Domain Lookup: Email Provider, SaaS Stack & DMARC

Paste a list of company domains (or websites, or email addresses) and learn, for each one, what the company runs on, straight from its public DNS:

• Email provider: Google Workspace, Microsoft 365, Zoho, Proton, or a security gateway like Mimecast or Proofpoint.
• SaaS tools verified in DNS: companies publish a verification record for many tools they sign up for. We read them: Atlassian, Zoom, Slack, OpenAI, Anthropic, Figma, Miro, 1Password, DocuSign, HubSpot, Canva, Stripe and more.
• Who sends email as the company (SPF): Mailchimp, HubSpot, Salesforce Marketing Cloud, SendGrid, Amazon SES, Zendesk, Klaviyo...
• Email security: DMARC policy (none / quarantine / reject) and the SPF all rule.
• DNS host: Cloudflare, Amazon Route 53, Azure, GoDaddy...
• SSL certificate: issuer, organization (on OV/EV certificates), expiry date and days left.

No scraping, no proxies, no browser. Only standard DNS queries through the Actor's own resolver and the certificate every website presents on port 443. 5 domains took 6 seconds in our test.

Use it for

• Sales prospecting: find companies on Microsoft 365 if you sell a Microsoft add-on, or HubSpot users if you sell a HubSpot integration. Combine with any list of domains.
• Competitive and market research: how many companies in a list use Zoom vs. another tool, or Google Workspace vs. Microsoft 365.
• Email deliverability and security audits: DMARC and SPF across all your clients' domains in one run; spot domains with no DMARC or with two SPF records.
• SSL monitoring: certificates expiring in the next 30 days across a portfolio of domains.
• AI agents: one plain JSON object per domain, callable through the Apify MCP server.

Input

{
  "domains": ["stripe.com", "https://www.userpilot.com", "jane@ottonova.de"],
  "includeSsl": true
}

Output

One item per domain (real result for stripe.com on 2026-09-24, lists shortened):

{
  "input": "stripe.com",
  "domain": "stripe.com",
  "status": "ok",
  "dnsResolves": true,
  "ipv4": ["198.137.150.111", "198.202.176.111"],
  "ipv6": false,
  "dnsProvider": "Amazon Route 53",
  "nameservers": ["ns-1087.awsdns-07.org", "ns-1882.awsdns-43.co.uk", "ns-423.awsdns-52.com", "ns-705.awsdns-24.net"],
  "mx": [{ "exchange": "aspmx.l.google.com", "priority": 10 }],
  "emailProvider": "Google Workspace",
  "acceptsEmail": true,
  "spfRecord": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
  "spfSenders": ["Qualtrics"],
  "spfAll": "softfail",
  "spfMultiple": false,
  "dmarcPolicy": "reject",
  "dmarcRecord": "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;",
  "verifiedServices": ["Anthropic (Claude)", "Apple", "Atlassian", "Canva", "Cursor", "Docker", "DocuSign", "ElevenLabs", "Fastly", "Google Search Console", "HackerOne", "Linear", "LiveRamp", "Meta (Facebook) Business", "Microsoft 365", "OpenAI (ChatGPT)", "Postman", "Stripe", "Vercel", "Whimsical"],
  "txtRecords": 39,
  "sslIssuer": "DigiCert Inc",
  "sslSubject": "stripe.com",
  "sslOrganization": "Stripe, LLC",
  "sslValidFrom": "2026-08-17T00:00:00.000Z",
  "sslValidTo": "2026-11-12T23:59:59.000Z",
  "sslDaysLeft": 49,
  "checkedAt": "2026-09-24T00:00:00.000Z"
}

Field notes:

• status is not_found when the name does not exist in DNS.
• verifiedServices lists tools with a well-known verification record. A record shows the company verified the domain with that tool at some point; it may no longer be an active customer. Tokens that do not name their tool are ignored rather than guessed.
• spfSenders names the services behind include: entries; the company's own includes are not listed. spfMultiple: true means two SPF records, which breaks SPF.
• acceptsEmail is false when there is no MX record or a "null MX" (RFC 7505).
• sslDaysLeft can be negative: an expired certificate is still reported.

Pricing

Pay per event: one event per domain looked up. Invalid inputs and duplicates are skipped for free. Set a maximum cost for the run and the Actor stops cleanly when it is reached.

Good to know

• No WHOIS / registration dates. The registries' terms of use (Verisign for .com and .net, PIR for .org, Nominet for .uk, DENIC for .de and others) forbid high-volume automated queries, so this Actor does not query them.
• DNS answers are what the domain publishes at the moment of the run; TTLs and CDNs can make IP addresses vary between runs.
• Subdomains are looked up as given (shop.example.com), after removing www..

Support

A provider or a tool that should be recognized but isn't? Open an issue on the Actor's Issues tab with the domain. Issues get an answer within a few days.