot be atomic; a rejected charge can leave one delivered row, then the run fails rather than continuing to emit.

Limits include `maxChargedResults`, `ACTOR_MAX_TOTAL_CHARGE_USD`, `ACTOR_MAX_CHARGED_RESULTS`, `ACTOR_MAX_PAID_DATASET_ITEMS` and `APIFY_MAX_PAID_DATASET_ITEMS`, plus the SDK's platform budget. Local runs apply the same configured caps. In-flight checks can finish after a cap is reached, but their rows are not delivered or charged beyond the cap. Event limits do not establish platform-cost allocation. Check the Store pricing and Console for any separately applicable platform usage.

### Limitations

- Availability is a hint, not an authoritative registration or purchase decision. Reserved, premium, restricted or unsupported names can return misleading 404s. Confirm with a registrar.
- Names are checked exactly as supplied. A subdomain is not automatically reduced to its registrable parent. Suffixes without an HTTPS endpoint in the IANA bootstrap return RDAP errors; there is no port-43 WHOIS fallback or hosting ASN lookup.
- Registration date availability and event meanings vary by registry. RDAP 404 is a valid check result with empty registration fields.
- DNS results reflect the selected public resolver/cache and are not authoritative propagation checks. NXDOMAIN and no-data are valid responses. SPF and DMARC parsing does not recursively expand includes, evaluate messages or validate policy semantics. DMARC is queried at the supplied domain, without organizational-domain fallback. CAA inheritance is not evaluated.
- TLS checks the supplied host on port 443. DNS SANs are returned; IP, URI and email SANs are omitted. Negative expiry days indicate expiration. HTTP certificate validation stays enabled and can fail independently of TLS inspection.
- HTTP begins with HTTPS and does not automatically retry over HTTP after TLS failure. Geo-routing, target policy and rate limits can affect results. There are no browsers or proxies and no JavaScript rendering.

### Local development and publishing

```bash
source ~/.nvm/nvm.sh
nvm use 22
npm ci
npm run build
npm test
npm run smoke
```

Run commands inside this Actor directory (Node 22). `npm run smoke` builds and runs the real SDK entrypoint with `INPUT.json` in isolated `.smoke-storage`, verifies both domains and every enabled section against the dataset schema, and prints a single JSON summary. Failures exit non-zero. Unit tests use representative synthetic fixtures and injected transports, with no network access or credentials.

For a local run, place input at `storage/key_value_stores/default/INPUT.json` and use `npm start` after building, or use the Apify CLI. `.actor/actor.json` points to the Dockerfile, Store README, input schema, output links and dataset schema/views. The multi-stage Dockerfile builds TypeScript and installs production dependencies without a browser image.

Before publishing a paid Actor, configure the event prices from `.actor/pay_per_event.json` in Apify's pricing configuration. The file is a deployment manifest matching the reference Actor; it does not activate pricing by itself. Disable `apify-default-dataset-item` charging to prevent duplicate billing. The Actor fails closed if its custom PPE event is missing or a synthetic dataset-item price is active. Production event prices come from the charging manager, while local budget simulation uses the listed price.

# Actor input Schema

## `domains` (type: `array`):

Bare domains, including IDNs; duplicates are normalized and removed. Registration checks use the supplied name, without guessing a registrable parent.

## `rdap` (type: `boolean`):

Registrar, dates, statuses and nameservers. Omits registrant personal data.

## `dns` (type: `boolean`):

A, AAAA, MX, NS, TXT, CAA plus parsed SPF and \_dmarc TXT.

## `tls` (type: `boolean`):

Port 443 certificate issuer, validity, SANs and validation status.

## `http` (type: `boolean`):

HTTPS GET status, redirects, final URL, server and HSTS.

## `availability` (type: `boolean`):

RDAP 404 means likely available, never guaranteed. Requires an internal RDAP lookup even if registration output is disabled.

## `concurrency` (type: `integer`):

Concurrent domains. Dataset writes and charges are serialized.

## `maxChargedResults` (type: `integer`):

Run-wide delivered row cap. Zero performs no upstream work. Also respects platform dollar and result limits.

## `timeoutSecs` (type: `integer`):

Per fetch attempt and TLS connection timeout. Retries may take longer overall.

## Actor input object example

```json
{
  "domains": [
    "example.com",
    "cloudflare.com"
  ],
  "rdap": true,
  "dns": true,
  "tls": true,
  "http": true,
  "availability": true,
  "concurrency": 2,
  "maxChargedResults": 2,
  "timeoutSecs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

Normalized results; export as JSON, CSV or Excel.

## `summary` (type: `string`):

Counts, errors, source expansion and budget stop reasons.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com",
        "cloudflare.com"
    ],
    "rdap": true,
    "dns": true,
    "tls": true,
    "http": true,
    "availability": false,
    "concurrency": 2,
    "maxChargedResults": 2
};

// Run the Actor and wait for it to finish
const run = await client.actor("rovnaki/domain-intel").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "example.com",
        "cloudflare.com",
    ],
    "rdap": True,
    "dns": True,
    "tls": True,
    "http": True,
    "availability": False,
    "concurrency": 2,
    "maxChargedResults": 2,
}

# Run the Actor and wait for it to finish
run = client.actor("rovnaki/domain-intel").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com",
    "cloudflare.com"
  ],
  "rdap": true,
  "dns": true,
  "tls": true,
  "http": true,
  "availability": false,
  "concurrency": 2,
  "maxChargedResults": 2
}' |
apify call rovnaki/domain-intel --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rovnaki/domain-intel"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/bB05kbrsU8gKcHLJc/builds/ngusqcBgJDkwVyEfP/openapi.json