DNS Records Lookup: A, AAAA, MX, NS, TXT, SPF, DMARC, CAA

DNS Records Lookup

DNS Records Lookup reads the DNS records of a list of hostnames and returns one row per hostname: A and AAAA addresses, the CNAME target, MX mail servers by priority, nameservers, TXT, SOA and CAA records, plus the SPF record, the DMARC policy and the mail provider. Paste hostnames, URLs or email addresses into Hostnames and click Start; 104 company domains took 4 seconds in October 2026. DKIM keys are not looked up, because their DNS name depends on a selector that only the sender knows. It costs $0.80 per 1,000 DNS lookups on the Free plan ($0.40 on Business), and the $5 of monthly credit in Apify's Free plan covers about 6,200 DNS lookups.

What data does it return?

Field	Description
input, hostname	The value you entered and the hostname taken from it, in lower case, with internationalized names converted to punycode.
domain, publicSuffix, tld	The registrable domain found with the Public Suffix List (apify.com for blog.apify.com), its public suffix such as co.uk, and the last label such as uk.
a, aaaa	IPv4 and IPv6 addresses of the hostname, or of the final target when it is an alias.
cname	Target of the CNAME record when the hostname is an alias, such as apify.ghost.io for blog.apify.com. null otherwise, and always for a bare domain.
mx	Mail servers, each with priority and exchange, the preferred one (lowest number) first.
ns	Nameservers in lower case. Empty for a subdomain that is not delegated to its own nameservers.
txt	Every TXT record with quotes removed and split strings joined: SPF, site verification tokens and similar entries.
soa	Start of authority: primaryNs, admin (the hostmaster mailbox written as a hostname), serial, and refresh, retry, expire and minimum in seconds. null below the top of a zone.
caa	CAA records naming the certificate authorities allowed to issue certificates, such as 0 issue "letsencrypt.org".
spf	The TXT record that starts with v=spf1, null when there is none.
dmarc, dmarcPolicy	The record published at _dmarc.<hostname> and its policy: none, quarantine or reject.
mailProvider	Mail service recognized from the MX hostnames among 22 known ones, such as Google Workspace, Microsoft 365, Proofpoint or Seznam.cz. Other when none matches, null without MX records.
websiteResolves, hasMx	true when the hostname has an A, AAAA or CNAME record, and when it has at least one MX record. null when no resolver answered.
notes	Problems met for this hostname, such as DNS: name does not exist (NXDOMAIN). Empty when everything went fine.
type, key, checkedAt	Always domain, the key domain:<hostname> that changes-only mode compares, and the time of the lookup in UTC.
registered, registrar, createdAt, expiresAt, nameservers, subdomains	These and the other registration fields are always null or empty here. They keep the row in the same shape as our WHOIS actors, which fill them.

How to look up DNS records in bulk

1. Enter names in Hostnames, one per line: example.com, mail.example.com, a URL such as https://www.example.com/pricing or an email address such as info@example.com. The hostname is taken from each value and looked up exactly, so www.example.com and example.com are separate rows.
2. In DNS record types, keep all eight types or pick the ones you need, such as MX and TXT for an email audit.
3. Leave Email setup checks on to get spf, dmarc, dmarcPolicy and mailProvider. It adds the DMARC query and, when you did not pick them, the MX and TXT queries, at no extra charge.
4. Click Start. The Output tab shows one row per hostname, which you can download as CSV, Excel or JSON. Values that are not domain names, such as IP addresses, are skipped and named in the log.

An API input that checks the mail setup of three domains every day and returns only those whose records moved:

{
  "domains": ["example.com", "info@example.org", "https://shop.example.net/"],
  "dnsTypes": ["MX", "TXT", "NS"],
  "emailChecks": true,
  "changesOnly": true,
  "watchName": "our-mail-domains"
}

Example output

The row for apify.com from a run on 11 October 2026 with all record types and email checks on.

{
  "type": "domain",
  "key": "domain:apify.com",
  "input": "apify.com",
  "hostname": "apify.com",
  "domain": "apify.com",
  "tld": "com",
  "publicSuffix": "com",
  "registered": null,
  "lookupSource": null,
  "rdapServer": null,
  "whoisServer": null,
  "registrar": null,
  "registrarIanaId": null,
  "registrarUrl": null,
  "createdAt": null,
  "updatedAt": null,
  "expiresAt": null,
  "transferredAt": null,
  "domainAgeDays": null,
  "daysUntilExpiry": null,
  "statuses": [],
  "nameservers": [],
  "dnssec": null,
  "a": [
    "3.170.42.100",
    "3.170.42.109",
    "3.170.42.68",
    "3.170.42.76"
  ],
  "aaaa": [
    "2600:9000:2870:1200:9:a03e:6540:93a1",
    "2600:9000:2870:3000:9:a03e:6540:93a1",
    "2600:9000:2870:3c00:9:a03e:6540:93a1",
    "2600:9000:2870:9600:9:a03e:6540:93a1",
    "2600:9000:2870:c00:9:a03e:6540:93a1",
    "2600:9000:2870:d400:9:a03e:6540:93a1",
    "2600:9000:2870:da00:9:a03e:6540:93a1",
    "2600:9000:2870:e00:9:a03e:6540:93a1"
  ],
  "cname": null,
  "mx": [
    {
      "priority": 1,
      "exchange": "aspmx.l.google.com"
    },
    {
      "priority": 5,
      "exchange": "alt1.aspmx.l.google.com"
    },
    {
      "priority": 5,
      "exchange": "alt2.aspmx.l.google.com"
    },
    {
      "priority": 10,
      "exchange": "aspmx2.googlemail.com"
    },
    {
      "priority": 10,
      "exchange": "aspmx3.googlemail.com"
    }
  ],
  "ns": [
    "ns-1225.awsdns-25.org",
    "ns-1928.awsdns-49.co.uk",
    "ns-449.awsdns-56.com",
    "ns-839.awsdns-40.net"
  ],
  "txt": [
    "aisle-domain-verification-ymx7gd=j3J4hCmXHIc9R0RNQCfa8xdSf",
    "google-site-verification=R_4agUZyHorQrO5QGFa6ZB_o-uDxq82NY-EteDUpPvo",
    "google-site-verification=XU737OZxx6NvGd3NQK9MRt98qxRMjx3RByq-O0cy16I",
    "google-site-verification=ZqRh2_YSBHj2bo_KsEdu6MfmTMKJYLpDDL3oPtOrN_A",
    "google-site-verification=jrECJwBG9eeO_FUrOMhp7JY1oF8JSBxhzmLsLGvrt9s",
    "mixpanel-domain-verify=44615d9c-27f2-4587-a781-8a0a1c734e9a",
    "openai-domain-verification=dv-WTM7Nna92Owwh4sgmDOVUyyt",
    "tito-domain-verification=pbg2696rvzbax2t4dl7h5ynqm",
    "v=MCPv1; k=ed25519; p=1rDnoEigwTr+4JjG89+sLbdNnswCnLjmaeT34srW53Y=",
    "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
    "zapier-domain-verification-challenge=2c358aa9-fa36-419f-b21a-ca9eb6f2791d"
  ],
  "soa": {
    "primaryNs": "ns-839.awsdns-40.net",
    "admin": "awsdns-hostmaster.amazon.com",
    "serial": 1,
    "refresh": 7200,
    "retry": 900,
    "expire": 1209600,
    "minimum": 86400
  },
  "caa": [
    "0 issue \"amazonaws.com\"",
    "0 issue \"digicert.com\"",
    "0 issue \"letsencrypt.org\"",
    "0 issuewild \"amazonaws.com\"",
    "0 issuewild \"letsencrypt.org\""
  ],
  "websiteResolves": true,
  "hasMx": true,
  "mailProvider": "Google Workspace",
  "spf": "v=spf1 a mx include:_spf.google.com include:mailgun.org include:amazonses.com include:19497222.spf05.hubspotemail.net -all",
  "dmarc": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com; ri=604800",
  "dmarcPolicy": "reject",
  "subdomains": null,
  "subdomainCount": null,
  "checkedAt": "2026-10-11T15:49:10.941Z",
  "notes": []
}

How much does it cost to look up DNS records?

	Free plan	Starter	Scale	Business
1,000 DNS lookups	$0.80	$0.64	$0.52	$0.40

You pay only for the events in the table. There is no start fee, and compute time and proxies are included.

Checking 10,000 hostnames costs $8.00 on the Free plan and $4.00 on Business. A hostname is charged once whatever the number of record types, and hostnames that no resolver answered or that changes-only mode leaves out cost nothing. A name that does not exist is charged, because the resolver did answer: its row has empty records and the NXDOMAIN note.

Limits

• Queries go to Cloudflare's DNS over HTTPS service, with Google Public DNS as a fallback, never to the target's own nameservers. Answers can come from their cache, and TTL values are not returned.
• Up to 6 hostnames are checked at a time, each with up to 9 queries. A query waits 15 seconds and is tried twice with each resolver before the hostname is given up with the note DNS resolvers did not answer.
• When resolvers fail for more than half of the hostnames, the run is marked as failed.
• Reverse DNS (PTR records of IP addresses) is not supported; IP addresses in the input are skipped.
• DMARC is read only at the exact hostname. A subdomain without its own record shows dmarc: null even when its parent domain publishes one that mail receivers would apply.
• When a hostname is an alias, a, aaaa and caa hold the records of the target it points to.
• mailProvider names whoever receives the mail first. Companies that route mail through a filtering service show that service, such as Proofpoint or Mimecast, and in a test of 104 large company domains in October 2026, 23 matched no known provider and show Other.
• One run returns at most 10,000 hostnames unless you raise Maximum rows.

Watching DNS for changes

Give the run a Watch name, or save it as a task, which keeps a snapshot automatically. Each run compares the A, MX, NS, SPF and DMARC values of every hostname with the previous run and writes the result to the CHANGES record: counts of new, changed and gone hostnames, and for each change the field with its old and new value. Turn on Return only hostnames whose records changed since the last run to get and pay for only the changed and new hostnames. AAAA, TXT records other than SPF, CAA and SOA are not compared.

Records are compared as sets, so a different order of the same records is not a change. Sites behind a content delivery network do change A addresses often: in two runs a minute apart in October 2026, 11 of 100 large company domains, such as google.com and walmart.com, had new A addresses, while none had a change in MX, NS, SPF or DMARC. For such sites, leave A out of DNS record types and watch MX, NS, SPF and DMARC.

FAQ

Is it legal to look up DNS records?

DNS records are public by design, and the actor reads them through the documented public DNS over HTTPS services of Cloudflare and Google, without contacting the target's servers. Records describe the infrastructure of a domain. A few of them, such as SOA or a DMARC rua address, can contain a mailbox name, which the actor returns as published. You are responsible for how you use the data.

Can I check SPF and DMARC for a list of domains?

Yes. Keep Email setup checks on and filter the output by spf being empty or by dmarcPolicy. Of 104 large company domains checked in October 2026, 75 had a reject policy, 16 quarantine, 11 none and 2 no DMARC record at all.

Why are the registrar and expiry fields empty?

This actor reads DNS only. For registrar, creation and expiry dates use our WHOIS actors linked below, which return the same row shape with those fields filled.

Related scrapers

• Domain WHOIS and DNS Lookup
• WHOIS Domain Lookup
• Domain Availability Checker
• Tech Stack Detector

Support

This actor is built and maintained by deriverge s.r.o., a software company based in the Czech Republic. If a run fails or a field you need is missing, please open an issue in the Issues tab or write to us at info@deriverge.com. We respond in English and Czech. Runs can be scheduled in Apify Console or started from the API tab, which has examples for Python, JavaScript and cURL and works with Make, Zapier, n8n and the Apify MCP server. If the actor saves you time, a short review helps other people find it.