DomainDNA: Tech Stack Lookup, Email Security & Domain Age API

Everything a domain gives away, in one JSON record. What it runs on, who handles its email, whether its DMARC is locked down, how old it is and when its certificate expires, in about 1 second for $0.004 per domain.

Why DomainDNA

• One call instead of five lookups. Tech stack, MX/SPF/DMARC, RDAP registration and domain age, TLS certificate and security headers come back together, plus a one-line summary an LLM can quote.
• Evidence you can check. Every detected technology shows the header, cookie or script that triggered it, so you're not relying on a guess.
• Fast and cheap at scale. There's no browser and no proxy, so most domains finish in about 1 second. Domains that don't resolve are not charged.

Example summary:

shopify.com: runs Shopify, email on Google Workspace, DMARC p=reject, domain 21y old, TLS expires in 60d.

What you get

Give it a list of domains. For each one you get one compact JSON record with:

• Tech stack (100+ fingerprints): CMS and site builders (WordPress, Webflow, Wix, Framer…), e-commerce (Shopify, WooCommerce, Magento…), JS frameworks (Next.js, Nuxt, Astro…), CDN and hosting (Cloudflare, Vercel, CloudFront…), analytics, ad pixels, marketing automation, live chat, payments (Stripe, PayPal, Paddle…), consent tools and monitoring. Every detection includes the evidence that triggered it.
• Email setup and security: MX provider (Google Workspace, Microsoft 365, Proofpoint…), SPF record and all qualifier, DMARC policy (none / quarantine / reject), pct and reporting.
• Domain registration (RDAP): registrar, creation and expiry dates, domain age in days.
• TLS certificate: issuer, expiry and days left.
• Security headers (HSTS, CSP, X-Frame-Options…) with a simple score.
• Well-known files: robots.txt, sitemap.xml, llms.txt, security.txt.
• DNS basics (A, AAAA, NS), third-party verification tokens (which SaaS tools the domain has verified with), page title, description and language.
• A one-line summary an LLM can quote directly.

Who it's for

• AI agents and MCP clients answering "what does acme.com run on?", "is this domain legit / how old is it?" or "can we email them safely?"
• Sales and lead-gen: qualify leads by stack ("Shopify stores using Klaviyo", "sites on WordPress without Cloudflare").
• Security and deliverability checks: find domains with no DMARC or an expiring certificate.
• Market research: stack share across a list of competitors.

Input

{ "domains": ["apify.com", "https://www.shopify.com/pricing", "wordpress.org"] }

Optional switches (all on by default): includeTech, includeDns, includeTls, includeRdap, includeFiles. timeoutSecs (default 15) and maxConcurrency (default 10) control speed.

Output (one item per domain, trimmed)

{
  "domain": "shopify.com",
  "summary": "shopify.com: runs Shopify, email on Google Workspace, DMARC p=reject, domain 21y old, TLS expires in 60d.",
  "reachable": true, "statusCode": 200, "blocked": false,
  "title": "Shopify: The All-in-One Commerce Platform for Businesses",
  "technologies": [
    { "name": "Shopify", "category": "E-commerce", "evidence": "header x-shopid" },
    { "name": "Cloudflare", "category": "CDN", "evidence": "header server" }
  ],
  "email": {
    "mxProvider": "Google Workspace", "mx": ["aspmx.l.google.com"],
    "spf": { "present": true, "allQualifier": "fail", "includes": ["_spf.google.com"] },
    "dmarc": { "present": true, "policy": "reject", "pct": 100, "rua": true }
  },
  "registration": { "registrar": "MarkMonitor Inc.", "createdAt": "2005-…", "ageDays": 7600 },
  "tls": { "issuer": "Google Trust Services", "validTo": "2026-…", "daysLeft": 60 },
  "securityHeaders": { "strictTransportSecurity": true, "contentSecurityPolicy": true, "score": "4/6" },
  "files": { "robotsTxt": true, "sitemapXml": true, "llmsTxt": true, "securityTxt": true },
  "errors": []
}

blocked: true means the homepage answered with a bot wall (403/429 or a challenge page), so the tech list may be partial. The DNS, email, TLS and registration data are still complete.

Pricing

Pay per result: one domain-analyzed event per domain returned. No subscription. Invalid inputs and domains that don't resolve (exists: false) are never charged.

Notes

• Detection uses our own fingerprint set, matched against the homepage's HTML, headers, cookies and script URLs. It won't see technologies that only load after user interaction.
• DNS is resolved over HTTPS (Cloudflare, falling back to Google). Registration data comes from the official RDAP registries (looked up via the IANA bootstrap file, with retries on rate limits).
• Only public information is collected; no login, no personal data.