Bulk WHOIS Lookup, DNS Records, SSL Expiry & SPF/DMARC Checker

Bulk-check domains and get one clean row per domain combining:

• WHOIS/RDAP: registrar, IANA ID, created/updated/expiry dates, domain age, days until expiry, EPP status codes, nameservers, DNSSEC, and registration status (an unregistered domain gives registered: false).
• DNS: A, AAAA, NS, MX, TXT, CAA, SOA and the www CNAME, plus the DNS hosting provider (Cloudflare, Route 53, GoDaddy...) and the email provider (Google Workspace, Microsoft 365, Zoho, Proofpoint...).
• Email security: SPF (qualifier, includes, lookup count, >10 lookups warning), DMARC (policy, pct, reporting), DKIM (common selectors), MTA-STS, TLS-RPT, BIMI, and a 0-100 email security score.
• SSL/TLS certificate: validity, issuer, valid-from/to, days until expiry, SANs, TLS version, cipher, key size and fingerprint.
• HTTP/HTTPS: status, HTTP-to-HTTPS redirect, final URL, HSTS and server header.
• Alerts: DOMAIN_EXPIRING_SOON, SSL_EXPIRING_SOON, SSL_INVALID, NO_SPF, NO_DMARC, DMARC_POLICY_NONE, SPF_TOO_MANY_LOOKUPS, NO_DNSSEC, NO_HTTPS_REDIRECT, NO_HSTS, DOMAIN_NOT_REGISTERED.

It uses official protocols only: RDAP (the ICANN-mandated successor of WHOIS, via the IANA bootstrap registry), DNS-over-HTTPS and direct TLS handshakes. No proxies, no third-party WHOIS APIs, no rate-limited port-43 scraping.

How to use

1. Paste domains into Domains (or a list into the text box).
2. Choose which checks to run: WHOIS/RDAP, DNS, email security, SSL and HTTP.
3. Click Start. Each domain returns one row with dates, records, scores and alerts.

Why this Actor

	This Actor	Typical WHOIS / DNS Actors
WHOIS + DNS + email security + SSL + HTTP	One row, one price	Separate Actors
Expiry and security alerts	Yes	No
Email provider and DNS host detection	Yes	No
Price	$2 / 1,000 domains	$2.30 to $100 / 1,000

Use cases

• Domain portfolio monitoring: catch expiring domains and certificates before they lapse. Schedule a daily run and alert on alerts.
• Security and deliverability audits: SPF/DMARC/DKIM posture for your own or your clients' domains.
• Sales/lead qualification: email provider (Google vs Microsoft), DNS host and domain age.
• Due diligence, M&A and brand protection: registrar, age and status of lookalike or acquired domains.

Input

{ "domains": ["stripe.com", "github.com", "bbc.co.uk"], "checks": ["rdap", "dns", "email", "ssl", "http"], "expiryAlertDays": 30, "sslAlertDays": 14 }

Output (abridged)

{ "domain": "stripe.com", "registered": true, "registrar": "SafeNames Ltd.", "registrarIanaId": "447", "createdDate": "1995-09-12T04:00:00Z", "expiryDate": "2027-09-11T04:00:00Z",
  "domainAgeDays": 11359, "daysUntilExpiry": 327, "status": ["client transfer prohibited"], "nameservers": ["ns-423.awsdns-52.com"], "dnssec": false,
  "dnsProvider": ["Amazon Route 53"], "emailProvider": ["Google Workspace"],
  "emailSecurity": { "spf": { "present": true, "allQualifier": "softfail", "dnsLookups": 3 }, "dmarc": { "present": true, "policy": "reject" }, "dkimSelectorsFound": ["google"], "emailSecurityScore": 80 },
  "ssl": { "valid": true, "issuer": "DigiCert, Inc. - DigiCert G5 TLS ECC SHA384 2021 CA1", "validTo": "2026-12-10T23:59:59.000Z", "daysUntilExpiry": 52, "protocol": "TLSv1.3" },
  "httpsStatus": 200, "httpRedirectsToHttps": true, "hsts": "max-age=63072000; includeSubDomains; preload", "alerts": ["NO_DNSSEC"] }

Pricing (pay per event)

$0.002 per domain ($2 per 1,000), whichever checks you pick. Invalid inputs are free error records.

How much does it cost?

You only pay for results, never for compute time:

You get	You pay (Starter/Bronze plan price)
100 domains	$0.20
1,000 domains	$2.00
10,000 domains	$20.00

Apify's free plan includes $5 of usage every month, and free-plan users pay half price on this Actor, so that covers about 5,000 domains at no cost. Paid plans get volume discounts (Silver -10%, Gold -20%). Set a maximum cost per run and the Actor stops cleanly at your limit.

Privacy

Registrant personal data is redacted by registries under GDPR. We only return a registrant organization and country when the registry publishes them unredacted, and never personal names, emails or phone numbers. Registrar abuse contacts are role addresses.

Run it from code (API, Python, JavaScript)

curl -X POST "https://api.apify.com/v2/acts/api-co~domain-intel/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" -d '{"domains": ["stripe.com", "github.com"]}'

from apify_client import ApifyClient
client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("api-co/domain-intel").call(run_input={"domains": ["stripe.com", "github.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('api-co/domain-intel').call({"domains": ["stripe.com", "github.com"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();

It also works from AI agents through the Apify MCP server, and with Zapier, Make, n8n, Google Sheets and webhooks. You can schedule it in the Apify Console.

FAQ

Is this a real WHOIS lookup? Yes. It uses RDAP, the official ICANN successor of WHOIS, through the IANA bootstrap registry, so it returns registry data directly.

Can I monitor domain and SSL expiry? Yes. Schedule a daily run and filter the alerts field for DOMAIN_EXPIRING_SOON or SSL_EXPIRING_SOON.

Does it return the domain owner's name or email? No. Registries redact personal data under GDPR, and this Actor never returns personal contact data.

Which TLDs are supported? Every TLD that publishes RDAP, which includes all gTLDs (.com, .net, .org, .io...) and most ccTLDs.