Domain Inspector

Domain Inspector: DNS, registration, certificates and what a site runs, one row per domain

Paste a list of domains and get one row each: the DNS records, who the registrar is and when the registration expires, the certificate on port 443 with its expiry date, the redirect chain, the security headers, robots.txt, sitemap.xml and a few signals about what the site is built with.

Registration data comes from RDAP, which is the registry-run replacement for the old WHOIS port. Not every registry publishes it, so on some country domains the registrar and the expiry date come back empty while everything else on the row is filled in.

🔍 What Domain Inspector does

Each domain gets four independent checks, and you can switch any of them off.

DNS resolves A, AAAA, MX, NS, TXT and CAA, reporting per-record errors rather than collapsing them into one failure. RDAP asks the registry for the registrar, the status codes, the nameservers and the registration, update and expiry dates. Certificates connect on port 443 and report the issuer, the subject, the alternative names, both validity dates, days left and whether Node's trust store accepts the chain. Web requests both http:// and https://, follows the redirects, and reads the final status, the page title, the canonical URL, the Open Graph block, the security headers and a short list of technology signals.

If robots.txt and sitemap.xml checking is on, both are fetched from whichever origin answered best, and any sitemap URLs declared in robots.txt come back with them.

Anything that went wrong without killing the row lands in warnings, with warningsCount beside it so you can sort by how messy a domain is.

📥 What you give it

{
  "domains": ["github.com", "example.org", "https://news.ycombinator.com/"],
  "maxConcurrency": 5,
  "requestTimeoutSecs": 8,
  "checkRdap": true,
  "checkTls": true
}

example.com and www.example.com are two different domains here. Both get inspected, both get a row, and both count against your total. Deduplication only catches exact repeats.

The 500 limit is applied before duplicates are removed, and the single domain field is added at the end of the list. So a list of 500 with repeats in it can push your single domain out.

Setting maxRedirects to 0 does not switch redirects off. It falls back to 5.

📤 What you get back

The flat summary fields from a real row, with the nested blocks left out here because a full row runs to several thousand characters:

{
  "ok": true,
  "domain": "github.com",
  "inspectedAt": "2026-09-14T05:42:44.663Z",
  "httpsStatus": 200,
  "httpStatus": 200,
  "title": "GitHub · Change is constant. GitHub keeps you ahead. · GitHub",
  "dnsA": ["140.82.114.3"],
  "dnsAAAA": [],
  "tlsExpiresAt": "2026-11-29T23:59:59.000Z",
  "registrationExpiresAt": "2028-10-09T18:20:50.000Z",
  "technologies": ["React", "Server: github.com"],
  "warningsCount": 0
}

Under those sit the full blocks. From the same row, the certificate one:

"tls": {
  "available": true,
  "authorized": true,
  "authorizationError": null,
  "protocol": "TLSv1.3",
  "subject": { "CN": "github.com" },
  "issuer": { "C": "GB", "O": "Sectigo Limited", "CN": "Sectigo Public Server Authentication CA DV E36" },
  "subjectAlternativeNames": ["github.com", "www.github.com"],
  "validFrom": "2026-09-01T00:00:00.000Z",
  "expiresAt": "2026-11-29T23:59:59.000Z",
  "daysUntilExpiry": 76,
  "serialNumber": "A59EBDB596751DB7F5C095079613953C",
  "fingerprint256": "46:B6:01:EE:08:B4:18:CF:8A:3A:1E:..."
}

The overview table in the console shows the flat summary only. Switch to JSON or All fields for the nested blocks.

🧾 Reading the output

Three kinds of row can land in your dataset.

Filter on _sample being absent, not on ok. The sample row also carries ok: true.

A BAD_INPUT row has no domain field, only input, so it shows in the overview table as a line with the domain column blank.

▶️ How to run it

1. Open Domain Inspector and click Try for free. 2. Paste your domains into Domains or URLs, one per line. 3. Leave the four check boxes on for a full row, or switch off the ones you do not need. 4. Click Start. Rows land once every domain has finished, so a long list stays quiet for a while. 5. Download the dataset as JSON, CSV or Excel, or read it from the Apify API.

💰 How much does it cost?

$1.50 per 1,000 domains. Flat on every Apify plan, no volume tiers.

You pay per domain that came back with something. A parked domain counts, because it still has DNS and registration data. A domain where every check came back empty does not, and neither does the sample row or an invalid entry.

💡 What people use it for

• Watching certificate and registration expiry across a portfolio, on a schedule, sorted by

daysUntilExpiry.

• Auditing security headers across every domain a company owns, in one pass.
• Checking a list of acquisition targets or suppliers before a first email: is the site live, who

registered it, what is it built with.

• Confirming a migration actually landed, by reading the redirect chain and the final URL.
• Finding the domains in a list that no longer resolve at all.

🚧 What it does not do

• No JavaScript. The title, metadata and technology signals come from the HTML the server sent,

so a site that renders everything client side looks emptier than it is.

• Technology detection is a short list of signals, not a full fingerprinting suite. Treat

technologies as a hint.

• RDAP only. There is no fallback to the old port-43 WHOIS, so registries that publish neither

come back with available: false.

• 500 domains per run, counted before duplicates are removed.
• Nothing is delivered until every domain has finished. A run that is aborted partway through

writes no rows at all, so split very large lists.

• A domain pointing at a private address gets its web and certificate checks skipped, with a

warning saying so. DNS and registration still come back.

• One certificate, on port 443. No other ports, no chain download, no revocation check.
• No subdomain discovery. It inspects exactly what you give it.
• No traffic, ranking or backlink figures.

🧭 Which site checker do you need?

❓ Questions people ask

Do I need an API key for any of this? No. DNS, RDAP and certificates are all public lookups.

Why is the registrar empty on some domains? That registry does not publish RDAP. There is no second source here, so the field stays empty rather than being guessed.

Can I check subdomains? Only ones you list yourself. It does not go looking for them.

How long does 500 domains take? It depends on Concurrent domains and how fast the targets answer. Raise it carefully: past a point the other end starts refusing.

Why did I get nothing back from a run I stopped early? Rows are written once every domain has been inspected. Stop it before then and nothing is written.

Is this legal? DNS, RDAP and certificates are published for public lookup, and robots.txt and sitemap.xml are files sites publish deliberately. Apify's write-up on scraping and the law is a good starting point, and we are not lawyers.

🆘 If something breaks

Open the Issues tab on the actor page. Send the run ID and the domain that behaved oddly. The warnings array on the row usually explains it, and errorCode names it when the whole row failed.