# Domain Checker – RDAP Expiry, DNS & SSL, No WHOIS Contacts (`rowfeed/domain-rdap-checker`) Actor

Official RDAP domain lookups: registrar, expiry, statuses, nameservers, DNSSEC, plus optional DNS (A/MX/NS/TXT) and TLS cert expiry. Registrar entity only - never WHOIS contact data.

- **URL**: https://apify.com/rowfeed/domain-rdap-checker.md
- **Developed by:** [Rowfeed](https://apify.com/rowfeed) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.50 / 1,000 domains

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

Check whether a domain is registered, when it expires, who the registrar is, and how its DNS and
SSL are set up - straight from the official RDAP registries, DNS-over-HTTPS, and a direct TLS
handshake. Built for scripts, dashboards, portfolio monitors and AI agents that need a clean,
typed answer, not a scraped WHOIS text blob.

**No WHOIS contact data, ever.** Only the registrar - a company - comes out of this Actor.

### What you get

- **Registration status and expiry** - `is_registered`, `expires_at`, `days_until_expiry` (negative
  once a domain has lapsed), `created_at`, `updated_at`, EPP `statuses`, and which registry RDAP
  server actually answered (`rdap_server`).
- **Registrar, nameservers, DNSSEC** - the registrar company name and IANA Registrar ID, the
  domain's nameservers, and whether DNSSEC is signed.
- **DNS and mail posture** - A/MX/NS/TXT records over Cloudflare DNS-over-HTTPS, the mail provider
  inferred from MX hostnames (Google Workspace, Microsoft 365, Proofpoint, ...), and whether SPF
  and DMARC are present. Optionally, live TLS certificate issuer and expiry.

### Why RDAP instead of WHOIS

RDAP is the IETF's structured, machine-readable replacement for WHOIS, served directly by the
registries (`rdap.org` resolves and redirects to the authoritative server for each TLD). WHOIS
scrapers parse inconsistent free text and, along the way, usually pick up registrant/admin/tech
contact details. This Actor never fetches or forwards those fields: the fetch layer's registrar
extractor only ever reads the entity whose role is `"registrar"`, and only ever takes its company
name and IANA ID from that entity - never a registrant, admin or tech contact, never an email or
phone number of a named individual, and never the registrar's own nested abuse-contact sub-entity.
That is deliberate: privacy by design, and the reason this tool is cheaper and cleaner to build a
product on top of than a service that resells WHOIS contacts.

### Example output row

One real row from a default run (`github.com`, 2026-09-23; the `TXT` array is trimmed here for
readability - the real dataset row has all of them):

```json
{
  "domain": "github.com",
  "tld": "com",
  "is_registered": true,
  "registrar_name": "MarkMonitor Inc.",
  "registrar_iana_id": "292",
  "statuses": ["client delete prohibited", "client transfer prohibited", "client update prohibited"],
  "created_at": "2007-10-09T18:20:50Z",
  "updated_at": "2026-09-07T09:22:52Z",
  "expires_at": "2028-10-09T18:20:50Z",
  "days_until_expiry": 747,
  "nameservers": [
    "DNS1.P08.NSONE.NET", "DNS2.P08.NSONE.NET", "DNS3.P08.NSONE.NET", "DNS4.P08.NSONE.NET",
    "NS-1283.AWSDNS-32.ORG", "NS-1707.AWSDNS-21.CO.UK", "NS-421.AWSDNS-52.COM", "NS-520.AWSDNS-01.NET"
  ],
  "dnssec": false,
  "rdap_server": "rdap.verisign.com",
  "dns": {
    "A": ["140.82.121.4"],
    "MX": ["0 github-com.mail.protection.outlook.com."],
    "NS": ["dns1.p08.nsone.net.", "dns2.p08.nsone.net.", "..."],
    "TXT": ["\"google-site-verification=...\"", "\"v=spf1 ip4:192.30.252.0/22 ... ~all\"", "..."]
  },
  "mail_provider": "Microsoft 365",
  "spf_present": true,
  "dmarc_present": true,
  "checked_at": "2026-09-23T11:35:20+00:00"
}
```

An unregistered domain gives a clean, non-error row instead of a crash or a false positive:

```json
{
  "domain": "zzz-not-a-real-domain-98765.com",
  "tld": "com",
  "is_registered": false,
  "registrar_name": null,
  "rdap_server": "rdap.verisign.com",
  "...": "every other RDAP field is null/empty, no `error` field"
}
```

`is_registered: false` is a normal, common answer, not an error - it means the registry itself
said the domain does not exist. If instead an RDAP server is unreachable or times out, you get a
genuinely different row: `{"domain": ..., "error": "network", "errorMessage": "..."}`. The two are
never conflated, so a downstream buyer can trust `is_registered: false` as ground truth.

#### Three answers, never two

Some top-level domains publish no RDAP service at all - `.mil` and a handful of others. For those,
nobody can tell you whether a domain is registered, so this Actor says exactly that instead of
guessing. `.io`, `.sh` and `.ac` are a special case: IANA's RDAP list leaves them out, so most tools
report them as unknown or, worse, as free - but their registry does answer RDAP, and this Actor asks
it directly, so you get the real registrar, expiry date and nameservers. Every row carries one of
three answers:

| `rdap_status` | `is_registered` | What it means |
|---|---|---|
| `registered` | `true` | The registry returned the domain record |
| `not_registered` | `false` | The registry said the domain does not exist |
| `no_rdap_service` | `null` | The TLD publishes no RDAP service, so registration is unknown |

DNS records, mail provider, SPF, DMARC and the TLS certificate are still returned in the
`no_rdap_service` case, because those come from other sources and are just as real.

This matters more than it sounds: a tool that trusts the IANA list either says every `.io` domain is
unknown or tells you a live, paid-for `.io` domain is free. Check any `.io` domain here and compare.

You can download the dataset in various formats such as JSON, CSV, or Excel from the Apify
Console, or pull it through the API/integrations.

### Input

- **Domains** (`domains`) - bare domains or full URLs (`github.com`, `https://github.com/x`); the
  scheme, path, query and port are stripped automatically. Default: `github.com`, `apify.com`,
  `example.org`.
- **Max domains** (`maxDomains`) - cap on rows checked, 1-1000. Default 100.
- **Include DNS lookups** (`includeDns`) - resolve the record types below plus a dedicated
  `_dmarc.<domain>` TXT lookup, and infer `mail_provider`/`spf_present`/`dmarc_present`. Free, part
  of the `domain` event. Default on.
- **DNS record types** (`dnsTypes`) - which record types to resolve. Default `A`, `MX`, `NS`, `TXT`.
- **Include TLS certificate check** (`includeTls`) - open a TLS connection to port 443 and read the
  certificate's issuer and expiry. One extra `tls-check` event per successful check. Default off.

The default input runs with zero edits and returns three real, valuable rows.

### Pricing

Pay-per-event:

- **Actor start** - $0.001, once per run.
- **Domain** - $0.0025 per domain row (registration, expiry, registrar, DNS, mail posture).
- **TLS check** - $0.001, only when `includeTls` is on and a certificate was actually read.

$2.50 per 1,000 domains checked - no charge for domains that turn out to be unregistered failing
silently, and no charge for a WHOIS-contacts add-on you didn't ask for, because there isn't one.

### Reliability and rate limits

Requests stay under ~5/second overall. 429s and 5xx/network errors retry with exponential backoff
(429 honours `Retry-After`); 401/403 and other unexpected responses are reported once, not retried.
Every failure is counted by category (`network`, `rate_limit`, `blocked`, `other`) in the run's
`STATS` key-value record, separately from `not_found`/unregistered-domain counts, so you can tell
input problems (typo'd domains) apart from source outages at a glance.

# Actor input Schema

## `domains` (type: `array`):

Bare domains or full URLs to check, e.g. "github.com" or "https://github.com/some/path". Scheme, path, query and port are stripped automatically.

## `maxDomains` (type: `integer`):

Maximum number of domain rows to check in this run. Each row is one `domain` event ($2.50 per 1,000).

## `includeDns` (type: `boolean`):

Look up the record types in "DNS record types" over Cloudflare DNS-over-HTTPS, plus a dedicated \_dmarc TXT lookup, and infer mail\_provider/spf\_present/dmarc\_present. Free - part of the domain event, no extra charge.

## `dnsTypes` (type: `array`):

DNS record types to resolve for each domain when "Include DNS lookups" is on.

## `includeTls` (type: `boolean`):

Open a TLS connection to port 443 of each registered domain and read the certificate's expiry date and issuer. Adds one connection per domain and one `tls-check` event ($0.001) per successful check.

## Actor input object example

```json
{
  "domains": [
    "github.com"
  ],
  "maxDomains": 100,
  "includeDns": true,
  "dnsTypes": [
    "A",
    "MX",
    "NS",
    "TXT"
  ],
  "includeTls": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("rowfeed/domain-rdap-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("rowfeed/domain-rdap-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call rowfeed/domain-rdap-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rowfeed/domain-rdap-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/XXOc9q2hgzya03Qs1/builds/ztHeWV35bwHhF5CS8/openapi.json