Bulk Domain Lookup: RDAP, DNS, SPF, DMARC & DKIM

Paste a list of domains and get one row per domain with:

• Registration data from RDAP, the official successor to WHOIS. You get the registrar (name, IANA ID), creation, last-changed, expiry and last-transfer dates, domain age, days until expiry, EPP status codes, the registry's nameservers and DNSSEC. Each domain goes to its registry's own RDAP server, which the Actor finds through the IANA RDAP bootstrap file.
• DNS records: A, AAAA, MX, NS and TXT, plus the DNS host inferred from NS (Cloudflare, Route 53 and so on) and SaaS verification records in TXT (Google, Microsoft 365, Atlassian, OpenAI and more).
• Email security: the SPF record, policy and allowed senders, the DMARC record, policy, pct and report domains, and DKIM selectors found by probing common selectors (google, selector1, selector2, k1, k2, default, s1, s2, mail, dkim and 6 more). You also get MTA-STS, TLS-RPT, BIMI and an A–F email-security grade.
• Mail provider: Google Workspace, Microsoft 365, Zoho, Proton and others, read from MX. When MX points at a security gateway such as Proofpoint or Mimecast, the provider behind the gateway is read from SPF instead.

No personal data. RDAP sometimes returns registrant, admin, technical or abuse contacts. They are always removed: the output only lists which contact roles were removed (redactedContactRoles), never a name, email, phone or address. Email addresses inside TXT and DMARC records are masked (rua=mailto:***@acme.com), so only the domain is kept.

By signalscouter. It uses only public RDAP and public DNS: no WHOIS port-43 scraping, no website scraping, no proxies and no API key.

Who it's for

• Domain portfolio and brand teams: expiry dates, registrar locks and nameserver changes across hundreds of domains.
• Security and deliverability teams: find domains with missing or weak SPF, DMARC or DKIM.
• Sales and RevOps: enrich a lead list with each company's mail provider (Google Workspace or Microsoft 365) and domain age.
• Fraud and risk teams: flag young domains or domains with no mail setup.

Input

{
  "domains": ["stripe.com", "https://www.github.com/about", "jane@example.org"],
  "includeRdap": true,
  "includeEmailSecurity": true,
  "includeTxtRecords": true,
  "onlyNew": false
}

Field	Default	What it does
domains		Domains, URLs or email addresses, one per line (commas also work). Each is reduced to its registrable domain using the Public Suffix List, so https://www.shop.example.co.uk/x becomes example.co.uk. Duplicates are merged into one row and one charge, and inputs lists every original string.
includeRdap	true	Registration data from RDAP.
includeEmailSecurity	true	SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI and the grade.
includeTxtRecords	true	Outputs the raw apex TXT records. SaaS verifications are detected either way.
keepSubdomains	false	When on, mail.acme.com is checked in DNS as entered. RDAP still uses acme.com, and DMARC falls back to acme.com's policy (dmarcInheritedFrom).
maxResults	0 (no limit)	Stops after this many charged domain rows.
onlyNew + monitorId	false	Monitoring mode, described below.
maxConcurrency	10	Number of domains looked up in parallel.
rdapRequestsPerSecond	1 (max 2)	Politeness limit per registry RDAP server.

Output

Here is a real row from a test run (20 Oct 2026), with the TXT list shortened:

{
  "recordType": "domain",
  "domain": "stripe.com",
  "registered": true,
  "rdapStatus": "ok",
  "rdapServer": "rdap.verisign.com",
  "registrar": "SafeNames Ltd.",
  "registrarIanaId": "447",
  "createdAt": "1995-09-12T04:00:00+00:00",
  "updatedAt": "2025-10-01T01:39:51+00:00",
  "expiresAt": "2027-09-11T04:00:00+00:00",
  "domainAgeYears": 31.1,
  "daysUntilExpiry": 325,
  "domainStatus": ["client delete prohibited", "client transfer prohibited", "client update prohibited", "server delete prohibited", "server transfer prohibited", "server update prohibited"],
  "rdapNameservers": ["ns-1087.awsdns-07.org", "ns-1882.awsdns-43.co.uk", "ns-423.awsdns-52.com", "ns-705.awsdns-24.net"],
  "dnssec": false,
  "contactsRedacted": true,
  "redactedContactRoles": ["abuse"],
  "aRecords": ["198.137.150.231", "198.202.176.231"],
  "mxRecords": [{"host": "aspmx.l.google.com", "priority": 10}, {"host": "alt1.aspmx.l.google.com", "priority": 20}],
  "nsRecords": ["ns-1087.awsdns-07.org", "ns-1882.awsdns-43.co.uk", "ns-423.awsdns-52.com", "ns-705.awsdns-24.net"],
  "dnsProvider": "Amazon Route 53",
  "txtRecords": ["MS=ms80697640", "…"],
  "txtVerifications": ["Microsoft 365", "Atlassian", "OpenAI", "Stripe", "…"],
  "mailProvider": "Google Workspace",
  "mailProviderSource": "MX",
  "spfRecord": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
  "spfPolicy": "softfail (~all)",
  "spfServices": ["Stripe", "Qualtrics"],
  "dmarcRecord": "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:***@stripe.com; ruf=mailto:***@stripe.com;",
  "dmarcPolicy": "reject",
  "dkimSelectors": ["google", "s1", "s2", "mandrill"],
  "dkimProviders": ["Google Workspace", "Mailchimp Transactional (Mandrill)", "SendGrid"],
  "mtaSts": false,
  "emailSecurityGrade": "A",
  "partial": false,
  "warnings": [],
  "checkedAt": "2026-10-20T13:01:35.326564+00:00"
}

Every domain row has the same columns (null where a value wasn't looked up), so CSV and Excel exports line up. The dataset has five views: Overview, Registration (RDAP), DNS records, Email security and Errors. RUN_SUMMARY in the key-value store holds the totals, error codes, DNS query count and RDAP request count.

Grade: A means strict SPF (-all or ~all), DMARC quarantine or reject at 100 %, and DKIM found. B means DMARC is enforced but either SPF is weak or no DKIM was found on the probed selectors. C means SPF and DMARC are both present but DMARC is not enforced. D means only one of SPF or DMARC is present. F means neither.

Good to know (limits)

• RDAP coverage: RDAP covers all gTLDs (.com, .net, .org, .app, .dev and so on) and the ccTLDs whose registry publishes an RDAP server in the IANA bootstrap. Some ccTLDs have no RDAP server there, including .de, .io, .me and .so at the time of writing. For those, rdapStatus is unsupported_tld, and the row still has all DNS and email data. We don't fall back to WHOIS scraping.
• robots.txt is obeyed on RDAP servers too. If a registry's robots.txt can't be fetched, the RFC treats that as "disallow", so the lookup returns rdapStatus: "robots_disallowed". In our tests this happened with Nominet (.uk).
• DKIM can't be listed. Selectors are found by probing common names. A domain can sign with a selector we didn't try. If a zone answers every selector (a wildcard), dkimWildcard is true and no selectors are reported.
• Politeness: each RDAP server gets at most rdapRequestsPerSecond requests (default 1 per second). The Actor slows down after an HTTP 429. It leaves a server alone for the rest of the run if the server asks for a pause longer than 60 s, and after 5 failures in a row. In practice, about 1,000 .com domains take roughly 17 minutes, because they all go to Verisign's server. DNS goes through DNS-over-HTTPS (Cloudflare, with Google as the fallback).
• Partial rows: if RDAP fails but DNS works (or the other way round), you still get the row with partial: true and the reason in warnings.

Monitoring: only new or changed domains

Set onlyNew: true and a monitorId, then schedule the Actor. A domain is output (and charged) only when:

• it has never been delivered for that monitor (changeStatus: "new"), or
• its registrar, expiry, status, registry nameservers, MX, NS, TXT, SPF, DMARC, DKIM selectors or mail provider changed (changeStatus: "changed").

Unchanged domains are skipped and not charged. A and AAAA changes are ignored, because CDNs rotate IP addresses on every lookup.

State is kept in your named key-value store signalscouter-bulk-domain-lookup-state. It is saved on Apify's PERSIST_STATE, MIGRATING and ABORTING events, every 30 s, after each delivered domain in the last 90 s before the run's timeout, and at the end. That way a timed-out or aborted run doesn't re-deliver or re-charge. In a platform test, a run killed by a 20 s timeout and its rerun delivered 18 + 32 = 50 domains with 0 overlap. Domains cut off by maxResults or your charge limit aren't remembered, so they come back next time. Entries are kept for 180 days.

Pricing

Pay per event: you pay per domain result row. You don't pay for:

• error rows (invalid input, unregistered or non-existent domains, failed lookups)
• duplicates
• unchanged domains in monitoring mode

The run stops when your maximum total charge is reached and never goes over it.

Error code	Meaning (free)
INVALID_INPUT	Not a domain, URL or email address
DOMAIN_NOT_REGISTERED	RDAP returns 404 and DNS returns NXDOMAIN
DOMAIN_NOT_FOUND	DNS returns NXDOMAIN and the TLD has no RDAP server
LOOKUP_FAILED	DNS and RDAP both failed. Try again later. After 25 failures in a row, the run stops early instead of continuing.

How this differs from our Company Tech Stack Actor

Company Tech Stack & Domain Signals visits each company's website to detect its technologies and hiring platform, and adds a summary of DNS, email and RDAP data. Bulk Domain Lookup doesn't fetch websites at all. It is a faster, cheaper domain-records tool, with raw A, AAAA, MX, NS and TXT records, full SPF and DMARC records, and registrar, expiry and status monitoring. Use it for domain portfolios and email-security audits. Use the tech-stack Actor for sales prospecting.

More signalscouter Actors

Actor	What it gives you
Career Site Jobs Scraper	Jobs from 12 ATSes (Greenhouse, Lever, Ashby, Workday, Workable and more) in one schema, from company domains
Workday Jobs Scraper	Jobs from any myworkdayjobs.com career site, including sites with more than 2,000 jobs
Greenhouse Jobs Scraper	Greenhouse boards with departments, offices, custom fields and pay ranges
Ashby & Lever Jobs Scraper	Startup jobs with structured compensation from Ashby and Lever
UK Public Sector Jobs Scraper	NHS Jobs, Teaching Vacancies and DWP Find a Job
Company Tech Stack & Domain Signals	What a company's website runs on, plus DNS, email security and domain age
SEC Form D Funding Signals	Newly funded US companies from SEC Form D filings
US Federal Contracts & Awards Signals	SAM.gov opportunities with incumbent award history, plus Grants.gov

Data sources and fair use

• RDAP: each registry's public RDAP server, found through the IANA bootstrap. Registries' terms say the data is for lawful, informational use and must not be used for unsolicited marketing. Respect them. Contacts are removed in any case.
• DNS: public DNS-over-HTTPS resolvers (Cloudflare and Google).
• Requests identify themselves as signalscouter-bulk-domain-lookup/0.1 (+https://apify.com/signalscouter; signalscouter.data@gmail.com).

Questions or a missing field? Email signalscouter.data@gmail.com or open an issue on the Actor's Issues tab.