Domain WHOIS & DNS API

What does Domain WHOIS & DNS API do?

Domain WHOIS & DNS API is a bulk domain lookup tool. Give it a list of domains or URLs and you get one clean row per domain with everything you normally collect from four or five separate tools:

• WHOIS / RDAP registration data: registrar, IANA registrar ID, creation date, expiry date, days until expiry, domain age, EPP status codes, transfer lock, DNSSEC and registrant country or organisation when the registry publishes them
• Domain availability: whether the domain is registered or free, straight from the registry
• DNS records: A, AAAA, MX, NS, TXT, CAA and SOA status
• Email security: parsed SPF and DMARC, MTA-STS and BIMI, the detected email provider (Google Workspace, Microsoft 365, Proofpoint and others) and an A–F email security grade
• SSL certificate: issuer, valid-from and expiry dates, days left, SAN list, wildcard flag, TLS version and whether the certificate validates
• Issues list: machine-readable codes such as DOMAIN_EXPIRES_SOON, SSL_EXPIRED, NO_DMARC and SPF_PLUS_ALL, each with a severity

It uses the official RDAP protocol, which ICANN made the standard machine-readable replacement for WHOIS. Lookups go to each registry's RDAP server, plus DNS-over-HTTPS and a single TLS handshake. There's no browser, no login and no API key, so it's fast and cheap: 1,000 domains cost about $2.

Typical uses:

• Domain portfolio monitoring: get an alert before any of your domains or SSL certificates expire
• Email deliverability audits: find client or prospect domains without DMARC, with a weak SPF policy, or with several conflicting SPF records
• Lead enrichment: add domain age, registrar, email provider and hosting nameservers to a CRM list
• Domain investing: check availability and the age of expiring or brandable names in bulk
• Security and vendor reviews: check a supplier list for expired certificates, missing CAA records or unsigned DNS

Why use Domain WHOIS & DNS API?

• Five tools in one row. WHOIS lookup, domain availability checker, DNS lookup, SPF/DMARC checker and SSL certificate checker in a single run and a single schema. You don't have to join datasets afterwards.
• Official sources only. Registration data comes from the registries' RDAP servers, found via the IANA bootstrap file. DNS comes from Cloudflare's public resolver (with Google as fallback). The SSL check is one normal HTTPS handshake.
• Monitoring mode built in. Switch on Only return domains with issues and schedule a daily run. You only get, and only pay for, the domains that need attention: expiring soon, invalid SSL, missing DMARC and so on.
• Clear issue codes. Every row has issueCodes and an issues array with severity (error, warning, info) and a plain-English message, ready to filter in a spreadsheet or route to Slack.
• Privacy-safe output. Registrant names, emails, phone numbers and street addresses are never output. Only the registrar's details and, when published by the registry, the registrant's country and organisation.
• Fair pricing. $2 per 1,000 domains, with volume discounts on higher Apify plans. Invalid domains, failed lookups and (in monitoring mode) domains without issues are not charged.
• Fast. Ten domains take about 20 seconds; thousands run in parallel with per-registry rate limiting so you don't get blocked.
• API and AI-agent ready. Call it from Make, Zapier or n8n, from your own code via the Apify API, or let an AI agent use it through the Apify MCP server.

What data can you extract?

Field	Example	Description
domain	apify.com	Registrable domain (URLs and subdomains are reduced to it)
host	shop.example.com	The host you entered, if it differs from the domain
available	false	true if the registry has no record of the domain, null if it can't be determined
registered	true	The inverse of available
registrationSource	rdap	rdap, or none when the TLD's registry has no RDAP server
registrar	Amazon Registrar, Inc.	Sponsoring registrar
registrarIanaId	468	IANA registrar ID
registrarAbuseEmail	trustandsafety@support.aws.com	Registrar's abuse contact (a company mailbox)
createdDate	2009-06-02T17:14:10Z	Registration date
updatedDate	2026-05-16T16:53:04Z	Last change at the registry
expiryDate	2035-06-02T17:14:10Z	Registration expiry date
daysUntilExpiry	3158	Days until the registration expires
domainAgeYears	17.3	Age of the domain in years (also domainAgeDays)
statusCodes	["client transfer prohibited"]	EPP status codes
transferLocked	true	Whether a transfer-prohibited lock is set
dnssecSigned	true	Whether the delegation is DNSSEC-signed (registry view)
registrantOrganization	Spotify AB	Registrant organisation, only when the registry publishes it
registrantCountry	SE	Registrant country code, only when published
dnsStatus	NOERROR	NOERROR, NXDOMAIN or SERVFAIL
aRecords / aaaaRecords	["3.174.18.47"]	IPv4 and IPv6 addresses
nameservers	["ns-449.awsdns-56.com"]	Live NS records
mxRecords	["1 aspmx.l.google.com"]	MX records with priority, sorted
emailProvider	Google Workspace	Detected from MX records
txtRecords	["v=spf1 ..."]	TXT records (first 30)
verificationTokens	["google", "openai"]	Services the domain verified ownership for
caaRecords	["0 issue \"letsencrypt.org\""]	Which CAs may issue certificates
spfRecord	v=spf1 include:_spf.google.com -all	The SPF record
spfAllQualifier	-all	-all, ~all, ?all or +all
spfDnsLookups	6	Top-level SPF terms that cost a DNS lookup (limit is 10)
dmarcPolicy	reject	DMARC p= policy (none, quarantine, reject)
dmarcSubdomainPolicy	reject	DMARC sp= policy
dmarcPct	100	DMARC pct= value
dmarcReporting	true	Whether aggregate reports (rua) are requested
mtaSts / bimi	true	Whether MTA-STS and BIMI records exist
emailSecurityGrade	A	A–F grade from SPF and DMARC (see FAQ), N/A if the domain has no mail setup
sslValid	true	Whether the certificate validates against public trust stores and matches the host
sslIssuer	Let's Encrypt	Certificate issuer organisation
sslExpiryDate	2027-01-16T23:59:59Z	Certificate expiry
sslDaysUntilExpiry	99	Days left on the certificate
sslSans	["*.apify.com", "apifier.com"]	Subject alternative names (first 100)
tlsVersion	TLSv1.3	Negotiated TLS version
issueCodes	["NO_DMARC", "NO_CAA"]	All issue codes, most severe first
issues	[{"code": "NO_DMARC", "severity": "warning", "message": "..."}]	Issues with severity and explanation
checkedAt	2026-10-09T12:05:57Z	When the domain was checked

How to use Domain WHOIS & DNS API (step by step)

1. Click Try for free and open the actor's input page.
2. Paste your domains into Domains or URLs, one per line. Full URLs, www. hosts and subdomains are fine; they're reduced to the registrable domain.
3. Leave the three checks (registration, DNS and email security, SSL) switched on, or switch off the ones you don't need to make runs even faster.
4. Optional: set the domain expiry and SSL expiry warning windows, for example 60 and 21 days.
5. Click Start. Results appear in the Overview table within seconds. Switch to the WHOIS / RDAP, DNS & email security or SSL certificates views for detail.
6. Download as JSON, CSV, Excel or HTML, or connect the dataset to Google Sheets, Slack or your CRM.

To monitor domains, switch on Only return domains with issues, pick a minimum severity, save the input as a task and add a daily or weekly schedule. Add an integration (email, Slack, webhook) on the task to be notified when the dataset isn't empty.

Input example

{
  "domains": ["apify.com", "klarna.se", "https://www.bbc.co.uk/news", "my-new-brand-idea.com"],
  "includeRegistration": true,
  "includeDns": true,
  "includeSsl": true,
  "expiryAlertDays": 30,
  "sslAlertDays": 14,
  "onlyWithIssues": false
}

Output example

[
  {
    "domain": "apify.com",
    "registrationSource": "rdap",
    "registered": true,
    "available": false,
    "registrar": "Amazon Registrar, Inc.",
    "registrarIanaId": "468",
    "createdDate": "2009-06-02T17:14:10Z",
    "expiryDate": "2035-06-02T17:14:10Z",
    "daysUntilExpiry": 3158,
    "domainAgeYears": 17.3,
    "statusCodes": ["client transfer prohibited"],
    "dnssecSigned": true,
    "dnsStatus": "NOERROR",
    "mxRecords": ["1 aspmx.l.google.com", "5 alt1.aspmx.l.google.com"],
    "emailProvider": "Google Workspace",
    "spfAllQualifier": "-all",
    "dmarcPolicy": "reject",
    "mtaSts": true,
    "bimi": true,
    "emailSecurityGrade": "A",
    "sslValid": true,
    "sslIssuer": "Amazon",
    "sslExpiryDate": "2027-01-16T23:59:59Z",
    "sslDaysUntilExpiry": 99,
    "tlsVersion": "TLSv1.3",
    "issueCodes": [],
    "error": null
  },
  {
    "domain": "zzq-unregistered-demo-domain-4821.com",
    "registrationSource": "rdap",
    "registered": false,
    "available": true,
    "dnsStatus": "NXDOMAIN",
    "emailSecurityGrade": "N/A",
    "issueCodes": ["DOMAIN_AVAILABLE"],
    "error": null
  }
]

Every field is also available as a CSV or Excel column. Arrays such as mxRecords are joined into one cell.

How much does it cost?

The actor uses pay-per-event pricing. You pay only for domains that come back with data.

Event	Price (free plan)	When it's charged
Actor start	$0.0005	Once per run
Domain checked	$0.002	Per domain returned with data ($2 per 1,000)

Higher Apify plans get automatic discounts on the per-domain price (Bronze −15%, Silver −30%, Gold and above −45%). Invalid domains, lookups where every source failed, and, in monitoring mode, domains without issues are free.

Worked examples:

• Check 1,000 domains once: about $2.00.
• Monitor a 200-domain portfolio daily in monitoring mode: if on average 5 domains have an issue, that's 30 days × (5 × $0.002 + $0.0005) ≈ $0.32 per month.
• Enrich a 20,000-row lead list with registrar, domain age and email provider: about $40, or less on a higher plan.

Apify's free plan includes $5 of monthly credit, enough for about 2,500 domain checks a month.

Use cases

• IT and DevOps teams: a weekly schedule that warns before domains or certificates expire, plus checks for missing CAA or unsigned DNS.
• Email deliverability consultants: audit a client's domains for SPF/DMARC readiness before Gmail and Yahoo bulk-sender rules bounce their mail. The emailSecurityGrade column turns into a sales pitch on its own.
• Sales and lead generation: filter prospects by email provider (Google Workspace vs Microsoft 365), domain age (older domains often mean established companies) or DMARC status to sell an email security product.
• Domain investors: bulk-check availability and the age of existing domains, and watch expiry dates of names you want to acquire.
• Security analysts and procurement: vendor and phishing-lookalike reviews: when was the domain registered, at which registrar, does it have a valid certificate?
• AI agents: an agent can call the actor to answer "is example.com available?", "when does our certificate expire?" or "does this domain have DMARC?" with structured data.

Use with AI agents, MCP and the API

Run it from the command line with curl (replace YOUR_TOKEN):

curl -X POST "https://api.apify.com/v2/acts/teddythebuilder~domain-whois-dns-api/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com", "example.org"]}'

Or from Python with the apify-client package:

from apify_client import ApifyClient

client = ApifyClient("YOUR_TOKEN")
run = client.actor("teddythebuilder/domain-whois-dns-api").call(
    run_input={"domains": ["example.com", "github.com"], "includeSsl": True}
)
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row.get("expiryDate"), row.get("emailSecurityGrade"), row["issueCodes"])

AI assistants that support MCP (Claude, Cursor, VS Code and others) can use the actor through the Apify MCP server (https://mcp.apify.com). Add teddythebuilder/domain-whois-dns-api as a tool and ask in plain language.

Integrations

Domain WHOIS & DNS API works with every Apify integration:

• Make, Zapier and n8n: run on new spreadsheet rows or CRM records and write results back.
• Google Sheets: export the dataset or sync it with a scheduled task.
• Slack and email: in monitoring mode, notify a channel when the run returns any rows.
• Webhooks: post the results to your own endpoint when a run finishes.

Data source and legality

• Registration data: each registry's official RDAP (Registration Data Access Protocol) server, located through the IANA bootstrap file https://data.iana.org/rdap/dns.json. RDAP is the ICANN-mandated, machine-readable successor of WHOIS and is intended for automated access. Classic port-43 WHOIS is not used.
• DNS: public DNS-over-HTTPS resolvers (Cloudflare, with Google as fallback). DNS records are public by design.
• SSL: one standard TLS handshake on port 443, the same as a browser visiting the site.
• Personal data: registrant names, email addresses, phone numbers and postal addresses are never stored or output, even when a registry publishes them. You get the registrar's details and, when published, the registrant's country and organisation only.
• Rate limits: requests to each RDAP server are capped at 4 in parallel with automatic back-off on HTTP 429.

FAQ

Which TLDs are supported? DNS, email security and SSL work for every domain. Registration data covers the 1,200+ TLDs with an RDAP server: all generic TLDs (.com, .net, .org, .ai, .app, .shop...) and many country codes (.uk, .fr, .nl, .no, .fi, .ch, .ca, .au and more). A few registries don't run RDAP yet (for example .de, .se, .dk, .eu, .io, .co). For those, registrationSource is none, registration fields are empty, and availability is inferred from DNS.

How reliable is the availability check? For RDAP TLDs, available: true means the registry returned "not found", which is authoritative. Premium or reserved names can still be unavailable for purchase, so confirm with a registrar. For non-RDAP TLDs, a domain without any DNS is reported as available: null with a note, because an unregistered domain and a registered domain without DNS look the same.

Why is expiryDate empty for some domains? Some registries don't publish expiry dates in RDAP (Norway's Norid, for example). The rest of the row is still filled.

How is the email security grade calculated? A: valid single SPF ending in -all or ~all and DMARC quarantine or reject at pct=100. B: the same with pct below 100. C: valid SPF and DMARC p=none. D: SPF or DMARC present but weak or broken. F: the domain has MX records but neither SPF nor DMARC. N/A: no mail setup at all.

Do you check DKIM? Not yet, because DKIM selectors can't be listed from DNS. If you know your selectors, open an issue and we'll consider adding a selector input.

Will I be charged for domains that fail? No. Invalid input, domains where every lookup failed and, in monitoring mode, domains without issues are not charged.

How fresh is the data? Live. Every run queries the registries, DNS and the web server at that moment. Nothing is cached between runs.

Can I use it on the free Apify plan? Yes. The $5 monthly free credit covers about 2,500 domain checks. If you find the actor useful, a rating on the Store page helps others find it.

Related actors

• Tech Stack Detector: CMS, ecommerce platform, analytics, CDN and SaaS tools for any website. Combine it with this actor for full domain + technology enrichment.
• Website SEO Audit Crawler: crawl a site and audit every page for broken links, redirects, titles, canonicals, noindex and sitemap coverage.
• Career Site Jobs API: jobs straight from company career sites on Greenhouse, Lever, Ashby, Workable, Recruitee and Teamtailor.
• Nordic Company Registry API: companies from Sweden, Norway and Finland with industry codes.
• Nordic Tenders Scraper: public procurement notices from Nordic buyers.
• Shopify & WooCommerce Products Scraper: product catalogues, prices and stock changes from Shopify and WooCommerce stores.

Changelog and support

• 1.0 (2026-10): first release. RDAP registration data and availability for 1,200+ TLDs, DNS records, SPF/DMARC/MTA-STS/BIMI parsing with an A–F grade, SSL certificate check, issue codes and a monitoring mode.

Questions, bugs or a TLD that doesn't work? Open an issue. We reply within 24 hours.