Domain WHOIS (RDAP), DNS and SPF/DMARC Checker

Give it a list of domains and get one row per domain with its registration facts, DNS records and email-security records, plus a short list of plain-language issues. Useful for qualifying B2B leads, auditing client domains before an email campaign, tracking expiry dates across a portfolio, or checking that your own domains can't be spoofed.

What it does

Only official public protocols are used; no web pages are scraped and no browser runs.

• Registration (RDAP): RDAP is the registries' official successor to WHOIS. The actor finds each TLD's RDAP server from the IANA bootstrap list and returns registrar, created, expires, days_to_expiry, status codes, nameservers and dnssec. For a subdomain it walks up to the registered domain.
• DNS (over HTTPS, Cloudflare with Google as fallback): a, aaaa, caa for the domain; mx, spf (the v=spf1 TXT record) and dmarc (_dmarc TXT) for the registered domain, with spf_all (-all, ~all ...; a bare all reads as +all, and an SPF redirect= is followed one hop to find it) and dmarc_policy (none / quarantine / reject) pulled out. null_mx is true when the domain publishes the RFC 7505 "accepts no mail" record (0 .); such domains are not flagged for missing SPF or DMARC. email_provider labels the mail host from the MX records: Google Workspace, Microsoft 365, Zoho, other (any other mail host), or none (no MX or null MX); useful for segmenting B2B prospect lists.
• issues: for example "no DMARC record", "DMARC policy is p=none (monitoring only)", "receives mail (MX) but has no SPF record", "SPF ends with +all", "multiple SPF records (invalid)", "DMARC record has no p= tag (invalid)", "domain expires in 12 days". Only faults of the domain itself go here.
• rdap_note: null, or why registration facts are missing (for example "no RDAP service for .de"). A lookup limit, not a problem with the domain.
• error: null, or invalid domain, not registered, dns lookups failed.

Limits, stated plainly: some country TLDs run no public RDAP server (for example .de); for those the registration fields are empty and rdap_note says so, while DNS fields are still filled. Registrant names and contact details are usually redacted by registries and are not collected. DKIM is not checked, because it needs the sender's selector.

Input

{
  "domains": ["zingermansdeli.com", "https://www.brooklynbrewery.com/about"],
  "concurrency": 8
}

Output example

{
    "input": "brooklynbrewery.com",
    "domain": "brooklynbrewery.com",
    "registered_domain": "brooklynbrewery.com",
    "registrar": "Network Solutions, LLC",
    "created": "1996-09-10T04:00:00Z",
    "expires": "2030-09-09T04:00:00Z",
    "days_to_expiry": 1438,
    "status": [
        "client transfer prohibited"
    ],
    "nameservers": [
        "colin.ns.cloudflare.com",
        "gabriella.ns.cloudflare.com"
    ],
    "dnssec": false,
    "a": [
        "34.121.84.232"
    ],
    "aaaa": [],
    "mx": [
        "0 brooklynbrewery-com.mail.protection.outlook.com."
    ],
    "spf": "v=spf1 mx ip4:172.254.49.195/32 ip4:50.74.28.226/32 ip4:67.227.248.159/32 ip4:208.68.135.212/32 ip4:137.117.87.205/32 include:_spf.31326.transactional-mail-a.com include:spf.mandrillapp.com include:spf.protection.outlook.com include:servers.mcsv.net include:_spf.google.com -all",
    "spf_all": "-all",
    "dmarc": "v=DMARC1; p=quarantine; rua=mailto:dmarc@brooklynbrewery.com; ruf=mailto:dmarc@brooklynbrewery.com; fo=0:s; adkim=r; aspf=r",
    "dmarc_policy": "quarantine",
    "caa": [],
    "null_mx": false,
    "email_provider": "Microsoft 365",
    "rdap_note": null,
    "issues": [],
    "error": null
}

Use from Clay

Clay's HTTP API column can call this actor directly, one domain per row. Replace <your Apify API token> with your own token (Apify Console > Settings > API & Integrations); runs are billed to that Apify account.

• Method: POST
• Endpoint: https://api.apify.com/v2/acts/weio~domain-whois-dns-email-security-checker/run-sync-get-dataset-items?token=<your Apify API token>
• Body: {"domains": ["{{domain}}"]} (insert your Clay domain column in place of {{domain}})
• Header: Content-Type: application/json

The response is a JSON array with one object for the one domain you sent. Map these fields from that first object: spf, dmarc, mx, email_provider (Google Workspace, Microsoft 365, Zoho, other or none) and, if you want them, spf_all, dmarc_policy and issues. Example for brooklynbrewery.com: email_provider = Microsoft 365, dmarc_policy = quarantine, spf_all = -all.

Cost: $0.003 per domain checked ($3.00 per 1,000), billed by Apify on pay-per-event pricing (Apify paid plans get lower per-event rates). An invalid, unregistered or failed lookup returns a row with error set and is free. A request with no domains is rejected with HTTP 400 before any run starts, so it costs nothing. The synchronous endpoint suits one or a few domains per call; for large lists run the actor with the whole list instead.

Pricing

$3.00 per 1,000 domains ($0.003 per domain), platform usage included. You are charged only for rows without an error: invalid, unregistered and failed lookups are free.

Related actors from Weio

• Website Contact Details Extractor: business emails, phones and social links from a list of websites.
• Website Tech Stack Detector: CMS, store platform, analytics, pixels and hosting of a list of websites.
• Local Business Website Audit: mobile layout, HTTPS, title/description and contact checks for small-business sites.

Made by

Weio, Inc., Santa Barbara, CA. AI operators build and maintain this actor; a person is accountable for it.