Domain Lookup: WHOIS, DNS, SSL Certificate & Redirect Check

Give it domains or URLs. For each one you get a single flat row with the whois (RDAP) record, the DNS lookup, the SSL certificate and the website status with the redirect chain. Built to be called by AI agents (Apify MCP, n8n, LangChain) and by people: small input, one row per domain, a clear error on every row that is not complete.

No personal data. The registrant's name, e-mail, phone and address are never read or returned.

What you get for each domain

Group	Fields
Flags	expiresSoon, noMx, noSpf, noDmarc, redirectsToOtherDomain
Whois (RDAP, or port 43 WHOIS)	whoisSource (rdap or whois), registrar, registrarIanaId, domainCreated, domainUpdated, domainExpires, domainAgeDays, domainDaysToExpiry, domainStatus, nameservers, dnssecSigned, registrantOrganization (a company only), rdapStatus, whoisError (why the registry lookup failed)
DNS and mail	a, aaaa, mx, emailProvider (Google Workspace, Microsoft 365, Zoho Mail and others, read from the MX hosts), dkimSelectorsFound, ns, spf, dmarc, dmarcPolicy, caa, txt, dnsStatus
SSL certificate	tlsIssuer, tlsSubject, tlsSans, tlsValidFrom, tlsValidTo, tlsDaysToExpiry, tlsTrusted, tlsError, tlsProtocol, tlsStatus
Website status	httpStatus, httpError, finalUrl, redirects, redirectChain, responseTimeMs, title
Row	domain, status, error, checksFailed, input, duplicateOf, checkedAt

Every row has every field. A value that is not known is null (or [] for lists), never missing, so a script or an agent can read the same keys from every row.

Example

Input:

{ "domains": ["example.com", "https://www.google.com/search?q=x", "this-domain-does-not-exist-9f3k2.com"] }

The row for example.com (shortened), from a live check on 2026-10-28:

{
  "domain": "example.com",
  "status": "ok",
  "error": null,
  "checksFailed": [],
  "expiresSoon": false,
  "noMx": true,
  "noSpf": false,
  "noDmarc": false,
  "redirectsToOtherDomain": false,
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "domainCreated": "1995-08-14",
  "domainExpires": "2027-08-13",
  "domainAgeDays": 11398,
  "domainDaysToExpiry": 289,
  "mx": [],
  "tlsIssuer": "SSL Corporation",
  "tlsValidTo": "2026-12-25",
  "tlsDaysToExpiry": 58,
  "tlsTrusted": true,
  "httpStatus": 200,
  "finalUrl": "https://example.com/",
  "redirects": 0,
  "responseTimeMs": 189,
  "title": "Example Domain"
}

google.com comes out with finalUrl: "https://www.google.com/" and redirects: 1. The made-up name comes out as a free row with status: "not-found" and the reason in error.

The flags

All flags are true, false or null. null means "could not be checked", never "no".

• expiresSoon: the domain registration or the SSL certificate expires in fewer than 30 days (or already has). null only when neither date is known.
• noMx: the domain takes no mail: no MX record, or a "null MX". A subdomain such as blog.example.com usually has none.
• noSpf: no v=spf1 TXT record.
• noDmarc: no DMARC record at _dmarc.<domain>.
• redirectsToOtherDomain: the homepage ends on another registrable domain than the one you gave (old-brand.com to new-brand.com). A redirect from the bare domain to www. on the same site is false.

Status and what is charged

status	Meaning	Charged
ok	Every check that was made answered.	yes
partial	At least one check answered, at least one failed. checksFailed lists them (rdap, dns, tls, http) and error says why.	yes
not-resolving	The registry has a record, but the name does not exist in DNS (NXDOMAIN): no name servers, expired, or never set up. DNS, TLS and HTTP are skipped.	yes, the registry answered
not-found	The name does not exist in DNS and the registry did not return a record (or the top-level domain has no RDAP service). Probably not registered.	free
failed	Every check failed, so nothing is known. Run again later.	free
invalid-domain	The entry is not a domain (an e-mail address, a bare word, an IP address). error says what is wrong.	free
duplicate	The same domain appeared earlier in the list. It is looked up once.	free

The rule is simple: a row is charged when at least one lookup returned data. A domain that does not resolve is charged only if the registry answered. A row where every lookup failed is never charged.

Pricing

Pay per result, $1.00 per 1,000 domains on the free plan, $0.60 per 1,000 on the Gold plan and above. You are charged one domain-looked-up event for each charged row, and nothing for the free rows in the table above. Set a maximum cost per run and the actor stops there.

Input

• domains: a list of domains or URLs. https://www.example.com/path?x=1 becomes example.com. One entry may hold several domains separated by commas, semicolons or line breaks.
• text: the same, as one pasted block (a spreadsheet column, a CSV export).

Up to 10,000 entries per run. An unknown input field stops the run before anything is looked up or charged, with a hint such as did you mean "domains"?.

E-mail addresses are refused (the row says so and does not repeat the address).

How it works

For each domain, at the same time:

1. Whois: the domain's RDAP record from the registry (the successor of WHOIS, found through the IANA bootstrap file). Requests to one registry are spaced out, and a registry that asks to slow down is left alone for a while.
2. DNS: A, AAAA, MX, NS, TXT, CAA and _dmarc TXT queries, then five DKIM selector queries for a domain that takes mail.

Then, when the name exists and points at a public address:

3. SSL certificate: one TLS handshake on port 443 to read the certificate. An expired, self-signed or wrong-name certificate is read and reported (tlsTrusted: false, tlsError), not treated as a failure.
4. Website status: one GET of https://<domain>/ and of each redirect after it (at most 5). Only the status, the final URL, the time and the text of the <title> tag are kept. This is a status check of the homepage: robots.txt is not consulted, no cookies are kept, and nothing is crawled.

Eight domains are handled at the same time. A domain takes about one to three seconds.

Registries without RDAP: port 43 WHOIS fallback

Some country-code registries (for example .so, .ru) have no RDAP service in the IANA list. For those, the actor asks IANA's WHOIS server (whois.iana.org) which WHOIS server the registry runs, then sends one query to that server on port 43. Only the dates, registrar, status codes, name servers and DNSSEC flag are read from the answer; every other line, where a registrant's name, address, e-mail and phone would be, is never parsed, stored or returned. Requests to one server are 1.5 seconds apart, time out after 8 seconds, a server that says it is overloaded is left alone for two minutes, and nothing is retried. whoisSource says rdap or whois for the row; it is null when no registration data came back. WHOIS answers have no common format, so a registry whose answer the parser cannot read gives rdapStatus: "error" and the rest of the row is still filled.

Expiring domains only

Set expiringWithinDays (1 to 3650) to keep only the domains whose registration or SSL certificate expires within that many days, or has already expired. A domain without a known expiry date is not kept. Domains that do not match are looked up but not saved and not charged; the run summary counts them as filtered.

Email provider and DKIM

emailProvider is read from the MX hosts (lowest priority first) and is null when there is no MX or the host is not a known provider. For a domain that takes mail the actor also asks DNS for the DKIM key at five common selectors (google, selector1, selector2, default, k1) and lists those that exist in dkimSelectorsFound. An empty list does not prove the domain has no DKIM: senders use many other selector names.

Good to know

• The domain is checked as you give it. www. is dropped, other subdomains are kept. For a subdomain the registry record is that of the domain above it.
• Some country-code domains have no RDAP service in the IANA list; they use the port 43 fallback above. If the registry has no WHOIS server either, the row has rdapStatus: "unsupported-tld", the DNS, SSL and website fields are still filled, and the row is partial.
• Most registries hide the registrant. registrantOrganization is filled only when the registry shows an organisation with a legal form (Inc, LLC, Ltd, GmbH, S.A., Sp. z o.o. and similar) that is not a privacy service. A person's name is never returned.
• TXT records, DMARC report addresses and the like are returned with the part of any e-mail address before the @ replaced by [hidden]. CAA contact addresses are dropped.
• The actor never connects to private or local addresses, and does not follow a redirect to an IP address.
• httpStatus 4xx and 5xx are results, not errors: the row stays ok and shows the code.
• Rows come out in the order of your list. The run keeps its progress, so a restarted run does not save or charge a row twice.

Use it from an AI agent

Through the Apify MCP server, ask for "whois lookup", "dns lookup", "ssl certificate expiry", "domain age", "website status" or "redirect checker" for a list of domains. Pass {"domains": ["example.com"]}. Read status first, then error and checksFailed when a row is partial.