SaaS Stack & Email Provider Detector: M365, Okta, HubSpot

Give a company domain (or a work email) and see the SaaS it runs, read from its public DNS. You get the email provider (Microsoft 365, Google Workspace, Zoho...), the email security gateway in front of it (Proofpoint, Mimecast, Barracuda...), the Microsoft 365 tenant name, DMARC policy and reporting vendor, every service allowed to send email as the domain (HubSpot, Marketo, Salesforce, SendGrid, Zendesk...), the SaaS its admins verified (Atlassian, DocuSign, Okta, Zoom, Slack, Adobe, OpenAI, Anthropic, Stripe...), and the vendors behind standard subdomains (help → Zendesk, status → Statuspage, careers → Greenhouse, go → Marketo, login → Okta, www → Webflow / WP Engine).

Why DNS: website tech detectors only see what loads on the homepage. A company's internal stack (email, security, identity, collaboration, AI tools, HR and recruiting) never appears there, but it leaves records in DNS. It's read-only DNS-over-HTTPS, so nothing is sent to the company. A domain takes 1-3 seconds.

📋 What you get (per company)

Field	What it is
emailProvider	Microsoft 365, Google Workspace, Zoho, Proton, Fastmail, GoDaddy, Rackspace... Inferred even behind a gateway ("Microsoft 365 (behind Proofpoint)")
emailSecurityGateway	Proofpoint, Mimecast, Barracuda, Cisco IronPort, Broadcom/Symantec, Trend Micro, Sophos, Trellix, Hornetsecurity...
microsoftTenant	The *.onmicrosoft.com tenant name, when DKIM reveals it
dmarc	Policy (none / quarantine / reject) and reporting vendor (Valimail, dmarcian, Proofpoint EFD, Red Sift, EasyDMARC...)
vendors	Every detected vendor: name, category, evidence (the exact record), confidence
stack	Vendors grouped: productivity, emailSecurity, identity, collaboration, ai, marketingAutomation, crm, emailSending, support, recruiting, hr, devTools, security, hosting, website, payments, eSignature...
verificationRecords	SaaS with a domain-verification TXT record (admin-level adoption)
subdomains	help / status / docs / careers / go / login / www... with their CNAME and vendor
dkimSelectors	DKIM selectors found (confirmed sending services)
dnsProvider	Cloudflare, Route 53, Azure DNS, GoDaddy, MarkMonitor / CSC (corporate registrars)...
itMaturity	basic / standard / advanced, from security gateway, SSO, DMARC enforcement and security tools
signals	Sales-ready one-liners: "Email on Microsoft 365 (behind Proofpoint)", "No DMARC record", "SSO: Okta", "AI tools verified: OpenAI, Anthropic"

📥 Input

Field	What it does
domains	Company domains or websites, e.g. ["stripe.com", "atlassian.com"]
emails	Work emails. The domain is taken from each address, and free-mail addresses (gmail.com, outlook.com...) are skipped for free
datasetId	Any dataset with a domain / website / url / email / companyDomain field (CRM export, LinkedIn or Maps scraper run...)
emailProvider	Keep only microsoft, google or other
requireVendors	Keep companies using any of these, e.g. ["Okta"], ["Proofpoint", "Mimecast"]
excludeVendors	Drop companies using any of these (e.g. your own product)
includeSubdomains	Return the vendor-hosted subdomain list (default on)

Example: which of my leads are on Microsoft 365?

{ "emails": ["jane@acme.com", "bob@initech.com", "sue@globex.com"], "emailProvider": "microsoft" }

Example: companies behind Proofpoint or Mimecast (email-security displacement)

{ "datasetId": "<your company list>", "requireVendors": ["Proofpoint", "Mimecast"] }

📤 Output (one row per company, shortened)

{
  "domain": "stripe.com",
  "emailProvider": "Google Workspace",
  "emailSecurityGateway": null,
  "dmarc": {"policy": "reject", "reportingVendor": null},
  "vendorsCount": 21,
  "vendors": [
    {"name": "Anthropic (Claude for Work)", "category": "ai", "confidence": "high",
     "evidence": ["TXT anthropic-domain-verification-zk7x9c=QfN52ECybLPUWh51R9pKF0Q"]},
    {"name": "Qualtrics", "category": "analytics", "confidence": "high", "evidence": ["SPF include:_spf.qualtrics.com"]},
    {"name": "SendGrid (Twilio)", "category": "emailSending", "confidence": "high",
     "evidence": ["DKIM s1._domainkey -> s1.domainkey.u2342.wl.sendgrid.net"]}
  ],
  "stack": {
    "ai": ["OpenAI (ChatGPT Enterprise / API)", "Anthropic (Claude for Work)"],
    "collaboration": ["Atlassian (Jira / Confluence)", "Whimsical"],
    "support": ["Zendesk", "Intercom"],
    "emailSending": ["SendGrid (Twilio)", "Mailchimp Mandrill"],
    "eSignature": ["DocuSign"],
    "hosting": ["Vercel", "Fastly"]
  },
  "dnsProvider": "Amazon Route 53",
  "itMaturity": "standard",
  "signals": ["Email on Google Workspace", "AI tools verified: OpenAI (ChatGPT Enterprise / API), Anthropic (Claude for Work)"]
}

A Microsoft 365 company also shows its tenant, for example "microsoftTenant": "deathwishcoffee" and "emailProvider": "Microsoft 365 (behind Barracuda)".

💰 Pricing (pay-per-event)

• Domain profiled: $0.005 per company domain that resolves ($5 per 1,000).
• Free: free-mail addresses, non-existent domains and failed lookups.
• Vendor and provider filters run after the lookup, so every resolved domain is billed.

💡 Use cases

• MSPs and IT resellers: find Google Workspace companies to migrate (or the reverse), and companies with no email security gateway or no DMARC.
• Email security and DMARC vendors: displacement lists (on Proofpoint, Mimecast, Barracuda), and domains with no DMARC or p=none.
• B2B SaaS sales: who runs Okta, HubSpot vs Marketo vs Pardot, Zendesk vs Intercom, Greenhouse vs Lever, and who has already verified OpenAI or Anthropic (AI-adoption signal).
• Lead enrichment: turn a list of work emails into each company's stack in one pass.
• Security research and vendor due diligence: a company's third-party SaaS footprint from public records.

🚀 Ready-made tasks

• Microsoft 365 or Google Workspace? (Email Provider Lookup)
• Email Security Gateway Detector (Proofpoint, Mimecast)
• Company SaaS Stack from Work Emails

🔌 API, Standby and agents

Instant lookup (Standby):

curl "https://centorprat--saas-stack-email-provider-detector.apify.actor/?domain=stripe.com&token=<YOUR_APIFY_TOKEN>"
curl "https://centorprat--saas-stack-email-provider-detector.apify.actor/?emails=jane@acme.com&includeSubdomains=false&token=<YOUR_APIFY_TOKEN>"

Python

from apify_client import ApifyClient
client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("centorprat/saas-stack-email-provider-detector").call(run_input={"domains": ["stripe.com"]})
for c in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(c["domain"], c["emailProvider"], c["stack"].get("identity"), c["signals"])

MCP

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=actors,docs,centorprat/saas-stack-email-provider-detector"
    }
  }
}

Claude Code: claude mcp add --transport http apify "https://mcp.apify.com/?tools=actors,docs,centorprat/saas-stack-email-provider-detector" --header "Authorization: Bearer <YOUR_APIFY_TOKEN>"

❓ FAQ

Is a verification record proof that the company uses the tool? It's proof that an admin verified the domain with that vendor, usually to set up SSO, a team or an enterprise workspace. It's a strong adoption signal; the evidence field shows the exact record.

How is the email provider found behind a gateway? The MX points to the gateway (Proofpoint, Mimecast...), so the mailbox provider is inferred from SPF includes, Microsoft verification and DKIM records, and Exchange autodiscover.

What about wildcard DNS? Some domains answer every name. The Actor probes a random name first and ignores results that only match the wildcard (wildcardDns: true).

Does it contact the company? No. Every query goes to public DNS-over-HTTPS resolvers (Google, Cloudflare fallback). Nothing is sent to the company's servers.

How fast? About 1-3 seconds per domain, 6 in parallel by default.

Is it legal? It reads public DNS records, the same data any mail server reads when it receives an email.

📜 Data & attribution

Public DNS only, via DNS-over-HTTPS. Vendor names are trademarks of their owners and are reported only as detected DNS records.

🔗 Related actors

• Domain Lookup API - DNS, MX, SPF, Tech & Contact Emails: DNS + live homepage → IPs, MX/SPF, tech, socials and public contacts per domain.
• Shopify App Detector: Tech Stack, Pixels & Theme: every app a Shopify store runs, with evidence, estimated app spend and change tracking.
• Company Hiring Monitor: every open role from a company's own careers board, with hiring trends.