DNS Lookup – Bulk DNS Records, MX, SPF, DMARC & Reverse DNS

Bulk DNS lookup for thousands of domains in one run. Paste a list of domains, URLs or email addresses and get one clean row per domain with A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records. Each row also includes a full SPF checker (mechanisms, includes, recursive DNS-lookup count with the 10-lookup limit warning), DMARC policy and rua, DKIM selector discovery, MTA-STS, TLS-RPT and BIMI, the detected email provider, an email-authentication grade A–F with a plain-English issue list, optional reverse DNS (PTR), a DNS propagation check across 8 public resolvers, and a monitor mode that reports only the domains whose DNS changed (with an optional webhook / Slack alert).

No API key and no proxies. You choose the resolver: Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9, the system resolver or your own DNS server. $1 per 1,000 domains, everything included.

What does DNS Lookup do?

Feature	Details
DNS records	A, AAAA, MX, NS, TXT, CNAME, SOA, CAA by default. SRV, DS, DNSKEY, HTTPS, SVCB, NAPTR, TLSA and PTR are optional. TTL for every record type.
MX lookup	Mail servers sorted by priority, plus the detected provider: Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast, Null MX and about 40 more.
SPF checker	Parsed mechanisms (ip4, ip6, a, mx, include, exists, ptr), the all policy, redirect, a recursive DNS-lookup count (RFC 7208 limit of 10), void lookups, broken includes, multiple-record and +all warnings
DMARC checker	Policy p, subdomain policy sp, pct, rua/ruf report addresses, adkim/aspf alignment, fo, and fallback to the organizational domain for subdomains
DKIM	Probes about 29 common selectors (google, selector1/2, k1–k3, s1/s2, default, mandrill, amazonses…) plus your own selectors. Returns the key type, approximate key size and whether the key is revoked.
MTA-STS / TLS-RPT / BIMI	Presence, record, policy id, report address, BIMI logo and VMC URLs
Reverse DNS	PTR records of up to 5 IPv4 addresses per domain
Email auth grade	emailAuthGrade (A–F), emailAuthScore (0–100) and a short emailAuthIssues list per domain, computed from the SPF, DMARC, DKIM, MTA-STS and TLS-RPT data above. No extra queries, no extra cost.
Run report	A run-level summary in the key-value store: REPORT (JSON) and REPORT.html (tables: grades, top issues, email providers, lowest-scoring domains). Free.
Propagation mode	The selected record types from 8 public resolvers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, UltraDNS Public, DNS.SB, DNS4EU), with per-resolver answers, a consistent flag and a mismatch list. Same price per domain.
Issues	Ready-made flags such as spf_too_many_lookups, missing_dmarc, dmarc_policy_none, dkim_not_found_common_selectors, no_mx, no_caa, nxdomain
Monitor mode	Compares each domain with the previous run and outputs only new or changed domains, with added/removed values. Optional webhookUrl (works with Slack/Discord incoming webhooks) is called when changes are found.
Input cleanup	URLs become host names, emails become domains, IDNs become punycode. Duplicates are removed, and invalid lines are reported for free.

Use cases

• Email deliverability audits: check SPF, DMARC and DKIM for every client or sending domain before a campaign, sort by emailAuthGrade, and hand the client the REPORT.html summary.
• Lead enrichment: find which leads use Google Workspace or Microsoft 365, or sit behind a Proofpoint or Mimecast gateway.
• DNS change monitoring: schedule a daily run with Monitor mode and get alerts when MX, NS, A or TXT records change. This catches domain hijacks, migrations and expired zones.
• Security and compliance: find domains without DMARC enforcement, SPF records over the 10-lookup limit, missing CAA, or dangling CNAMEs.
• Domain portfolio and migration checks: verify that thousands of domains point to the right IPs and name servers after a move.
• DNS propagation check: after a migration or an MX/TXT change, use Propagation mode to see whether 8 public resolvers already return the new records.
• Resolver comparison: run the same list against 1.1.1.1, 8.8.8.8 or your internal DNS server.

Input example

{
  "domains": ["apify.com", "https://www.github.com/apify", "jane@gmail.com"],
  "recordTypes": ["A", "AAAA", "MX", "NS", "TXT", "CNAME", "SOA", "CAA"],
  "resolver": "cloudflare",
  "emailSecurity": true,
  "checkDkim": true,
  "reverseDns": false,
  "onlyChanges": false
}

You can also paste a long list or a whole CSV into Bulk list, or give a file URL (TXT or CSV, for example a published Google Sheet).

Output example

One row per domain. The flat columns work well in Excel or Google Sheets, and full details are in nested objects. Example (shortened):

{
  "input": "apify.com",
  "domain": "apify.com",
  "rootDomain": "apify.com",
  "status": "OK",
  "ipv4": "3.160.57.105, 3.160.57.31, 3.160.57.35, 3.160.57.84",
  "mxHosts": "1 aspmx.l.google.com, 5 alt1.aspmx.l.google.com, ...",
  "nameservers": "ns-1225.awsdns-25.org, ns-1928.awsdns-49.co.uk, ...",
  "emailProvider": "Google Workspace",
  "spf": "-all (fail)",
  "spfLookups": 10,
  "dmarcPolicy": "reject",
  "dmarcRua": "mailto:dmarc-reports@apify.com",
  "dkimSelectors": "google",
  "mtaSts": true,
  "bimi": true,
  "issues": [],
  "emailAuthGrade": "A",
  "emailAuthScore": 100,
  "emailAuthIssues": [],
  "records": { "A": ["3.160.57.105", "..."], "MX": [{ "priority": 1, "host": "aspmx.l.google.com" }], "SOA": [{ "primaryNs": "ns-839.awsdns-40.net", "serial": 1 }], "CAA": [{ "flags": 0, "tag": "issue", "value": "letsencrypt.org" }] },
  "ttls": { "A": 60, "MX": 86400, "NS": 172800 },
  "emailSecurity": {
    "spf": { "record": "v=spf1 a mx include:_spf.google.com include:mailgun.org ... -all", "dnsLookupCount": 10, "lookupLimitExceeded": false, "includes": ["_spf.google.com", "mailgun.org"], "warnings": [] },
    "dmarc": { "policy": "reject", "subdomainPolicy": "reject", "pct": 100, "rua": ["mailto:dmarc-reports@apify.com"] },
    "dkim": [{ "selector": "google", "keyType": "rsa", "keyBits": 2048, "revoked": false }],
    "mtaSts": { "found": true, "id": "29919a352ef9476a" },
    "bimi": { "found": true, "logoUrl": "https://apify.com/ext/apify-bimi-logo.svg" }
  },
  "resolver": "cloudflare",
  "checkedAt": "2026-10-12T13:57:56Z"
}

Status values: OK (records found), NO_RECORDS (the name exists but has none of the selected types), NXDOMAIN (the domain does not exist), TIMEOUT / SERVFAIL (the lookup failed; not charged), INVALID_INPUT (not charged).

Email authentication grade (A–F)

Every domain with email security enabled gets emailAuthGrade, emailAuthScore and emailAuthIssues. The score starts at 100 and loses points per finding:

Finding	Points
No DMARC record	−35
No SPF record	−30
DMARC p= missing/invalid	−30
SPF +all	−25
DMARC p=none, multiple SPF/DMARC records, SPF over 10 lookups	−20 each
SPF ?all	−15
No DKIM key under the common selectors, weak (<1024-bit) DKIM key, broken SPF include, SPF without all	−10 each
DMARC pct<100, no rua, sp=none, unknown SPF terms, >2 void lookups	−5 each
No MTA-STS / 1024-bit DKIM / SPF ptr / no TLS-RPT	−3 / −3 / −3 / −2

Grades: A ≥ 90, B ≥ 80, C ≥ 65, D ≥ 50, F < 50. A domain with neither SPF nor DMARC is always F. For domains without MX (or with a Null MX), DKIM, MTA-STS and TLS-RPT are not counted, because only spoofing protection (SPF + DMARC) applies. Web-only subdomains without MX get no grade (null). The grade is a quick triage score from public DNS, not a guarantee of inbox placement: DNS cannot show DKIM keys under custom selectors, sending reputation or content.

After each run, the key-value store holds REPORT (JSON) and REPORT.html: counts per grade, the most common issues, email providers and the lowest-scoring domains. Both are linked on the run's Output tab.

Propagation mode

Set Mode to Propagation check. Each domain is queried for the selected record types on 8 public resolvers:

id	Resolver	IP
cloudflare	Cloudflare	1.1.1.1
google	Google Public DNS	8.8.8.8
quad9	Quad9	9.9.9.9
opendns	Cisco OpenDNS	208.67.222.222
adguard	AdGuard DNS (non-filtering)	94.140.14.140
dns4eu	DNS4EU (unfiltered)	86.54.11.100
ultradns	UltraDNS Public	64.6.64.6
dnssb	DNS.SB	185.222.222.222

Each row has consistent, consistentExceptAddresses, inconsistentTypes, mismatches ({type, resolver, answer, majority}), respondedResolvers / failedResolvers, and propagation with every resolver's answer per record type. The flat columns (ipv4, mxHosts, nameservers…) show the majority answer. The SOA serial is compared, because it is the usual sign that a zone change has not reached a resolver yet. A resolver that times out is listed in failedResolvers and is not counted as a mismatch.

Note: sites behind a CDN, geo-DNS or round-robin DNS (GitHub, AWS CloudFront…) often return different A/AAAA answers per resolver even when nothing is wrong. Use consistentExceptAddresses to check only NS, MX, TXT, SOA, CNAME and CAA. Quad9 blocks known-malicious domains, so for those it returns no answer while the others do. All resolvers are queried from the Actor's data-center location, so this shows resolver caches, not answers from different countries. The price is the same as a normal lookup: one domain-checked event per domain.

Monitor mode and webhook

In monitor mode, each row also has changeType (new / changed), previousCheckedAt and changes, for example: [{"field": "MX", "added": ["0 github-com.mail.protection.outlook.com"], "removed": ["10 old-mx.example.net"]}]

If you set Webhook URL, the Actor POSTs one JSON message at the end of a monitor run that found changed domains (new domains alone do not trigger it):

{
  "text": "DNS changes detected on 2 domain(s) (of 3 checked):\n- github.com: MX\n- python.org: dmarc",
  "event": "dns_changes_detected",
  "runId": "...", "datasetId": "...", "datasetUrl": "https://api.apify.com/v2/datasets/.../items?format=json",
  "domainsChecked": 3, "changedCount": 2, "newCount": 0, "unchangedCount": 1,
  "changes": [{ "domain": "github.com", "changes": [{ "field": "MX", "added": ["..."], "removed": ["..."] }] }]
}

The text field means a Slack or Discord incoming-webhook URL works without extra setup. The webhook is best effort: it is tried twice, and a failure is only logged, so it never fails the run.

Pricing

Pay per event: $0.001 per domain checked ($1 per 1,000 domains) plus $0.00005 per run. Email security, DKIM, reverse DNS, the A–F grade, the run report, propagation mode, monitoring and the webhook are included. Failed lookups (timeouts, resolver errors), invalid inputs and duplicates are free. An NXDOMAIN answer is a real result, so it is charged. Set Maximum cost per run and the Actor stops cleanly when it is reached.

Actor (Apify Store, Oct 2026)	Price per domain
This Actor	$0.001, no per-run fee
santamaria-automations/domain-whois-dns	$0.003 + $0.001 per run
automation-lab/domain-availability-checker	$0.0012–0.0023 + $0.035 per run
ryanclinton/dns-record-lookup	$0.003
logiover/bulk-dns-records-lookup	$0.0035–0.005
Email-security auditors (SPF/DMARC/DKIM)	$0.003–0.01

Speed: about 1,000 domains in 1.5–2 minutes with the default settings (measured: 1,000 hosts, 37,000 DNS queries, 78 s).

FAQ

Which resolver should I use? Cloudflare 1.1.1.1 (the default) is fast and unfiltered. Use Google 8.8.8.8 or Quad9 to compare. Use Custom to query a specific server, such as your corporate DNS or a domain's authoritative name server.

Why does an SPF record with only 4 includes show 12 lookups? The 10-lookup limit counts nested includes too. The Actor follows every include: and redirect= recursively, the same way a receiving mail server does. Over 10 lookups gives an SPF permerror, and mail can fail authentication.

Why "DKIM not found" when the domain signs its mail? DNS has no way to list DKIM keys. The Actor checks about 29 common selectors. If your provider uses a custom selector, add it in Extra DKIM selectors.

How does monitor mode work? Turn on Monitor mode and schedule the Actor (for example, daily). The state is saved in a named key-value store in your account (dns-lookup-monitor by default). The first run outputs every domain as new. Later runs output only changed domains. TTLs and the SOA serial are ignored. For CDN sites whose IPs rotate, add A and AAAA to Ignore these record types. Unchanged domains are still looked up and charged. For watch lists over 50,000 domains, use 1 GB of memory.

Do I get rows for subdomains like www.example.com? Yes. The Actor queries exactly what you entered by default. Set What to look up to Root domain to turn every URL into its registrable domain. DMARC on a subdomain falls back to the parent domain's record, as receivers do.

What does the email auth grade not cover? It only uses public DNS. It cannot see DKIM keys under custom selectors (add them in Extra DKIM selectors), IP or domain reputation, blocklists, or whether mail is actually signed and aligned. For a deeper SPF/DKIM/DMARC deliverability audit, see the Related section below.

Is this legal? Yes. DNS records are public by design, and the Actor only sends standard DNS queries.

Use with AI agents / Apify MCP

AI agents (Claude, ChatGPT, Cursor and others) can call this Actor through the Apify MCP server. Add bulk-dns-lookup as a tool and ask, for example: "Check SPF, DMARC and MX for these 200 client domains and list the ones without DMARC enforcement." The flat fields (spf, spfLookups, dmarcPolicy, emailProvider, issues) are easy for an LLM to read. You can also call it through the Apify API, or from Make, Zapier or n8n with the Apify integration.

Related

• SPF, DKIM & DMARC Checker – Bulk Email Deliverability Audit (same developer): a dedicated SPF/DKIM/DMARC deliverability audit with Gmail/Yahoo bulk-sender readiness and the exact DNS fix for each issue. Use it when you need email authentication only and more detail than the grade here.