DNS Lookup - Bulk MX, SPF, DMARC, Reverse DNS & DNSSEC

What does DNS Lookup do?

DNS Lookup resolves the full DNS record set for any list of domains in a single run. It returns A, AAAA, MX, TXT, CNAME, NS, SOA and CAA records, reverse DNS (PTR) for every resolved IP, and DNSSEC status, with per-record-type control. Turn on the email-auth check for an SPF, DMARC and DKIM grade, including the SPF 10-DNS-lookup limit. Paste bare domains or full URLs — they're auto-cleaned to the apex. Turn on monitoring to detect DNS changes over time. WHOIS, SSL, HTTP and blacklist checks are available too for a full domain audit.

New to Apify? Sign up free and use the included $5 monthly platform credit to test this actor.

Key features

• 📇 All record types — A, AAAA, MX (priority-sorted), TXT, CNAME, NS, SOA and CAA resolved for every domain, with per-type selection so you fetch only what you need.
• ↩️ Reverse DNS (PTR) — every IPv4 and IPv6 address the domain resolves to is looked up in reverse, so you see the hosting provider's hostname next to the IP.
• ✉️ SPF, DMARC & DKIM checker — email-auth check parses SPF (including the RFC 7208 10-DNS-lookup limit, followed through every include), DMARC policy and common DKIM selectors, and grades each domain A–F.
• 🔐 DNSSEC status — checks whether each domain is DNSSEC-signed (validated AD flag), the signal registrars and security teams look for.
• ♻️ DNS change monitoring — incremental mode flags NEW / UPDATED domains and detects record changes (new A records, MX moves, TXT edits) since the previous run.
• ⚡ Fast bulk resolution — native resolver, high concurrency, no browser — resolve hundreds of domains per run.
• 🧩 Full audit option — enable WHOIS, SSL/TLS, HTTP and email-authentication checks for complete domain data alongside the DNS records.
• 🔔 Notifications — push new findings to Telegram, Discord, Slack, WhatsApp or a generic webhook (n8n / Make / Zapier).
• 📦 Compact + MCP output — a compact at-a-glance mode and MCP-connector export for AI-agent and automation workflows.

What data can you get for each domain?

Each result includes Core domain fields (domain, inputUrl, securityScore, flags, dns, whois, ssl, and http, and more) and contact information (emailGrade and emailAuth). In standard mode, all fields are always present — unavailable data points are returned as null, never omitted. In compact mode, only core fields are returned.

Input

The main inputs are a result limit. Additional filters and options are available in the input schema.

Key parameters:

• domains — Domains or full URLs to inspect — one per line, or paste a JSON array. Full URLs are auto-cleaned to the apex domain (https://www.example.com/path → example.com).
• checks — Which inspections to run per domain. Defaults to DNS records only; enable WHOIS/SSL/HTTP/email/blacklist too for a full audit. (default: ["dns"])
• recordTypes — Which DNS record types to resolve when the DNS check is enabled. PTR is reverse DNS: the hostname behind every A/AAAA address found. (default: ["A","AAAA","MX","TXT","CNAME","NS","SOA","CAA","PTR"])
• dkimSelectors — DKIM cannot be enumerated, so common selectors (default, google, selector1/2, k1…) are probed automatically. Add your ESP's selector here to catch custom setups. (default: [])
• timeoutMs — Timeout for each individual DNS/WHOIS/SSL/HTTP lookup. (default: 8000)
• compact — At-a-glance verdict only (domain, security score, email grade, flags) — drops the raw record blocks. Ideal for AI-agent / MCP workflows. (default: false)
• excludeEmptyFields — Drop null, empty-string, and empty-array fields from each record before push. Smaller payloads for AI agents and dashboards. (default: false)
• incrementalMode — Compare each domain against the previous run and flag changes (NEW / UPDATED / UNCHANGED). Detects cert renewals, WHOIS expiry, DNS changes, email-auth drift and blacklist appearances over time. stateKey is optional — defaults to a stable key derived from the domain list + checks. (default: false)
• stateKey — Optional. Stable identifier for the monitored domain set. Leave empty to auto-generate from the domain list + checks.
• emitUnchanged — When monitoring, also output domains whose signals did not change since the last run. Off = only NEW and UPDATED domains are emitted. (default: false)
• telegramToken — Telegram bot token (from @BotFather). Required for Telegram notifications.
• telegramChatId — Telegram chat or channel ID (e.g. "-100123456789"). Required when telegramToken is set.
• ...and 13 more parameters

Input examples

Resolve DNS records for a list of domains — Paste bare domains or full URLs and pick the record checks you need.

→ One record per domain with the selected record types resolved.

{
  "domains": [
    "github.com",
    "cloudflare.com"
  ],
  "checks": [
    "dns"
  ]
}

Incremental change monitoring — Only emit domains whose DNS records changed since the previous run with this stateKey.

→ First run builds the baseline; later runs emit only new or changed domains.

{
  "domains": [
    "github.com",
    "cloudflare.com"
  ],
  "checks": [
    "dns"
  ],
  "incrementalMode": true,
  "stateKey": "dns-tracker"
}

Compact output for AI agents — Return only core fields for AI-agent and MCP workflows.

→ Small payload with the most important fields — ideal for piping into LLMs without token overhead.

{
  "domains": [
    "github.com",
    "cloudflare.com"
  ],
  "checks": [
    "dns"
  ],
  "compact": true
}

Output

Each run produces a dataset of structured domain records. Results can be downloaded as JSON, CSV, or Excel from the Dataset tab in Apify Console.

Example domain record

{
  "domain": "github.com",
  "inputUrl": "github.com",
  "securityScore": 96,
  "emailGrade": "A",
  "dns": {
    "records": {
      "A": [
        "140.82.121.3"
      ],
      "NS": [
        "dns1.p08.nsone.net",
        "dns2.p08.nsone.net",
        "dns3.p08.nsone.net",
        "dns4.p08.nsone.net",
        "ns-1283.awsdns-32.org",
        "... 3 more items"
      ],
      "SOA": [
        {
          "nsname": "ns-1707.awsdns-21.co.uk",
          "hostmaster": "awsdns-hostmaster.amazon.com",
          "serial": 1,
          "refresh": 7200,
          "retry": 900,
          "expire": 1209600,
          "minttl": 86400
        }
      ],
      "MX": [
        {
          "priority": 0,
          "exchange": "github-com.mail.protection.outlook.com"
        }
      ],
      "CAA": [
        {
          "critical": 0,
          "issue": "digicert.com"
        },
        {
          "critical": 0,
          "issue": "globalsign.com"
        },
        {
          "critical": 0,
          "issue": "letsencrypt.org"
        },
        {
          "critical": 0,
          "issue": "sectigo.com"
        },
        {
          "critical": 0,
          "issuewild": "digicert.com"
        },
        "... 2 more items"
      ],
      "TXT": [
        "00Dd0000000hHE0=1TBKg000000TN2r",
        "MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805",
        "MS=ms44452932",
        "MS=ms58704441",
        "TAILSCALE-xOzoDvFUzZr5YYVCQFuD",
        "... 19 more items"
      ],
      "PTR": [
        {
          "ip": "140.82.121.3",
          "hostnames": [
            "lb-140-82-121-3-fra.github.com"
          ]
        }
      ]
    },
    "dnssec": false,
    "errors": {
      "AAAA": "ENODATA",
      "CNAME": "ENODATA"
    }
  },
  "whois": {
    "raw": "Domain Name: github.com\r\nRegistry Domain ID: 1264983250_DOMAIN_COM-VRSN\r\nRegistrar WHOIS Server: whois.markmonitor.com\r\nRegistrar Registration Expiration Date: 2028-10-09T18:20:50.000+00:00\r\nRegistry...",
    "server": "whois.markmonitor.com",
    "registrar": "Markmonitor Inc.",
    "createdDate": "2007-10-09T18:20:50.000+00:00",
    "updatedDate": "2026-09-07T09:22:52.000+00:00",
    "expiryDate": "2028-10-09T18:20:50.000+00:00",
    "nameServers": [
      "dns1.p08.nsone.net",
      "dns2.p08.nsone.net",
      "dns3.p08.nsone.net",
      "dns4.p08.nsone.net",
      "ns-1283.awsdns-32.org",
      "... 3 more items"
    ],
    "status": [
      "clientUpdateProhibited",
      "clientTransferProhibited",
      "clientDeleteProhibited",
      "active"
    ],
    "daysToExpiry": 696
  },
  "ssl": {
    "ok": true,
    "subject": "github.com",
    "issuer": "Sectigo Limited",
    "altNames": [
      "github.com",
      "www.github.com"
    ],
    "validFrom": "Oct 30 00:00:00 2026 GMT",
    "validTo": "Jan 27 23:59:59 2027 GMT",
    "daysToExpiry": 75,
    "expired": false,
    "certSha256": "7D:C4:D8:5C:F1:E3:10:97:12:25:BC:9A:92:57:67:90:43:A2:43:D7:0A:3C:C2:A9:1C:C5:D3:89:89:2C:27:76",
    "protocol": "TLSv1.3"
  },
  "http": {
    "http": {
      "status": 200,
      "finalUrl": "https://github.com/",
      "redirected": true,
      "server": "github.com"
    },
    "https": {
      "status": 200,
      "finalUrl": "https://github.com/",
      "redirected": false,
      "server": "github.com"
    },
    "upgradesToHttps": true
  },
  "emailAuth": {
    "hasMx": true,
    "spf": {
      "found": true,
      "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net...",
      "all": "~all",
      "includes": [
        "spf.protection.outlook.com",
        "_netblocks.google.com",
        "_netblocks2.google.com",
        "mail.zendesk.com",
        "_spf.salesforce.com",
        "... 3 more items"
      ],
      "dnsLookups": 10,
      "lookupLimitExceeded": false,
      "verdict": "pass"
    },
    "dmarc": {
      "found": true,
      "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
      "policy": "quarantine",
      "pct": 100,
      "rua": [
        "mailto:dmarc@github.com"
      ],
      "verdict": "pass"
    },
    "dkim": {
      "selectorsChecked": [
        "default",
        "google",
        "selector1",
        "selector2",
        "k1",
        "... 8 more items"
      ],
      "found": [
        "google",
        "selector1",
        "k2"
      ],
      "verdict": "pass"
    },
    "dnssec": false,
    "score": 90,
    "grade": "A"
  },
  "blacklist": {
    "ip": "140.82.121.3",
    "checked": [
      "zen.spamhaus.org",
      "b.barracudacentral.org",
      "dnsbl.sorbs.net",
      "dbl.spamhaus.org"
    ],
    "note": "best-effort; datacenter resolvers may be refused by some zones"
  },
  "checkedAt": "2026-11-13T16:50:28.702Z",
  "source": "dns-lookup"
}

Incremental fields

When incremental mode is on, each record also carries:

• changeType — one of NEW, UPDATED, UNCHANGED, REAPPEARED. Default output covers NEW / UPDATED / REAPPEARED; set emitUnchanged: true to opt into the others.

How to audit domains

1. Go to DNS Lookup in Apify Console.
2. Paste your domains (bare domains or full URLs) into Domains.
3. Pick the Checks to run and the DNS record types — including PTR for reverse DNS. Select all six checks for a full audit.
4. Optionally set maxResults to cap how many domains are inspected (0 = all).
5. Click Start and wait for the run to finish.
6. Export the dataset as JSON, CSV, or Excel.

Use cases

• Bulk-resolve DNS records for a large list of domains for inventory, auditing or migration verification.
• Verify a DNS migration or propagation by comparing record sets across domains, and monitor for changes over time.
• Check MX and TXT records across many domains to validate mail routing and verification tokens.
• Audit CAA and DNSSEC coverage across a domain portfolio as a security-hygiene signal.
• Combine with WHOIS, SSL and email-auth checks for a full security-posture review of a domain portfolio.

How much does it cost to audit domains?

DNS Lookup uses pay-per-event pricing. You pay a small fee when the run starts and then for each result that is actually produced.

• Run start: $0.00005 per run
• Per result: $0.001 per domain record

Example costs:

• 10 results: $0.01
• 25 results: $0.025
• 100 results: $0.1
• 200 results: $0.2
• 500 results: $0.5

Example: recurring monitoring savings

These examples compare full re-scrapes with incremental runs at different churn rates. Churn is the share of domains that are new or whose tracked content changed since the previous run. Actual churn depends on your query breadth, source activity, and polling frequency — the scenarios below are examples, not predictions.

Example setup: 250 domains per run, daily polling (30 runs/month). Costs scale linearly with the number of domains.

Churn rate	Full re-scrape run cost	Incremental run cost	Savings vs full re-scrape	Monthly cost after baseline
5% — stable niche query	$0.25	$0.01	$0.24 (95%)	$0.38
15% — moderate broad query	$0.25	$0.04	$0.21 (85%)	$1.13
30% — high-volume aggregator	$0.25	$0.08	$0.17 (70%)	$2.25

Full re-scrape monthly cost at the same cadence: $7.50. First month with incremental costs $0.61 / $1.34 / $2.43 for the 5% / 15% / 30% scenarios because the first run builds baseline state at full cost before incremental savings apply.

Platform usage is included in the per-result fee shown above.

Run limits: A run stops on its own after 12 hours if you set no timeout or a timeout longer than 12 hours. It also stops if it finds no new results for 60 minutes. Results collected before the stop are saved in your dataset.

FAQ

How many domains can I check per run?

Every domain in your input list is checked — there is no fixed cap, so the number of domains per run is limited only by your list size and the run's time budget.

Does DNS Lookup support recurring monitoring?

Yes. Enable incremental mode to only receive new or changed domains on subsequent runs. This is ideal for scheduled monitoring where you want to track changes over time without re-processing the full dataset.

Can I integrate DNS Lookup with other apps?

Yes. DNS Lookup works with Apify's integrations to connect with tools like Zapier, Make, Google Sheets, Slack, and more. You can also use webhooks to trigger actions when a run completes.

Can I use DNS Lookup with the Apify API?

Yes. You can start runs, manage inputs, and retrieve results programmatically through the Apify API. Client libraries are available for JavaScript, Python, and other languages.

Can I use DNS Lookup through an MCP Server?

Yes. Apify provides an MCP Server that lets AI assistants and agents call this actor directly. Use compact mode and excludeEmptyFields to keep payloads manageable for LLM context windows.

Is it legal to audit domains?

This actor queries publicly available data for the domains you provide. You remain responsible for ensuring your use complies with applicable laws, source terms, and downstream obligations.

Your feedback

If you have questions, need a feature, or found a bug, please open an issue on the actor's page in Apify Console. Your feedback helps us improve.

You might also like

• Domain Intelligence Scraper — All-in-one domain audit: DNS, WHOIS, SSL, HTTP, email authentication and blacklist checks with a.
• Email Deliverability Checker — SPF, DMARC, DKIM and DNSSEC audit with an A-F inbox-readiness grade for sending domains.
• SSL Certificate Monitor — Bulk SSL/TLS certificate check: issuer, expiry, chain validity and SANs with expiring-soon alerts.

Getting started with Apify

New to Apify? Create a free account with $5 credit — no credit card required.

1. Sign up — $5 platform credit included
2. Open this actor and configure your input
3. Click Start — export results as JSON, CSV, or Excel

Need more later? See Apify pricing.

Disclaimer

This actor accesses only publicly available data on dns lookup. You are responsible for how you use the extracted data — in particular any personal information such as names, phone numbers, or email addresses — and for complying with DNS Lookup's terms of use, applicable data-protection law (including the GDPR where it applies), and the anti-spam rules of your jurisdiction.

This actor is an independent tool and is not affiliated with, endorsed by, or sponsored by DNS Lookup or any of its subsidiaries. All trademarks mentioned are the property of their respective owners.

Search keywords

dns lookup scraper, dns lookup api, apify dns lookup, dns lookup data extraction.