Domain Intel: WHOIS/RDAP, DNS, SSL, SPF & DMARC in bulk

Paste a list of domains (or URLs) and get one clean row per domain with:

• RDAP / WHOIS: registrar, IANA ID, abuse contact, creation / update / expiry dates, domain age, days until expiry, EPP status, nameservers, DNSSEC. The registry's RDAP server is found through the official IANA bootstrap, with rdap.org as a fallback.
• DNS: A, AAAA, CNAME, MX, NS, TXT, CAA, SOA, from public resolvers 1.1.1.1 and 8.8.8.8.
• SSL certificate on port 443: issuer, validity dates, days left, SANs, trust status, TLS version.
• Email authentication: SPF (syntax, all qualifier, includes, lookup count, issues), DMARC (policy, sp, pct, rua; inherited from the organizational domain if the subdomain has none), BIMI, MTA-STS (record plus policy mode) and TLS-RPT.
• Provider detection: the mail provider (Google Workspace, Microsoft 365, Proofpoint, …) and the DNS provider (Cloudflare, Route 53, NS1, …), inferred from MX and NS records.
• Health score from 0 to 100, with each deduction listed so you can see why.
• Optional: subdomains from Certificate Transparency logs (crt.sh).

Use cases: lead enrichment (company email stack, domain age), security and compliance audits (SPF/DMARC/certificate hygiene), expiry monitoring across a portfolio, and due diligence.

Use cases

• Expiry monitoring: catch domain registrations and SSL certificates that expire soon, on a schedule.
• Email authentication audits: SPF, DMARC, BIMI and MTA-STS for every client or vendor domain.
• Sales enrichment: domain age and mail provider (Google Workspace, Microsoft 365) as firmographic signals.
• Security and vendor due diligence: registrar, DNS host, certificate issuer and subdomains from certificate transparency.
• Portfolio management for agencies and domain investors.

Input

{ "domains": ["apify.com", "https://www.github.com/about", "bbc.co.uk"], "includeCtSubdomains": false }

Each check can be switched off (includeRdap, includeDns, includeSsl, includeEmailAuth). Invalid entries and duplicates are skipped and never charged.

Output sample (shortened)

{
  "domain": "github.com", "status": "ok", "healthScore": 83,
  "registrar": "MarkMonitor Inc.", "createdAt": "2007-10-09T18:20:50Z", "expiresAt": "2028-10-09T18:20:50Z", "domainDaysLeft": 710,
  "sslIssuer": "Sectigo Limited", "sslDaysLeft": 89, "sslTrusted": true,
  "mailProvider": "Google Workspace", "dnsProvider": "NS1, Amazon Route 53",
  "spfValid": true, "dmarcPolicy": "reject", "emailAuthIssues": [],
  "rdap": { "registrarIanaId": "292", "status": ["client transfer prohibited"], "nameservers": ["dns1.p08.nsone.net"], "dnssec": false },
  "dns": { "a": ["140.82.112.3"], "mx": [{ "priority": 1, "exchange": "aspmx.l.google.com" }], "txt": ["v=spf1 ..."], "caa": [] },
  "ssl": { "validTo": "2027-01-27T23:59:59.000Z", "sans": ["github.com", "www.github.com"], "tlsProtocol": "TLSv1.3" },
  "emailAuth": { "spf": { "allQualifier": "fail", "includes": ["_spf.google.com"] }, "dmarc": { "policy": "reject", "rua": ["mailto:..."] }, "bimi": { "present": false }, "mtaSts": { "present": false } },
  "health": { "score": 83, "notes": ["-2 no CAA record"] }
}

The dataset has three views: Overview, Email authentication and Expiry watch.

Pricing (pay per event)

Event	Price	When
domain-checked	$0.001 per domain	A domain where DNS or RDAP answered. All enabled checks are included.
ct-subdomains	$0.001 per domain	Only if you enable CT subdomains and crt.sh returns at least one subdomain.

Invalid inputs, lookups that fail completely, and domains with no DNS and no RDAP record (unregistered) are never charged; they still appear in the dataset with status set. You also pay normal Apify platform usage, which is small because there is no browser.

Cost example: 1,000 domains with default settings cost about $1.00 in events, plus a few cents of platform usage.

Notes and limits

• RDAP replaces WHOIS for gTLDs. Some ccTLDs (for example .de) don't offer public RDAP, so rdap may be missing while DNS/SSL/email checks still work.
• Registrant personal data is redacted by registries, and this Actor does not try to recover it. Only the registrant organization/country is kept, and only when the registry publishes it.
• The SPF lookup count covers the top level only (nested includes are not expanded).

Use it from AI agents (MCP), Zapier, Make, n8n or the API

AI agents (Claude, Cursor, VS Code, ChatGPT and other MCP clients). Add Apify's hosted MCP server with just this Actor as a tool:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=steadyline/domain-intel"
    }
  }
}

Sign in with Apify (OAuth) on first connect, or add an Authorization: Bearer <APIFY_TOKEN> header. Then ask your agent, for example:

Use steadyline/domain-intel to check these 100 domains and list the ones whose SSL certificate or registration expires in the next 30 days, plus any with no DMARC policy.

The agent sees this Actor's input schema and output fields, so it can call it without extra prompting. Agents that use the general Apify MCP server can also find it with search-actors.

This Actor uses pay-per-event pricing with limited permissions, so it can also be run through Apify's agentic payments (no Apify account needed for the agent). See the Apify docs.

Zapier, Make and n8n. Use the official Apify app: Zapier "Run Actor" action, Make "Run an Actor" module, or the n8n Apify node. Choose steadyline/domain-intel, paste the input below, then use "Get dataset items" (or the run's dataset) to send results to Google Sheets, Slack, a CRM or a database.

API (any language). Run it and get the results in one call:

curl -X POST "https://api.apify.com/v2/acts/steadyline~domain-intel/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["apify.com", "github.com"]}'

Or with the Python client (pip install apify-client):

from apify_client import ApifyClient
client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("steadyline/domain-intel").call(run_input={"domains": ["apify.com", "github.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

Works well with other Steadyline Data tools

• Email list hygiene: clean addresses with Email Deliverability Checker, then audit the remaining company domains here.
• Domain due diligence: this Actor + Tech Stack Detector + Website Screenshot, about $0.005 per domain.
• Related: Email Deliverability Checker, Tech Stack Detector, Website Screenshot API.

FAQ

Is this a WHOIS lookup? It uses RDAP, the ICANN-standard successor to WHOIS, for registrar and dates, plus live DNS and TLS checks.

Can I find subdomains? Yes, turn on includeCtSubdomains to list subdomains from certificate-transparency logs (billed as ct-subdomains, $0.001 per domain).

What does it cost? $0.001 per domain checked, so $1 per 1,000.

Can I run it on a schedule? Yes. Create an Apify Schedule (or a saved Task with a schedule) and connect a webhook or integration to receive results.

Need a feature or found a bug? Open an issue on the Issues tab of this page or email steadylinedata@proton.me. Built and maintained by Steadyline Data.

Acceptable use

The Actor only reads public DNS, RDAP, Certificate Transparency and TLS handshake data, at a polite concurrency. Use it for domains you own, manage or have a legitimate interest in researching. Don't use it for spam or abuse. You're responsible for complying with applicable laws and the terms of the registries you query.

---

Built and maintained by Steadyline Data. Found an issue? Open one on the Actor's Issues tab.