Domain DNS Facts: Mail Provider, SPF and DMARC

For email, deliverability, IT and marketing agencies that manage many client domains. Domain DNS Facts reads public DNS for a list of up to 2,000 domains per run and returns, per domain: where mail goes and which provider runs it, who hosts the DNS, the SPF all rule, the DMARC policy and the DNSSEC validation flag.

The job in one line: paste client or prospect domains, get one row per domain showing how mail is set up and how strict SPF and DMARC are.

What one run costs (pay per event):

Event	Price
Domain checked (one domain with status ok)	$0.001
Actor start (once per run, Apify's standard fee)	$0.00005

1,000 domains cost $1.00. Domains that do not exist, rejected lines and resolver failures are free, and a repeated domain is charged once. A real run on 17 Oct 2026 (python.org, example.com, gmail.com) took 6.5 seconds, returned 3 ok domains and cost a buyer $0.00305.

Quick start

{
    "domains": ["python.org", "example.com", "gmail.com"],
    "dohProvider": "google"
}

domains takes bare domain names, one per line (no https://, path or port). dohProvider is google (default) or cloudflare.

Output example

A REAL record, read on 8 Oct 2026 at 01:55 UTC through dns.google by this Actor. DNS answers change, so a later run can differ.

{
  "id": "f731bf51ae1d57b8152f",
  "input": "stripe.com",
  "domain": "stripe.com",
  "status": "ok",
  "error": null,
  "mail_route": "mx",
  "mx_hosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com"],
  "mx_provider": "google",
  "ns_hosts": ["ns-1087.awsdns-07.org", "ns-1882.awsdns-43.co.uk", "ns-423.awsdns-52.com", "ns-705.awsdns-24.net"],
  "ns_host_count": 4,
  "ns_provider": "aws_route53",
  "has_a": true,
  "spf_present": true,
  "spf_record_count": 1,
  "spf_all": "~all",
  "dmarc_present": true,
  "dmarc_policy": "reject",
  "dmarc_subdomain_policy": null,
  "dnssec_validated": false,
  "lookup_errors": [],
  "source_url": "https://dns.google/resolve?name=stripe.com&type=MX",
  "source_urls": [
    "https://dns.google/resolve?name=stripe.com&type=MX",
    "https://dns.google/resolve?name=stripe.com&type=NS",
    "https://dns.google/resolve?name=stripe.com&type=A",
    "https://dns.google/resolve?name=stripe.com&type=TXT",
    "https://dns.google/resolve?name=_dmarc.stripe.com&type=TXT"
  ],
  "fetched_at": "2026-10-08T01:55:31Z"
}

Key fields:

• status: ok; not_found (the name does not exist in DNS); error (rejected line or resolver failure); blocked (resolver rate limit).
• mail_route: mx, null_mx (the domain declares it takes no mail), a_fallback (no MX, mail would go to the A address) or none.
• spf_all: the all rule of the first SPF record (-all, ~all, ?all, +all), or null.
• dmarc_policy and dmarc_subdomain_policy: none, quarantine or reject, or null.
• mx_provider and ns_provider: guesses from host names, null when no rule matches.
• source_urls: every lookup used, so each fact points back to its source.

Three agency use cases

1. DMARC and SPF audit across the client book. Run every client domain once a month. Sort by dmarc_policy and spf_all to see which clients still sit at none or ~all, and turn that into the next quarter's deliverability work.
2. Prospect qualification. Before outreach to a list of companies, check which mail provider and DNS host each one uses and whether email authentication is set up. A domain with no DMARC record is a concrete talking point for a deliverability or security offer.
3. Onboarding check for a new client. On day one, run the client's brand and campaign domains to record the starting state: mail route, provider, SPF, DMARC and DNSSEC flag, each with the DNS lookup address behind it.

Limits and what it does not do

• Public DNS over HTTPS only. No registry, website or mail server is contacted.
• No registration data (creation or expiry dates, registrar): the large registries forbid bulk automated use of their registration data service.
• No DKIM check: DKIM records live under selectors that cannot be listed from DNS.
• At most 2,000 domains per run, about 1 second per domain. For a longer list, split it into several runs.
• A subdomain is looked up exactly as given; the parent domain's records are not consulted.
• Provider guesses come from a short built-in list of host name patterns and say nothing about plans or contracts.
• dnssec_validated is the resolver's flag on the MX answer; a signed zone that the resolver does not validate shows false.

FAQ

Does not_found mean the domain is free to register? No. It only means the name does not resolve in DNS today.

Can I paste website addresses? Only bare domains. Remove https://, paths and ports first. Rejected lines come back as error with invalid_domain and are not charged.

What does a null field mean? Unknown, never absent. When a lookup after the MX one fails, it is listed in lookup_errors, the record stays ok and those fields stay null.

Is anything stored between runs? No. Each run reads DNS fresh for your list and keeps nothing afterwards.

How do I cap my spend? Set a maximum cost per run in the run options. The run stops cleanly when it is reached.

Keywords: DMARC checker bulk, SPF record checker, email deliverability audit, mail provider lookup, MX record lookup, DNS host lookup, domain list enrichment for agencies