Bulk Domain DNS Lookup — MX, TXT, SPF, DMARC, DNSSEC Check

Resolve full DNS records for many domains in a single run. Query all the record types that matter — A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV — choose your recursive resolver, and get clean structured JSON back, with the e-mail and security posture of each domain worked out for you.

Built for DevOps, SRE, security recon, email-deliverability debugging, lead enrichment, and domain monitoring.

Public DNS data only. Read-only queries. No personal data.

Why this Actor

• All record types in one call — A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV
• Bulk and fast — up to 1000 domains per run, resolved in parallel
• Posture fields included at no extra cost — SPF, DMARC (and its policy), DNSSEC, CAA, www, mail provider and DNS provider, all derived from extra lookups we run for you
• Messy input is fine — URLs, e-mail addresses, trailing dots, ports, www. prefixes and non-ASCII (IDN) domains are normalised automatically
• Agent friendly — url, urls, startUrls, hostname, email or a plain comma-separated string work just as well as domains, so an MCP client never comes back empty-handed
• Choose your resolver — Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or system
• Per-type error isolation with a TCP retry — one failing type never blocks the rest, and a dropped UDP packet is retried over TCP
• Pay per result — $0.005 per domain answered, which includes an authoritative "this domain does not exist". A lookup the resolver never answered (lookup_failed) and notice rows are not charged. No subscription.

Input

Field	Type	Description
domains	array	Up to 1000 domains. URLs, e-mail addresses and IDN domains are accepted
domain	string	Single-domain alternative
url · urls · startUrls · hostname · email	string / array	Accepted aliases — the domain is taken out of whatever you send
recordTypes	array	Which types to query (default: A, AAAA, MX, NS, TXT, CNAME, SOA, CAA)
resolver	string	google / cloudflare / quad9 / system (default google)
timeout	integer	Per-query timeout in seconds (default 8)
concurrency	integer	Domains resolved in parallel (default 20, max 50)

{
  "domains": ["example.com", "github.com"],
  "recordTypes": ["A", "MX", "TXT", "NS"],
  "resolver": "google"
}

Output

One dataset row per domain: domain, status, recordCount, resolver, the A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV arrays, the derived posture fields, plus errors and scannedAt.

status is one of ok, no_records, nxdomain (the domain does not exist — an authoritative answer), or lookup_failed (the resolver never answered).

{
  "domain": "github.com",
  "status": "ok",
  "recordCount": 42,
  "resolver": "google",
  "A": ["140.82.113.3"],
  "MX": ["1 aspmx.l.google.com."],
  "NS": ["dns1.p08.nsone.net.", "..."],
  "TXT": ["v=spf1 ..."],
  "hasSpf": true,
  "spfRecord": "v=spf1 ...",
  "hasDmarc": true,
  "dmarcPolicy": "quarantine",
  "hasMx": true,
  "mailProvider": "microsoft",
  "nsProvider": "aws-route53",
  "dnssecEnabled": false,
  "hasCaa": true,
  "wwwResolves": true,
  "ipv4Count": 1,
  "ipv6Count": 0,
  "errors": {},
  "scannedAt": "2026-09-15T..."
}

If the input has no usable domain, the run ends successfully with a single notice row explaining what to fix. Notice rows are never charged.

Use cases

• Email deliverability debugging — MX, SPF, DMARC policy and CAA in one row per domain
• Lead enrichment — tell which prospects run Google Workspace, Microsoft 365 or Zoho, and who hosts their DNS
• Infrastructure mapping — A/AAAA/NS/CNAME across a domain portfolio
• Migration & monitoring — snapshot DNS before and after changes
• Security recon — enumerate mail and name servers, check DNSSEC and CAA coverage for in-scope targets

Disclaimer

For informational purposes only. DNS responses reflect what the chosen resolver returns at query time and may be cached. The operator is not responsible for decisions made from these results.