DNS & Domain Intelligence Scraper (SPF, DMARC, DKIM, DNSSEC)

Here is one real result, with every field the actor returns:

{
  "domain": "github.com",
  "registrableDomain": "github.com",
  "resolvedIps": ["140.82.114.3"],
  "aRecords": ["140.82.114.3"],
  "aaaaRecords": [],
  "nameservers": [
    "dns1.p08.nsone.net",
    "dns2.p08.nsone.net",
    "ns-1283.awsdns-32.org",
    "ns-1707.awsdns-21.co.uk"
  ],
  "mxRecords": [
    { "host": "github-com.mail.protection.outlook.com", "priority": 0 }
  ],
  "mailProvider": "Microsoft 365",
  "cnames": [],
  "txtRecords": [
    "MS=ms44452932",
    "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com ... ~all",
    "google-site-verification=UTM-3akMgubp6tQtgEuAkYNYLyYAvpTnnSrDMWoDR3o",
    "facebook-domain-verification=39xu4jzl7roi7x0n93ldkxjiaarx50",
    "apple-domain-verification=RyQhdzTl6Z6x8ZP4"
  ],
  "spfRecord": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com ... ~all",
  "hasSpf": true,
  "spfPolicy": "softfail (~all)",
  "dmarcRecord": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
  "hasDmarc": true,
  "dmarcPolicy": "quarantine",
  "dmarcSubdomainPolicy": "reject",
  "dmarcPct": 100,
  "dmarcRua": "mailto:dmarc@github.com",
  "dkimSelectorsFound": ["google", "selector1", "k1", "s1"],
  "caaRecords": [
    { "flag": 0, "tag": "issue", "value": "letsencrypt.org" },
    { "flag": 0, "tag": "issuewild", "value": "sectigo.com" }
  ],
  "hasCaa": true,
  "caaIssuers": ["letsencrypt.org", "digicert.com", "sectigo.com", "globalsign.com"],
  "soa": {
    "mname": "dns1.p08.nsone.net",
    "rname": "hostmaster.nsone.net",
    "serial": 1656468023,
    "refresh": 43200,
    "retry": 7200,
    "expire": 1209600,
    "minimumTtl": 3600
  },
  "dnssecEnabled": false,
  "txtVerifications": {
    "ms": "ms44452932",
    "google-site-verification": "UTM-3akMgubp6tQtgEuAkYNYLyYAvpTnnSrDMWoDR3o",
    "facebook-domain-verification": "39xu4jzl7roi7x0n93ldkxjiaarx50",
    "apple-domain-verification": "RyQhdzTl6Z6x8ZP4",
    "atlassian-domain-verification": "jjgw98AKv2aeoYFxiL/VFaoyPkn3undEssTRuMg6C/3Fp/iqhkV4HVV7WjYlVeF8"
  },
  "ttlByType": { "NS": 249, "A": 60, "MX": 98, "SOA": 2701, "TXT": 45, "CAA": 3600 },
  "resolverUsed": "google",
  "mailIpListed": false,
  "dnsblListedOn": [],
  "dnsblListedCount": 0,
  "aiRiskLevel": "low",
  "aiRiskVerdict": "GitHub enforces a strong email-authentication posture: SPF is published, DMARC is set to quarantine with a reject policy on subdomains, and multiple valid DKIM selectors resolve, so the domain is hard to spoof. No sending IP appears on the checked mail blocklists, indicating healthy deliverability. Enabling DNSSEC would further harden the zone against tampering.",
  "queriedAt": "2026-08-16T05:22:45.186Z",
  "error": null
}

mailIpListed, dnsblListedOn, dnsblListedCount, aiRiskLevel and aiRiskVerdict are populated only when the optional paid add-ons are enabled (see Billing and limits).

The most complete DNS lookup on Apify. Where other DNS actors hand you a flat list of raw records, this one resolves every record type over encrypted DNS-over-HTTPS and then parses the results into ready-to-use intelligence: your email-security posture (SPF, DMARC, DKIM, DNSSEC), the mail provider behind the MX, the certificate authorities allowed by CAA, and a clean map of every domain-ownership verification token hiding in TXT. One rich row per domain, or one row per record if you prefer.

📥 Input · 📤 Output · 💰 Pricing · ▶️ Examples

Table of contents

• What it does
• Use cases
• Why it beats a plain DNS lookup
• Quickstart
• Input reference
• Output reference
• Run via API and CLI
• Fetch results
• Billing and limits
• FAQ and troubleshooting

What it does

Give the actor one or more domains. For each domain it queries A, AAAA, MX, NS, TXT, SOA, CNAME and CAA records over DNS-over-HTTPS, plus the DMARC record at _dmarc.<domain> and a set of common DKIM selectors. It then derives:

• Resolved IPs from A and AAAA records.
• Mail provider inferred from the MX hosts (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho, Proton, Amazon, self-hosted and more).
• Email-security posture: spfRecord with a parsed spfPolicy, dmarcRecord with dmarcPolicy, dmarcPct and dmarcRua, and the DKIM selectors that actually resolve.
• Certificate authority policy from CAA, with a clean caaIssuers list.
• DNSSEC status from the resolver's authenticated-data flag.
• Ownership verification tokens (Google, Microsoft, Facebook, Apple, Atlassian, Stripe and dozens more) pulled out of TXT into a txtVerifications map.
• SOA authority details and a ttlByType map.

It pairs naturally with the Certificate Transparency & Subdomain Discovery Scraper as an OSINT, attack-surface and KYB suite.

Use cases

• Email deliverability and DNS audit: bulk-check SPF, DMARC, DKIM and DNSSEC across a domain portfolio to find spoofable domains and misconfigured mail security before attackers do.
• Email spoofing and phishing risk assessment: score how easily each domain can be impersonated, with an optional AI verdict that explains the risk in plain English for non-technical stakeholders.
• Mail-server reputation and blocklist monitoring: check whether a domain's sending IPs are listed on Spamhaus, SpamCop, Barracuda or SORBS blocklists that hurt inbox placement.
• Attack-surface and OSINT recon: map name servers, mail providers, resolved IPs and CAA certificate-authority policy for a target domain during security research.
• KYB and vendor due diligence: enrich a company domain with DNS hygiene, mail provider and ownership-verification signals for onboarding and compliance checks.
• Lead enrichment for cold email and sales: detect the email provider (Google Workspace, Microsoft 365, Proofpoint and more) and domain configuration behind a prospect list.
• Cloud and SaaS inventory: extract Google, Microsoft, Facebook, Apple, Atlassian and Stripe domain-ownership verification tokens from TXT to see which platforms a domain is wired into.
• Migration and monitoring: snapshot DNS records, TTLs and SOA serials before and after a DNS or email migration to confirm nothing broke.

Why it beats a plain DNS lookup

A typical DNS actor returns raw record strings and stops there. This actor:

• Parses email security (SPF policy, DMARC policy and percentage, DKIM selectors present) instead of leaving you to read raw TXT.
• Identifies the mail provider and allowed certificate authorities for you.
• Reports DNSSEC validation, not just records.
• Extracts every domain-ownership verification token into a structured map.
• Uses encrypted DNS-over-HTTPS with Google primary and Cloudflare fallback, so lookups are reliable and never blocked.

Quickstart

Open the actor, paste this into the input, and press Run.

{
  "domains": ["stripe.com", "github.com", "cloudflare.com"]
}

You get one rich intelligence row per domain. Set perRecordRows to true to get one row per individual DNS record instead.

Input reference

Field	Type	Description
domains	array	One or more domains to look up (registered domain only, no http or path).
domain	string	Alternative single domain, or several separated by commas, spaces or new lines.
recordTypes	array	Which record types to query. Defaults to A, AAAA, MX, NS, TXT, SOA, CNAME, CAA. DMARC and DKIM are always attempted.
resolver	string	auto (Google primary, Cloudflare fallback), google, or cloudflare. Default auto.
perRecordRows	boolean	When true, emit one row per DNS record instead of one rich row per domain. Default false.
withDnsblCheck	boolean	Opt-in paid add-on. Check each domain's resolved IPv4 against public mail blocklists (Spamhaus, SpamCop, Barracuda, SORBS) and return mailIpListed, dnsblListedOn and dnsblListedCount. Default false. Disabled for free accounts.
withAiRisk	boolean	Opt-in AI add-on. Turn the SPF, DMARC, DKIM, DNSSEC and blocklist findings into a plain-English aiRiskLevel and aiRiskVerdict on spoofability and deliverability risk. Default false. Disabled for free accounts.
maxDomains	integer	Maximum number of domains to process. Free accounts are capped at 10 per run.
proxyConfiguration	object	Optional proxy. DNS-over-HTTPS works without one; only needed for very large batches.

Output reference

One row per domain (default mode):

Field	Description
domain	Domain that was queried.
registrableDomain	Registrable (apex) domain.
resolvedIps / aRecords / aaaaRecords	Resolved IPv4 and IPv6 addresses.
nameservers	Authoritative name servers.
mxRecords	Mail exchangers with host and priority.
mailProvider	Email provider derived from MX.
cnames	CNAME targets.
txtRecords	All TXT records.
spfRecord / hasSpf / spfPolicy	SPF record and parsed all-mechanism policy.
dmarcRecord / hasDmarc / dmarcPolicy / dmarcSubdomainPolicy / dmarcPct / dmarcRua	Parsed DMARC posture.
dkimSelectorsFound	DKIM selectors detected among common names.
caaRecords / hasCaa / caaIssuers	CAA records and allowed certificate authorities.
soa	Start of authority (mname, rname, serial, timers).
dnssecEnabled	Whether the resolver reported DNSSEC validation.
txtVerifications	Map of extracted domain-ownership verification tokens.
ttlByType	Minimum TTL observed per record type.
resolverUsed	Which resolver answered (google or cloudflare).
mailIpListed / dnsblListedOn / dnsblListedCount	Mail-IP blocklist status (only with the withDnsblCheck add-on).
aiRiskLevel / aiRiskVerdict	AI spoofability and deliverability risk verdict (only with the withAiRisk add-on).
queriedAt	When the lookup was performed.
error	Error message, if any.

In per-record mode each row has domain, recordType, name, value, ttl, optional selector, queriedAt and error.

Run via API and CLI

$apify call scrapers_lat/dns-domain-intelligence-scraper --input='{"domains":["stripe.com","github.com"]}'

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~dns-domain-intelligence-scraper/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["stripe.com","github.com"]}'

Fetch results

$curl "https://api.apify.com/v2/datasets/DATASET_ID/items?token=YOUR_TOKEN&format=json"

Swap format=json for csv or xlsx to export a spreadsheet.

Billing and limits

This actor is billed pay per result: you are charged for each domain intelligence record returned (or each DNS record in per-record mode). Domains that cannot be resolved return an error row and are not charged. Free Apify accounts are capped at 10 domains per run; upgrade for more.

Two optional paid add-ons are available, both default off and both disabled for free accounts:

• Mail-IP blocklist check (withDnsblCheck, $0.012 per domain): checks the domain's resolved IPv4 against public mail blocklists and returns the listing status. Charged once per domain only when the checks complete (a clean result still counts).
• AI email-security risk verdict (withAiRisk, $0.012 per domain): produces a plain-English risk level and verdict on spoofability and deliverability. Charged only when a usable AI verdict is produced; if the AI service is unavailable, the field is left empty and you are not charged.

FAQ and troubleshooting

Is this blocked by bots or rate limits? No. It uses public DNS-over-HTTPS endpoints from Google and Cloudflare, which are designed for programmatic use. There is no browser and no bot wall.

Why is DNSSEC false for a big domain? DNSSEC reflects whether the domain's zone is signed and validated. Many large domains still do not sign their zones, so false is the correct, real answer.

Why are some DKIM selectors missing? DKIM selectors are private to each sender and not discoverable from DNS alone. The actor checks a set of common selector names on a best-effort basis and reports the ones that resolve. A domain can use DKIM with a custom selector that is not in the common list.

Can I get raw records instead of the parsed summary? Yes, set perRecordRows to true for one row per individual DNS record.

What does the mail provider field detect? It infers the provider from MX hostnames, covering the major platforms. Domains with custom or uncommon MX hosts are reported as self-hosted or other.