DNS Lookup – Bulk DNS Records, MX, SPF & DMARC Checker

Bulk DNS lookup for thousands of domains in one run. Paste a list of domains, URLs or email addresses and get one clean row per domain with A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records. Each row also includes a full SPF checker (mechanisms, includes, recursive DNS-lookup count with the 10-lookup limit warning), DMARC policy and rua, DKIM selector discovery, MTA-STS, TLS-RPT and BIMI, the detected email provider, optional reverse DNS (PTR), and a monitor mode that reports only the domains whose DNS changed.

No API key and no proxies. You choose the resolver: Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9, the system resolver or your own DNS server. $1 per 1,000 domains, everything included.

What does DNS Lookup do?

Feature	Details
DNS records	A, AAAA, MX, NS, TXT, CNAME, SOA, CAA by default. SRV, DS, DNSKEY, HTTPS, SVCB, NAPTR, TLSA and PTR are optional. TTL for every record type.
MX lookup	Mail servers sorted by priority, plus the detected provider: Google Workspace, Microsoft 365, Zoho, Proofpoint, Mimecast, Null MX and about 40 more.
SPF checker	Parsed mechanisms (ip4, ip6, a, mx, include, exists, ptr), the all policy, redirect, a recursive DNS-lookup count (RFC 7208 limit of 10), void lookups, broken includes, multiple-record and +all warnings
DMARC checker	Policy p, subdomain policy sp, pct, rua/ruf report addresses, adkim/aspf alignment, fo, and fallback to the organizational domain for subdomains
DKIM	Probes about 29 common selectors (google, selector1/2, k1–k3, s1/s2, default, mandrill, amazonses…) plus your own selectors. Returns the key type, approximate key size and whether the key is revoked.
MTA-STS / TLS-RPT / BIMI	Presence, record, policy id, report address, BIMI logo and VMC URLs
Reverse DNS	PTR records of up to 5 IPv4 addresses per domain
Issues	Ready-made flags such as spf_too_many_lookups, missing_dmarc, dmarc_policy_none, dkim_not_found_common_selectors, no_mx, no_caa, nxdomain
Monitor mode	Compares each domain with the previous run and outputs only new or changed domains, with added/removed values
Input cleanup	URLs become host names, emails become domains, IDNs become punycode. Duplicates are removed, and invalid lines are reported for free.

Use cases

• Email deliverability audits: check SPF, DMARC and DKIM for every client or sending domain before a campaign.
• Lead enrichment: find which leads use Google Workspace or Microsoft 365, or sit behind a Proofpoint or Mimecast gateway.
• DNS change monitoring: schedule a daily run with Monitor mode and get alerts when MX, NS, A or TXT records change. This catches domain hijacks, migrations and expired zones.
• Security and compliance: find domains without DMARC enforcement, SPF records over the 10-lookup limit, missing CAA, or dangling CNAMEs.
• Domain portfolio and migration checks: verify that thousands of domains point to the right IPs and name servers after a move.
• Resolver comparison: run the same list against 1.1.1.1, 8.8.8.8 or your internal DNS server.

Input example

{
  "domains": ["apify.com", "https://www.github.com/apify", "jane@gmail.com"],
  "recordTypes": ["A", "AAAA", "MX", "NS", "TXT", "CNAME", "SOA", "CAA"],
  "resolver": "cloudflare",
  "emailSecurity": true,
  "checkDkim": true,
  "reverseDns": false,
  "onlyChanges": false
}

You can also paste a long list or a whole CSV into Bulk list, or give a file URL (TXT or CSV, for example a published Google Sheet).

Output example

One row per domain. The flat columns work well in Excel or Google Sheets, and full details are in nested objects. Example (shortened):

{
  "input": "apify.com",
  "domain": "apify.com",
  "rootDomain": "apify.com",
  "status": "OK",
  "ipv4": "3.160.57.105, 3.160.57.31, 3.160.57.35, 3.160.57.84",
  "mxHosts": "1 aspmx.l.google.com, 5 alt1.aspmx.l.google.com, ...",
  "nameservers": "ns-1225.awsdns-25.org, ns-1928.awsdns-49.co.uk, ...",
  "emailProvider": "Google Workspace",
  "spf": "-all (fail)",
  "spfLookups": 10,
  "dmarcPolicy": "reject",
  "dmarcRua": "mailto:dmarc-reports@apify.com",
  "dkimSelectors": "google",
  "mtaSts": true,
  "bimi": true,
  "issues": [],
  "records": { "A": ["3.160.57.105", "..."], "MX": [{ "priority": 1, "host": "aspmx.l.google.com" }], "SOA": [{ "primaryNs": "ns-839.awsdns-40.net", "serial": 1 }], "CAA": [{ "flags": 0, "tag": "issue", "value": "letsencrypt.org" }] },
  "ttls": { "A": 60, "MX": 86400, "NS": 172800 },
  "emailSecurity": {
    "spf": { "record": "v=spf1 a mx include:_spf.google.com include:mailgun.org ... -all", "dnsLookupCount": 10, "lookupLimitExceeded": false, "includes": ["_spf.google.com", "mailgun.org"], "warnings": [] },
    "dmarc": { "policy": "reject", "subdomainPolicy": "reject", "pct": 100, "rua": ["mailto:dmarc-reports@apify.com"] },
    "dkim": [{ "selector": "google", "keyType": "rsa", "keyBits": 2048, "revoked": false }],
    "mtaSts": { "found": true, "id": "29919a352ef9476a" },
    "bimi": { "found": true, "logoUrl": "https://apify.com/ext/apify-bimi-logo.svg" }
  },
  "resolver": "cloudflare",
  "checkedAt": "2026-10-12T13:57:56Z"
}

Status values: OK (records found), NO_RECORDS (the name exists but has none of the selected types), NXDOMAIN (the domain does not exist), TIMEOUT / SERVFAIL (the lookup failed; not charged), INVALID_INPUT (not charged).

In monitor mode, each row also has changeType (new / changed), previousCheckedAt and changes, for example: [{"field": "MX", "added": ["0 github-com.mail.protection.outlook.com"], "removed": ["10 old-mx.example.net"]}]

Pricing

Pay per event: $0.001 per domain checked ($1 per 1,000 domains) plus $0.00005 per run. Email security, DKIM, reverse DNS and monitoring are included. Failed lookups (timeouts, resolver errors), invalid inputs and duplicates are free. An NXDOMAIN answer is a real result, so it is charged. Set Maximum cost per run and the Actor stops cleanly when it is reached.

Actor (Apify Store, Oct 2026)	Price per domain
This Actor	$0.001, no per-run fee
santamaria-automations/domain-whois-dns	$0.003 + $0.001 per run
automation-lab/domain-availability-checker	$0.0012–0.0023 + $0.035 per run
ryanclinton/dns-record-lookup	$0.003
logiover/bulk-dns-records-lookup	$0.0035–0.005
Email-security auditors (SPF/DMARC/DKIM)	$0.003–0.01

Speed: about 1,000 domains in 1.5–2 minutes with the default settings (measured: 1,000 hosts, 37,000 DNS queries, 78 s).

FAQ

Which resolver should I use? Cloudflare 1.1.1.1 (the default) is fast and unfiltered. Use Google 8.8.8.8 or Quad9 to compare. Use Custom to query a specific server, such as your corporate DNS or a domain's authoritative name server.

Why does an SPF record with only 4 includes show 12 lookups? The 10-lookup limit counts nested includes too. The Actor follows every include: and redirect= recursively, the same way a receiving mail server does. Over 10 lookups gives an SPF permerror, and mail can fail authentication.

Why "DKIM not found" when the domain signs its mail? DNS has no way to list DKIM keys. The Actor checks about 29 common selectors. If your provider uses a custom selector, add it in Extra DKIM selectors.

How does monitor mode work? Turn on Monitor mode and schedule the Actor (for example, daily). The state is saved in a named key-value store in your account (dns-lookup-monitor by default). The first run outputs every domain as new. Later runs output only changed domains. TTLs and the SOA serial are ignored. For CDN sites whose IPs rotate, add A and AAAA to Ignore these record types. Unchanged domains are still looked up and charged. For watch lists over 50,000 domains, use 1 GB of memory.

Do I get rows for subdomains like www.example.com? Yes. The Actor queries exactly what you entered by default. Set What to look up to Root domain to turn every URL into its registrable domain. DMARC on a subdomain falls back to the parent domain's record, as receivers do.

Is this legal? Yes. DNS records are public by design, and the Actor only sends standard DNS queries.

Use with AI agents / Apify MCP

AI agents (Claude, ChatGPT, Cursor and others) can call this Actor through the Apify MCP server. Add bulk-dns-lookup as a tool and ask, for example: "Check SPF, DMARC and MX for these 200 client domains and list the ones without DMARC enforcement." The flat fields (spf, spfLookups, dmarcPolicy, emailProvider, issues) are easy for an LLM to read. You can also call it through the Apify API, or from Make, Zapier or n8n with the Apify integration.