Domain Checker – RDAP Expiry, DNS & SSL, No WHOIS Contacts

Check whether a domain is registered, when it expires, who the registrar is, and how its DNS and SSL are set up - straight from the official RDAP registries, DNS-over-HTTPS, and a direct TLS handshake. Built for scripts, dashboards, portfolio monitors and AI agents that need a clean, typed answer, not a scraped WHOIS text blob.

No WHOIS contact data, ever. Only the registrar - a company - comes out of this Actor.

What you get

• Registration status and expiry - is_registered, expires_at, days_until_expiry (negative once a domain has lapsed), created_at, updated_at, EPP statuses, and which registry RDAP server actually answered (rdap_server).
• Registrar, nameservers, DNSSEC - the registrar company name and IANA Registrar ID, the domain's nameservers, and whether DNSSEC is signed.
• DNS and mail posture - A/MX/NS/TXT records over Cloudflare DNS-over-HTTPS, the mail provider inferred from MX hostnames (Google Workspace, Microsoft 365, Proofpoint, ...), and whether SPF and DMARC are present. Optionally, live TLS certificate issuer and expiry.

Why RDAP instead of WHOIS

RDAP is the IETF's structured, machine-readable replacement for WHOIS, served directly by the registries (rdap.org resolves and redirects to the authoritative server for each TLD). WHOIS scrapers parse inconsistent free text and, along the way, usually pick up registrant/admin/tech contact details. This Actor never fetches or forwards those fields: the fetch layer's registrar extractor only ever reads the entity whose role is "registrar", and only ever takes its company name and IANA ID from that entity - never a registrant, admin or tech contact, never an email or phone number of a named individual, and never the registrar's own nested abuse-contact sub-entity. That is deliberate: privacy by design, and the reason this tool is cheaper and cleaner to build a product on top of than a service that resells WHOIS contacts.

Example output row

One real row from a default run (github.com, 2026-09-23; the TXT array is trimmed here for readability - the real dataset row has all of them):

{
  "domain": "github.com",
  "tld": "com",
  "is_registered": true,
  "registrar_name": "MarkMonitor Inc.",
  "registrar_iana_id": "292",
  "statuses": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
  "created_at": "2007-10-09T18:20:50Z",
  "updated_at": "2026-09-07T09:22:52Z",
  "expires_at": "2028-10-09T18:20:50Z",
  "days_until_expiry": 747,
  "nameservers": [
    "DNS1.P08.NSONE.NET", "DNS2.P08.NSONE.NET", "DNS3.P08.NSONE.NET", "DNS4.P08.NSONE.NET",
    "NS-1283.AWSDNS-32.ORG", "NS-1707.AWSDNS-21.CO.UK", "NS-421.AWSDNS-52.COM", "NS-520.AWSDNS-01.NET"
  ],
  "dnssec": false,
  "rdap_server": "rdap.verisign.com",
  "dns": {
    "A": ["140.82.121.4"],
    "MX": ["0 github-com.mail.protection.outlook.com."],
    "NS": ["dns1.p08.nsone.net.", "dns2.p08.nsone.net.", "..."],
    "TXT": ["\"google-site-verification=...\"", "\"v=spf1 ip4:192.30.252.0/22 ... ~all\"", "..."]
  },
  "mail_provider": "Microsoft 365",
  "spf_present": true,
  "dmarc_present": true,
  "checked_at": "2026-09-23T11:35:20+00:00"
}

An unregistered domain gives a clean, non-error row instead of a crash or a false positive:

{
  "domain": "zzz-not-a-real-domain-98765.com",
  "tld": "com",
  "is_registered": false,
  "registrar_name": null,
  "rdap_server": "rdap.verisign.com",
  "...": "every other RDAP field is null/empty, no `error` field"
}

is_registered: false is a normal, common answer, not an error - it means the registry itself said the domain does not exist. If instead an RDAP server is unreachable or times out, you get a genuinely different row: {"domain": ..., "error": "network", "errorMessage": "..."}. The two are never conflated, so a downstream buyer can trust is_registered: false as ground truth.

Three answers, never two

Some top-level domains publish no RDAP service at all - .mil and a handful of others. For those, nobody can tell you whether a domain is registered, so this Actor says exactly that instead of guessing. .io, .sh and .ac are a special case: IANA's RDAP list leaves them out, so most tools report them as unknown or, worse, as free - but their registry does answer RDAP, and this Actor asks it directly, so you get the real registrar, expiry date and nameservers. Every row carries one of three answers:

rdap_status	is_registered	What it means
registered	true	The registry returned the domain record
not_registered	false	The registry said the domain does not exist
no_rdap_service	null	The TLD publishes no RDAP service, so registration is unknown

DNS records, mail provider, SPF, DMARC and the TLS certificate are still returned in the no_rdap_service case, because those come from other sources and are just as real.

This matters more than it sounds: a tool that trusts the IANA list either says every .io domain is unknown or tells you a live, paid-for .io domain is free. Check any .io domain here and compare.

You can download the dataset in various formats such as JSON, CSV, or Excel from the Apify Console, or pull it through the API/integrations.

Input

• Domains (domains) - bare domains or full URLs (github.com, https://github.com/x); the scheme, path, query and port are stripped automatically. Default: github.com, apify.com, example.org.
• Max domains (maxDomains) - cap on rows checked, 1-1000. Default 100.
• Include DNS lookups (includeDns) - resolve the record types below plus a dedicated _dmarc.<domain> TXT lookup, and infer mail_provider/spf_present/dmarc_present. Free, part of the domain event. Default on.
• DNS record types (dnsTypes) - which record types to resolve. Default A, MX, NS, TXT.
• Include TLS certificate check (includeTls) - open a TLS connection to port 443 and read the certificate's issuer and expiry. One extra tls-check event per successful check. Default off.

The default input runs with zero edits and returns three real, valuable rows.

Pricing

Pay-per-event:

• Actor start - $0.001, once per run.
• Domain - $0.0025 per domain row (registration, expiry, registrar, DNS, mail posture).
• TLS check - $0.001, only when includeTls is on and a certificate was actually read.

$2.50 per 1,000 domains checked - no charge for domains that turn out to be unregistered failing silently, and no charge for a WHOIS-contacts add-on you didn't ask for, because there isn't one.

Reliability and rate limits

Requests stay under ~5/second overall. 429s and 5xx/network errors retry with exponential backoff (429 honours Retry-After); 401/403 and other unexpected responses are reported once, not retried. Every failure is counted by category (network, rate_limit, blocked, other) in the run's STATS key-value record, separately from not_found/unregistered-domain counts, so you can tell input problems (typo'd domains) apart from source outages at a glance.