SaaS Footprint from DNS: Tools a Company Uses

See which SaaS tools a company uses, from its public DNS records alone. Give it company domains and get one row each: the vendors implied by verification TXT tokens, SPF includes, the MX mail provider and the CNAMEs of help, status and careers subdomains, with the exact record that proves each vendor. No API key, no login, no proxy.

Who uses it: sales and RevOps teams building tech-stack lists for outbound, security and vendor-risk teams mapping a supplier's third parties, and competitive analysts checking what a rival's stack looks like.

What you get per domain: vendors (name, category, evidence), vendorNames, a count per category, the mail provider, every SPF include, and an "unmapped" bucket for vendor-looking tokens the map does not know. A vendor is only named when a record matches the hand-maintained map; nothing is guessed.

Price: billed per domain that returns at least one vendor. A domain that does not exist, or whose DNS shows no known SaaS signal, comes back as a free found:false row.

How to use

1. In the Apify Console. Open the actor page and click Start — the domains field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. Via the API. Call it directly with a POST request — no Console needed once you have an API token:

   curl "https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"domains":["stripe.com","notion.so","vercel.com"]}'
   

3. On a schedule. Save this actor as an Apify Task with the input you want, then add a Schedule (hourly, daily, weekly) so it runs on its own — no server of your own required.

Input

{
  "domains": [
    "stripe.com",
    "notion.so",
    "vercel.com"
  ]
}

One company domain per line. A URL, a www. prefix or an email address also works; it is reduced to the domain. Accepted formats: stripe.com, https://www.notion.so/pricing, ceo@vercel.com.

One dataset row per domain. Rows with "found": false are never charged.

Output

One row per item, for example:

query	found	status	domain	vendorCount	vendorNames	vendors	categories	mailProvider	spfIncludes	hasDmarc	txtRecordCount	mapCoverage	unmappedTxtPrefixes	subdomainsChecked	sourceUrl	scrapedAt
stripe.com	true	OK										<token map coverage (0-1)>				1970-01-01T00:00:00.000Z

A miss comes back as a row with "found": false and is never charged.

Pricing

• Domain profiled: $8 per 1,000 domains

Plus a $0.002 start fee per run. Each event above is billed independently, only when it actually returns data — misses (found:false) are never charged.

What the signals mean

• TXT verification tokens. Vendors ask you to publish a record like canva-site-verification=... to prove you own the domain. The prefix identifies the vendor; the token value is never output.
• SPF includes. include: entries list the services allowed to send mail for the domain (a marketing platform, a help desk, a transactional sender).
• MX hosts. The mail provider and any mail-security gateway in front of it.
• CNAMEs. help., support., status., careers. and similar subdomains that point at a hosted vendor. Turn this off with checkSubdomains to use 3 DNS requests per domain instead of 16.

DNS only shows tools that need a domain record. It will not show tools a company uses without ever touching DNS, so treat the list as a floor, not a full inventory. mapCoverage tells you what share of vendor-looking TXT tokens the map could name.

Example runs

Paste any of these into the Input tab and press Start. All three return rows with no key, no token and no account of your own beyond an Apify login.

Three well-known software companies. The default prefill.

{
  "domains": ["stripe.com", "notion.so", "vercel.com"]
}

A pasted list with URLs and an email address, TXT, SPF and MX only.

{
  "domains": ["https://www.linear.app/pricing", "ceo@figma.com", "canva.com"],
  "checkSubdomains": false
}

A prospect list, only domains that returned vendors, three columns.

{
  "domains": ["shopify.com", "atlassian.com", "zapier.com", "this-domain-does-not-exist-12345.com"],
  "onlyFound": true,
  "columns": ["domain", "vendorCount", "vendorNames"]
}

Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

curl "https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"domains":["stripe.com","notion.so","vercel.com"]}'

n8n. Add an HTTP Request node: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body Content Type JSON, JSON Body {"domains":["stripe.com","notion.so","vercel.com"]} (swap in an expression from an earlier node for a real value).

Clay. Add an "HTTP API" column: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body {"domains":["{{domain}}"]}, mapping the row's domain into the domains array.

MCP. In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "saas footprint lookup" — the agent will find and run this actor.