Domain Intelligence: bulk WHOIS/RDAP, DNS, email provider, SPF/DMARC and SSL lookup

Paste a list of domains, website URLs or email addresses and get one clean record per domain:

• who it's registered with, when it was created and when it expires (RDAP, the official successor to WHOIS)
• DNS records
• which email provider the company uses (Google Workspace, Microsoft 365, Zoho…) and its SPF and DMARC setup
• the SaaS tools revealed by DNS verification records
• the SSL certificate and its expiry
• the website's hosting/CDN, title and description

No API keys, no login, and nothing to install. Built for lead enrichment, Clay/n8n/Make workflows, security audits and domain portfolio checks.

What data you get

• Registration: registrar and IANA ID, creation, expiry and last-changed dates, domain age in days, EPP status codes, nameservers, DNSSEC, and whether the domain is registered at all
• DNS: A, AAAA, CNAME, NS, MX and TXT records
• Email setup:
  • email provider detected from MX, with 30+ providers recognised (Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Mimecast, Proofpoint, Cisco, MessageLabs…)
  • whether the domain accepts email
  • SPF record and its all qualifier
  • DMARC record and policy (none, quarantine or reject)
• Tools in use: SaaS services that verified the domain, such as Google, Microsoft 365, Atlassian, HubSpot, Stripe, Slack, Zoom, OpenAI and DocuSign
• SSL/TLS: valid or not (and why not), issuer, valid-from and valid-to, days until expiry, alternative names, TLS version
• Website:
  • HTTP status, final URL after redirects, response time
  • page title, meta description, language
  • Server and X-Powered-By headers
  • CDN/hosting (Cloudflare, Vercel, Netlify, Fastly, CloudFront, Shopify, Wix…)
  • HSTS

Sample result (trimmed)

{
  "input": "https://www.stripe.com/pricing",
  "domain": "stripe.com",
  "registrar": "SafeNames Ltd.",
  "registeredAt": "1995-09-12T04:00:00Z",
  "expiresAt": "2027-09-11T04:00:00Z",
  "domainAgeDays": 11364,
  "nameservers": ["ns-1087.awsdns-07.org", "ns-423.awsdns-52.com"],
  "dnssec": false,
  "mxRecords": [{ "host": "aspmx.l.google.com", "priority": 1 }],
  "emailProvider": "Google Workspace",
  "spfAllQualifier": "~",
  "dmarcPolicy": "reject",
  "verifiedServices": ["Microsoft 365", "Anthropic", "Apple", "Atlassian", "Canva", "Cursor", "DocuSign", "Meta", "Google", "OpenAI", "Stripe"],
  "tlsValid": true,
  "tlsIssuer": "DigiCert, Inc.",
  "tlsDaysUntilExpiry": 48,
  "websiteStatus": 200,
  "websiteTitle": "Stripe | Financial Infrastructure to Grow Your Revenue",
  "edgeProvider": null,
  "errors": [],
  "checkedAt": "2026-10-23T01:48:47.923Z"
}

How to use

Field	What it does	Default
domains	Domains, URLs or emails, one per line. Each is reduced to its registrable domain (blog.example.co.uk becomes example.co.uk), and duplicates are removed	required
checkRegistration	RDAP registration data	on
checkDns	DNS records	on
checkEmail	Email provider, SPF, DMARC, verified SaaS tools	on
checkTls	SSL certificate	on
checkWebsite	One homepage request	on
maxItems	Stop after this many domains	50
concurrency	Domains inspected in parallel (1–20)	8

Examples

• Enrich a lead list: paste 1,000 work emails. You get each company's email provider, domain age, website title and tech hints.
• Security/compliance audit: check which of your domains lack DMARC reject, have weak SPF, or have certificates expiring within 30 days.
• Domain portfolio: check expiry dates and registrars across all your domains in one run.

Turn off the checks you don't need to make runs faster. Registration only, for example, is a quick WHOIS-style lookup.

Pricing

$3 per 1,000 domains, i.e. $0.003 per domain inspected, whichever checks you enable. 1,000 leads enriched costs $3.

FAQ

Is this legal? Yes. It reads public data through channels designed for automated access:

• registry RDAP services, the official IETF protocol that replaces WHOIS
• public DNS resolvers
• a standard TLS handshake
• one request to each site's homepage, just like a browser

No logins, no scraping of WHOIS websites, and no personal data. Registrant contact details are not collected.

Why is registration data empty for some domains? Some country registries haven't published an RDAP service yet. Currently that includes .io, .co, .me, .de, .eu, .us, .ch, .es, .it and .jp. For those domains you still get DNS, email, SSL and website data, and rdapNote explains why registration is missing. .com, .net, .org, .ai, .app, .dev, .uk, .fr, .nl, .ca, .au, .in and over 1,000 other TLDs are covered.

What does "Other / self-hosted" mean for email provider? The domain receives mail on servers that aren't one of the recognised providers, often its own mail servers.

Why does websiteStatus show 403 for some sites? Some sites put a bot challenge (e.g. "Just a moment…") in front of every automated request. We report that honestly instead of trying to get around it.

Integrations / API Run it from Clay, n8n, Make or Zapier, or call it through the Apify API and get results as JSON, CSV or Excel. Each domain's output is one flat record, so it maps straight onto spreadsheet columns.

Integrations / API

1. Enrich a lead list row by row (Clay)

Add company tech and email signals to every row that has a website or work email.

1. Add enrichment → Apify → Run Apify Actor, and choose Domain Intelligence.
2. Input. The column token has no quotes around it, and a work-email column works too:

   { "domains": [{{Website}}], "maxItems": 1, "checkTls": false }
   

3. Map the fields you want into columns:
   • emailProvider: Google Workspace, Microsoft 365, etc.
   • domainAgeDays
   • registrar
   • verifiedServices: e.g. HubSpot, Atlassian, Stripe, OpenAI
   • edgeProvider: Cloudflare, Vercel, Shopify…
   • websiteTitle

Tips:

• Turn off the checks you don't use to make each row faster.
• For example, "checkRegistration": false gives email and tech signals only.
• Each row costs $0.003.

2. Enrich a Google Sheet in bulk (n8n)

1. Google Sheets → Get Rows: read the column with domains, URLs or emails.
2. Code node: collect them into one input, return [{ json: { domains: $input.all().map(i => i.json.Website), maxItems: 1000 } }].
3. HTTP Request: POST https://api.apify.com/v2/acts/wakachobi~domain-intelligence/run-sync-get-dataset-items, header Authorization: Bearer <APIFY_TOKEN>, body {{ $json }}.
   • Keep each call to about 300 domains. Lookups to any single registry (e.g. Verisign for all .com) are spaced 300 ms apart to respect its limits, so 300 .com domains take about 90 s or more, inside the 300 s sync limit.
   • For bigger lists, use the Apify node's run-and-wait (no 300 s limit), or loop over 300-row batches with n8n's Loop Over Items.
4. Google Sheets → Update Row: match on domain, and write emailProvider, dmarcPolicy, domainAgeDays and so on back into the sheet.

3. Weekly domain-health check for your own domains (n8n or Apify schedule → email)

Catch expiring certificates, expiring domains and weak email security before they bite.

1. Schedule: weekly. Run Domain Intelligence on your domains: { "domains": ["example.com", "example.co.uk", "example-app.io"], "checkWebsite": false }.
2. Filter: keep a domain if any of these is true:
   • tlsDaysUntilExpiry < 21
   • expiresAt is within 30 days
   • dmarcPolicy isn't reject
   • spfAllQualifier is + or missing
3. Email: send the filtered list to the ops or security inbox.

4. Plain API call

curl -X POST "https://api.apify.com/v2/acts/wakachobi~domain-intelligence/run-sync-get-dataset-items?format=csv" \
  -H "Authorization: Bearer $APIFY_TOKEN" -H "Content-Type: application/json" \
  -d '{ "domains": ["stripe.com", "notion.so", "jane@openai.com"] }' -o domains.csv