# SaaS Footprint from DNS: Tools a Company Uses (`accountable_eel/saas-footprint-from-dns-lookup`) Actor

Find which SaaS tools a company uses from its public DNS records. For each domain, read the verification TXT tokens, SPF includes, MX provider and help, status and careers CNAMEs, and get the vendors they imply, with the record that proves each one. No API key.

- **URL**: https://apify.com/accountable_eel/saas-footprint-from-dns-lookup.md
- **Developed by:** [Adriana Voss](https://apify.com/accountable_eel) (community)
- **Categories:** Lead generation, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $4.00 / 1,000 domain profileds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SaaS Footprint from DNS: Tools a Company Uses

**See which SaaS tools a company uses, from its public DNS records alone.** Give it company domains and get one row each: the vendors implied by verification TXT tokens, SPF includes, the MX mail provider and the CNAMEs of help, status and careers subdomains, with the exact record that proves each vendor. No API key, no login, no proxy.

**Who uses it:** sales and RevOps teams building tech-stack lists for outbound, security and vendor-risk teams mapping a supplier's third parties, and competitive analysts checking what a rival's stack looks like.

**What you get per domain:** `vendors` (name, category, evidence), `vendorNames`, a count per category, the mail provider, every SPF include, and an "unmapped" bucket for vendor-looking tokens the map does not know. A vendor is only named when a record matches the hand-maintained map; nothing is guessed.

**Price:** billed per domain that returns at least one vendor. A domain that does not exist, or whose DNS shows no known SaaS signal, comes back as a free `found:false` row.

### How to use

1. **In the Apify Console.** Open the actor page and click **Start** — the `domains` field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. **Via the API.** Call it directly with a POST request — no Console needed once you have an API token:
   ```bash
   curl "https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"domains":["stripe.com","notion.so","vercel.com"]}'
   ```
3. **On a schedule.** Save this actor as an Apify **Task** with the input you want, then add a **Schedule** (hourly, daily, weekly) so it runs on its own — no server of your own required.

### Input

```json
{
  "domains": [
    "stripe.com",
    "notion.so",
    "vercel.com"
  ]
}
```

One company domain per line. A URL, a www. prefix or an email address also works; it is reduced to the domain. Accepted formats: stripe.com, https://www.notion.so/pricing, ceo@vercel.com.

One dataset row per domain. Rows with `"found": false` are never charged.

### Output

One row per item, for example:

| query | found | status | domain | vendorCount | vendorNames | vendors | categories | mailProvider | spfIncludes | hasDmarc | txtRecordCount | mapCoverage | unmappedTxtPrefixes | subdomainsChecked | sourceUrl | scrapedAt |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| stripe.com | true | OK | <domain> | <saas vendors found> | <vendor names> | <vendors with evidence> | <vendors per category> | <mail provider> | <spf includes> | <has dmarc record> | <txt records> | \<token map coverage (0-1)> | <unmapped txt prefixes> | <subdomains checked for cnames> | <source> | 1970-01-01T00:00:00.000Z |

A miss comes back as a row with `"found": false` and is never charged.

### Pricing

- **Domain profiled**: $8 per 1,000 domains

Plus a $0.002 start fee per run. Each event above is billed independently, only when it actually returns data — misses (`found:false`) are never charged.

### What the signals mean

- **TXT verification tokens.** Vendors ask you to publish a record like `canva-site-verification=...` to prove you own the domain. The prefix identifies the vendor; the token value is never output.
- **SPF includes.** `include:` entries list the services allowed to send mail for the domain (a marketing platform, a help desk, a transactional sender).
- **MX hosts.** The mail provider and any mail-security gateway in front of it.
- **CNAMEs.** `help.`, `support.`, `status.`, `careers.` and similar subdomains that point at a hosted vendor. Turn this off with `checkSubdomains` to use 3 DNS requests per domain instead of 16.

DNS only shows tools that need a domain record. It will not show tools a company uses without ever touching DNS, so treat the list as a floor, not a full inventory. `mapCoverage` tells you what share of vendor-looking TXT tokens the map could name.

### Example runs

Paste any of these into the Input tab and press Start. All three return rows with no key, no token
and no account of your own beyond an Apify login.

**Three well-known software companies.** The default prefill.

```json
{
  "domains": ["stripe.com", "notion.so", "vercel.com"]
}
```

**A pasted list with URLs and an email address, TXT, SPF and MX only.**

```json
{
  "domains": ["https://www.linear.app/pricing", "ceo@figma.com", "canva.com"],
  "checkSubdomains": false
}
```

**A prospect list, only domains that returned vendors, three columns.**

```json
{
  "domains": ["shopify.com", "atlassian.com", "zapier.com", "this-domain-does-not-exist-12345.com"],
  "onlyFound": true,
  "columns": ["domain", "vendorCount", "vendorNames"]
}
```

### Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

```bash
curl "https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"domains":["stripe.com","notion.so","vercel.com"]}'
```

**n8n.** Add an HTTP Request node: Method `POST`, URL `https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>`, Body Content Type `JSON`, JSON Body `{"domains":["stripe.com","notion.so","vercel.com"]}` (swap in an expression from an earlier node for a real value).

**Clay.** Add an "HTTP API" column: Method `POST`, URL `https://api.apify.com/v2/acts/accountable_eel~saas-footprint-from-dns-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>`, Body `{"domains":["{{domain}}"]}`, mapping the row's domain into the `domains` array.

**MCP.** In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "saas footprint lookup" — the agent will find and run this actor.

# Actor input Schema

## `domains` (type: `array`):

One company domain per line. A URL, a www. prefix or an email address also works; it is reduced to the domain. Accepted formats: stripe.com, https://www.notion.so/pricing, ceo@vercel.com. You're only charged for the ones we actually find — a miss costs nothing.

## `testRun` (type: `boolean`):

Turn this on to test your input on a small sample before running the full list. Turn it off to process everything.

## `onlyFound` (type: `boolean`):

Only keep rows where something was actually found. Misses are always free, whether or not you show them here.

## `includeKeywords` (type: `array`):

Optional. Only keep results that mention at least one of these words (e.g. a job title, a city, a product name). Leave empty to keep everything.

## `excludeKeywords` (type: `array`):

Optional. Drop any result that mentions one of these words. Leave empty to skip nothing.

## `maxResults` (type: `integer`):

Optional. Stop the run once this many results have been found — useful for a quick, cheap sample. Leave blank for no limit.

## `checkSubdomains` (type: `boolean`):

Looks up help., support., docs., status., blog., shop., careers., jobs., go., email., em., mail., link. and community. for a CNAME that points at a known SaaS host (a help desk, a status page, a careers board). Turn off to use only the domain's TXT, SPF and MX records: 3 DNS requests per domain instead of 16.

## `columns` (type: `array`):

Choose which pieces of information to include in each result row. All are included by default.

## `maxConcurrency` (type: `integer`):

Parallel requests. Keep conservative — this target has no browser fallback, so getting blocked costs more than slow-and-steady.

## Actor input object example

```json
{
  "domains": [
    "stripe.com",
    "notion.so",
    "vercel.com"
  ],
  "testRun": false,
  "onlyFound": false,
  "includeKeywords": [],
  "excludeKeywords": [],
  "checkSubdomains": true,
  "columns": [
    "domain",
    "vendorCount",
    "vendorNames",
    "vendors",
    "categories",
    "mailProvider",
    "spfIncludes",
    "hasDmarc",
    "txtRecordCount",
    "mapCoverage",
    "unmappedTxtPrefixes",
    "subdomainsChecked",
    "sourceUrl"
  ],
  "maxConcurrency": 3
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "stripe.com",
        "notion.so",
        "vercel.com"
    ],
    "includeKeywords": [],
    "excludeKeywords": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("accountable_eel/saas-footprint-from-dns-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "stripe.com",
        "notion.so",
        "vercel.com",
    ],
    "includeKeywords": [],
    "excludeKeywords": [],
}

# Run the Actor and wait for it to finish
run = client.actor("accountable_eel/saas-footprint-from-dns-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "stripe.com",
    "notion.so",
    "vercel.com"
  ],
  "includeKeywords": [],
  "excludeKeywords": []
}' |
apify call accountable_eel/saas-footprint-from-dns-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,accountable_eel/saas-footprint-from-dns-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/GAHdndhkBFYAL8THg/builds/7tS3gAnocgMaHVE7l/openapi.json