Email & Domain OSINT (WHOIS + DNS + SSL + Breach)

What does Email & Domain OSINT Toolkit do?

Email & Domain OSINT Toolkit is an all-in-one email domain OSINT and email intelligence actor that enriches any email address or domain with security, deliverability, and infrastructure data — all from free public APIs. Per email it returns RFC 5322 validation, disposable/role/free-email detection, MX reachability, a composite A–F risk score, and 20+ social platform presence checks. Per domain it returns full WHOIS, DNS records (A/AAAA/MX/TXT/SPF/DMARC/DKIM), SSL certificate status with days-to-expiry, and HIBP breach metadata.

This domain email lookup tool requires no API key and costs $0.005 per target — a fraction of commercial tools like Hunter.io ($49+/mo), SecurityTrails ($199/mo), or Whoxy ($150/mo). It covers single targets, bulk CSV lists, and batch API inputs in a single run.

Why use Email & Domain OSINT Toolkit?

Cybersecurity reconnaissance, sales prospecting, and IT operations teams all run the same three lookups — WHOIS, DNS, SSL — plus a breach check. Commercial tools bundle these behind expensive monthly subscriptions. This actor provides the same email intelligence on-demand, billed only per target.

Key business use cases:

• Cybersecurity reconnaissance — Quick WHOIS + DNS + SSL triage on a suspicious domain during phishing or BEC investigations
• Pre-sales prospect verification — Confirm a lead's domain is real, active, and reputable before outreach; detect disposable and role accounts
• Email deliverability screening — Filter disposable, role-account, and catch-all domains before sending campaigns to protect sender reputation
• SSL certificate monitoring — Audit your domain portfolio for certs expiring within 30/60/90 days before they cause outages
• Security triage — Check whether your organization's domains appear in public breach datasets (HIBP)
• B2B lead qualification — Use is_free_email and is_role_account flags to prioritize high-quality business email leads
• Domain email lookup at scale — Bulk-enrich a list of 1,000 prospects for under $5

How to use Email & Domain OSINT Toolkit

1. Open the actor on Apify Store and click Try for free
2. Enter one or more targets in the targets field — accepts email addresses, domains, or a mix
3. For batch runs, use the emails and domains arrays to pass multiple targets at once
4. Toggle skipWhois or skipSsl to speed up large batches where you only need DNS data
5. Optionally add a samplePassword to check it against HIBP Pwned Passwords (k-anonymity — only the first 5 chars of the SHA-1 hash are sent; plaintext never leaves the actor)
6. Click Start — results appear in the dataset within seconds

Default run with { "targets": ["example.com"] } returns WHOIS, full DNS, SSL, and breach data in one row.

Input

Parameter	Type	Default	Description
emails	array	[]	Email addresses for email intelligence checks
email	string	—	Single email (used when emails is empty)
domains	array	[]	Domains for domain email lookup and OSINT enrichment
domain	string	—	Single domain (used when domains is empty)
samplePassword	string	—	Password to check against HIBP (k-anonymity, SHA-1 prefix only)
skipWhois	boolean	false	Skip WHOIS (saves 1–3s per domain; use for speed in large cybersecurity reconnaissance batches)
skipSsl	boolean	false	Skip SSL cert check (saves 0.5–2s per domain)

Output

Email record

{
  "_type": "email",
  "email": "jane@example.com",
  "local_part": "jane",
  "domain": "example.com",
  "risk_score": 0,
  "risk_level": "low",
  "format_valid": true,
  "format_score": "valid",
  "is_disposable": false,
  "is_role_account": false,
  "is_free_email": false,
  "provider": null,
  "mx_reachable": true,
  "email_deliverability_score": 98,
  "catch_all_possible": false,
  "breach_count": 0,
  "fetched_at": "2026-06-10T03:30:00+00:00"
}

Domain record

{
  "_type": "domain",
  "domain": "example.com",
  "company": "Internet Corporation for Assigned Names and Numbers",
  "dns": {
    "a": ["93.184.216.34"],
    "mx": ["0 ."],
    "spf": ["v=spf1 -all"],
    "dmarc": ["v=DMARC1; p=reject;"],
    "dkim_probe": { "selector1": "v=DKIM1;k=rsa;p=MII..." }
  },
  "whois": {
    "registrar": "ICANN",
    "creation_date": "1995-08-14T00:00:00",
    "expiration_date": "2026-08-13T00:00:00",
    "name_servers": ["a.iana-servers.net"]
  },
  "ssl": {
    "common_name": "*.example.com",
    "issuer_cn": "DigiCert Global G3 TLS ECC SHA384 2020 CA1",
    "not_after": "Mar  1 23:59:59 2026 GMT",
    "days_until_expiry": 263
  },
  "hibp_breaches": [],
  "breach_count": 0
}

Data fields

Field	Type	Description
risk_score	integer 0–100	Composite email intelligence risk score (A–F grade)
risk_level	string	low / medium / high based on risk score
is_disposable	boolean	Matched against 250+ known disposable email provider domains
is_role_account	boolean	admin@, noreply@, info@, etc. — not a real person
is_free_email	boolean	Gmail, Yahoo, Outlook — useful for B2B email domain OSINT
mx_reachable	boolean	MX record resolves and responds
email_deliverability_score	integer	0–100 deliverability confidence
catch_all_possible	boolean	Domain accepts all addresses — bounce unpredictable
domain_age_days	integer	Days since WHOIS creation_date — young domains = higher risk
ssl.days_until_expiry	integer	Days before SSL cert expires — key for monitoring
breach_count	integer	Number of HIBP breaches matching this domain
breach_names	array	Names of known breaches
latest_breach_date	string	ISO date of most recent breach

Cost estimation

Pay-Per-Event pricing: $0.005 per target (email or domain). The first 5 targets per run are free.

Scenario	Targets	Charged	Estimated cost
Single email domain OSINT check	2 (email + domain)	0	free
Outreach list of 100 emails	100 emails + 30 domains	125	$0.63
Domain portfolio SSL audit (300 domains)	300	295	$1.48
Full prospect enrichment (1,000 emails)	1,000 + ~200 domains	1,170	$5.85

Compare: SecurityTrails $199/mo, Whoxy $150/mo, Hunter.io $49+/mo. This actor charges per query — no subscription lock-in.

FAQ

Is this legal for cybersecurity reconnaissance use? This actor queries only publicly available data: WHOIS records, public DNS, publicly visible SSL certificates, and HIBP's public breach database. All data sources are free-tier APIs with no authentication requirement. It does not attempt unauthorized access to any system. Users are responsible for ensuring their use complies with applicable laws (e.g. GDPR when processing personal data from emails).

How does the disposable email detection work? The actor checks the email's domain against a curated list of 250+ known disposable email providers (Mailinator, Guerrilla Mail, Temp-Mail, etc.) and applies pattern matching for subdomain variations. This is a static blocklist approach — newly created disposable domains may not yet be included.

Why is the HIBP per-account breach check not included? The HIBP per-email lookup (/breachedaccount/) requires a paid API key ($3.95/month). This actor uses the free endpoints only: the k-anonymity Pwned Passwords API for password safety checks, and the public /breaches list for domain email lookup breach metadata. Per-account lookup is on the roadmap for a future version with optional API key input.

Disclaimer: This tool is intended for legitimate cybersecurity reconnaissance, IT security operations, and sales intelligence use cases. Do not use it to stalk, harass, or unlawfully surveil individuals. All data returned is publicly available through standard internet protocols. The author is not responsible for misuse.

---

Limitations

• WHOIS coverage varies by TLD. Some ccTLDs (.cn, .jp) hide registrant info or require RDAP
• DKIM probe tries 5 common selectors — custom selectors will not be detected
• HIBP per-email breach check (paid API) is not included; only domain-level breach metadata is returned

---

Related actors

• Crypto Address Sanctions Checker — On-chain equivalent for cybersecurity reconnaissance
• Wallet Label Lookup
• HTML Metadata Extractor
• Sitemap URL Discovery

---

A short review helps security and sales teams find this email domain OSINT tool: Leave a review on Apify Store