Web data · Apify actor

Registration, DNS, SSL and email security in one report

For any list of domains: who the registrar is, when the domain was created and expires, whether it is registered or available, all DNS records, whether the SSL certificate is valid and how many days are left, and an A-F email security grade.

$0.003 per domainFailed inputs are free

Run it on Apify See pricing

What it does

Domain Lookup, in short

Registration from registry RDAP (the ICANN successor of WHOIS), with classic WHOIS as a fallback
Registrar, created / expiry / updated dates, domain age, days until expiry, status, nameservers, DNSSEC
DNS: A, AAAA, MX, NS, TXT, CAA, SOA and the www record
SSL: valid or not, issuer, validity dates, days until expiry, SAN count, TLS version
Email: SPF, DMARC, DKIM (12 common selectors), MTA-STS, TLS-RPT, BIMI, email provider, 0-100 score and A-F grade
A plain-English issues list; no registrant personal data is read or returned

Who it's for

Built for

Lead enrichmentAdd company domain age, email provider (Google Workspace, Microsoft 365) and mail security maturity to a lead list.

Portfolio monitoringRun it daily and alert when a domain or certificate is about to expire.

Security and deliverability auditsFind clients with missing DMARC, weak SPF or expired certificates.

Availability and brand checksregistered: false means the name is free; check lookalike domains and their registrars.

Example

Input and output

One dataset row per result, downloadable as JSON, CSV or Excel, or read through the Apify API.

Input

{
  "domains": ["stripe.com", "https://www.shopify.com/pricing", "ceo@example.org"]
}

From a real test run, trimmed. Domains, full URLs and email addresses are all accepted as input.

Output (one row)

{
  "domain": "apify.com",
  "registered": true,
  "registrySource": "rdap",
  "registrar": "Amazon Registrar, Inc.",
  "createdDate": "2009-06-02T17:14:10Z",
  "expiresDate": "2035-06-02T17:14:10Z",
  "domainAgeDays": 6321,
  "dnssec": true,
  "email": {
    "emailProvider": "Google Workspace",
    "spfAll": "-all",
    "dmarcPolicy": "reject",
    "dkimSelectorsFound": ["google"],
    "score": 100,
    "grade": "A"
  },
  "ssl": { "valid": true, "issuer": "Amazon", "daysUntilExpiry": 116, "tlsVersion": "TLSv1.3" },
  "issues": [],
  "error": null
}

Pricing

Pay per result. Failures are free.

$0.003domain analyzed · $3.00 per 1,000

No subscription, no monthly minimum. Apify platform compute is included in the price; Apify also adds a tiny start fee per run ($0.00005 per GB of run memory).

Example costs
You run	You pay
The 3-domain demo run	$0.009
Enrich 5,000 lead domains	$15.00
200 domains every day for 30 days	$18.00

Worked example. You monitor a 200-domain portfolio once a day for a month.200 × 30 = 6,000 lookups × $0.003 = $18.00

Not charged:

Invalid inputs
Domains where every lookup failed

Registration, DNS, SSL and email security are all included in the one per-domain price. An unregistered domain is a real result (registered: false) and is charged. You can set Maximum cost per run in the run options and the actor stops cleanly when it is reached.

FAQ

Questions

Why RDAP and not WHOIS?

RDAP is ICANN's official, structured replacement for WHOIS and is mandatory for generic TLDs. For country TLDs without RDAP the actor falls back to classic WHOIS, so fields may be sparser there.

How is the email grade calculated?

MX 10 points, SPF up to 25, DMARC up to 35 (reject 35, quarantine 28, none 12), DKIM 20, MTA-STS 5, TLS-RPT 5. A is 85 or more, B 70, C 50, D 30, otherwise F.

Can I pass subdomains?

Yes. Registration and DNS are reported for the registrable domain, and the SSL certificate is checked on the exact host you entered.

Does it collect personal data?

No. Registrant names, emails and addresses are not read or returned.

Why is the registrar sometimes the company itself?

Some registries, for example Nominet for .uk, list large organisations that act as their own registrar.