Tech Enricher — Website Stack & Email/DNS Detector

Give it a list of domains. Get back the CMS, ecommerce, analytics, marketing, advertising, consent, support, hosting/CDN, and frontend framework technologies each one runs — plus its email provider and DNS host, from public DNS records.

A pay-as-you-go alternative to Wappalyzer and BuiltWith. No subscription, no seat fees.

What you get per domain

Field	Example
input	https://www.Stripe.com/pricing: the input exactly as you gave it, on every row (including duplicates, skipped and not-found rows), so each row joins back to your list
domain	stripe.com: the domain the input reduces to (see "Input")
technologies	React, Next.js, Cloudflare, Google Analytics (confirmed from the page's tags, scripts, headers or cookies)
technologiesByCategory	{"Frontend": ["React"], "Hosting": ["Cloudflare"]}
cspOnlyTechnologies	Technologies matched only through the site's Content-Security-Policy: the Content-Security-Policy or Content-Security-Policy-Report-Only header, a <meta http-equiv="Content-Security-Policy"> tag, or a policy string in the page's inline JSON, e.g. ["Vimeo", "Wistia"] for zoho.com, or only through a resource hint naming a vendor's host (<link rel="preconnect">, dns-prefetch or prefetch): no known fingerprint for them was found in the page's tags, scripts or other headers (a plain <a> link doesn't count as a load; preload and modulepreload do). A CSP or a hint names vendors the site allows or expects, so the site may load them through a tag manager or a self-hosted wrapper, or may have stopped using them. They are listed here for reference and are not included in technologies or technologiesByCategory, and they never make a row chargeable on their own
emailProvider	The inbound mail provider, from MX records. Mailbox providers: Google Workspace, Microsoft 365, Zoho Mail, ProtonMail, Fastmail, Amazon SES / WorkMail, Yandex 360, VK WorkSpace (Mail.ru). Mail security gateways in front of the mailbox: Mimecast, Proofpoint, Cisco Secure Email (IronPort), Broadcom/Symantec Email Security (MessageLabs), Barracuda Email Protection, Cloudflare Email Security (incl. Area 1), Trend Micro Email Security, Sophos Email, Hornetsecurity, Forcepoint Email Security, SpamTitan, FortiMail Cloud. Also HEY (HEY for Work). Forwarding: Cloudflare Email Routing (the inbox mail is forwarded to isn't visible in DNS), Mailgun (inbound routing) and ImprovMX (forwarding). Forward Email forwards mail or hosts the mailbox. Consumer mail is <Brand> (personal): Outlook.com (personal) for outlook.com/hotmail.com, Gmail (personal) for gmail.com, Yahoo (personal), Yandex (personal), Mail.ru (personal) and other free-mail domains, and any domain whose MX is the consumer Outlook.com service. Only the primary (lowest-numbered) MX records count, since that's where mail is delivered; a backup MX never names the provider. null when there's no MX or the primary MX isn't a recognised provider (e.g. self-hosted mail). Same answer as the emailProvider of our Email Security Signals Actor
dnsProvider	Cloudflare DNS, AWS Route 53, Google Cloud DNS, Google Domains, Google (own nameservers, e.g. google.com), Azure DNS, Vercel DNS, Netlify DNS, NS1, CSC, MarkMonitor, Akamai Edge DNS, GoDaddy DNS, … (from NS records). null when the nameservers aren't a recognised provider
spfSenders	third-party services allowed to send mail as this domain, from SPF include: and redirect= targets (up to 10). The domain's own SPF hosts (e.g. _spf.example.com) aren't listed; the services they include are, one level deep. Empty when the policy only lists IP ranges
server, finalUrl, httpStatus	raw signal for debugging
redirectedTo	recent.design when the homepage redirects to a different site (godly.website → recent.design): technologies are then that site's, while emailProvider, dnsProvider and spfSenders are still the input domain's. null when there's no redirect or it stays on the input's own domain (example.com → www.example.com, shop.example.com → example.com). A company's other domain is still named (notion.so → notion.com, google.co.uk → google.com)
parked	true on a free found: false row for a parked or for-sale domain (see "Pricing")
noSignal	true on a free found: false row for a live homepage where no confirmed technology, email provider, DNS provider or SPF sender was detected, or where no technology and no email provider were detected on a page with fewer than three links to its own pages and no email address at the site's own domain (that row also carries dnsOnly: true with the DNS host and SPF senders) (it may still carry cspOnlyTechnologies, vendors named only in its CSP or resource hints)
dnsOnly	true on a free found: false row whose homepage couldn't be read (unreachable, robots-blocked, error, bot-challenge or SSO sign-in redirect page, or a non-HTML answer such as a markdown page) but whose email/DNS profile could; technologies is absent
timedOut	true on a free found: false row for a domain that had no result within 90 seconds (the site or its DNS stalled); retry it

How it works

100% public data, no logins:

• Fetches the domain's homepage (https, falling back to http) and matches its HTML, script tags, response headers, and Content-Security-Policy (header or <meta http-equiv> tag; it reveals tags loaded dynamically via a tag manager, not just static <script> tags) against fingerprints for 152 technologies: Analytics 29, CMS 12, Frontend 14, Search 1 (Algolia), Marketing 23, Hosting/CDN 11, Support 8, CRM 5 (Salesforce, HubSpot CRM, Pipedrive, Zoho SalesIQ, Freshsales), Advertising 12 (Google Ads, Microsoft Advertising, TikTok Pixel, X (Twitter) Pixel, Reddit Pixel, Pinterest Tag, Snap Pixel, Google Ad Manager, Google AdSense, Prebid, Criteo, Outbrain), Ecommerce 6, Recruiting/ATS 4, Payments 7 (Stripe, PayPal, Braintree, Klarna, Afterpay (Clearpay), Affirm, Shop Pay), Video 4, Fonts 2, A/B testing 2, Consent Management 5 (OneTrust, Sourcepoint, Usercentrics, Cookiebot, Google Funding Choices), Monitoring 3 (Sentry, New Relic, SpeedCurve), Security 4 (reCAPTCHA, Akamai Bot Manager, Google Sign-In, Friendly Captcha). Publisher and media tools include Chartbeat, comScore, Nielsen, Marfeel, Cxense (Piano DMP), Cloudflare Web Analytics, Echobox, StorifyMe and AppsFlyer; also Adobe Experience Manager, Cloudinary, CrazyEgg and Ahrefs Analytics. The first 3MB of the homepage HTML is read, enough for large news homepages. CRM fingerprints only count a script the page actually loads (a <script src> or the CSP), not a link or a mention in the text, so a link to a Salesforce login page or a domain like workforce.com doesn't read as "uses Salesforce". Likewise, CMS, frontend and video fingerprints (and WooCommerce, Magento and BigCommerce) count only the site's own tags, scripts and styles: a review page that links to Squarespace or Ghost, or names them in its structured data, isn't reported as running on them. An applicant-tracking system (Greenhouse, Lever, Ashby, Workable) counts from its embed on the page, or from a job-board link whose board name matches the site's domain name, or where one of the two begins with the other and both are at least 5 characters long (example.com linking to boards.greenhouse.io/example, datadoghq.com to boards.greenhouse.io/datadog), so a job board or a portfolio page that links to other companies' boards isn't reported as using their ATS. Mailchimp signup links do count, since they point to the site's own list.
• Looks up MX, NS, and TXT (SPF) records over DNS-over-HTTPS to identify the email provider, DNS host, and third-party mail senders.
• Respects robots.txt (RFC 9309, for SiftsmithBot or *): skips domains whose rules disallow the homepage. The longest matching Allow or Disallow rule wins, so Allow: /$ with Disallow: / still allows the homepage.

Use cases

• Sales & RevOps: find accounts running the stack you integrate with or replace (e.g. "on WooCommerce, not Shopify").
• Recruiting agencies / hiring-signals pairing: cross-reference detected ATS (Greenhouse/Lever/Ashby/Workable) with Hiring Signals for a full pipeline.
• Competitive & market research: track which analytics/marketing tools a market segment standardizes on.
• Security/IT vendor risk: inventory external services a domain depends on (CDN, email, chat, forms) without agent installs.

Input

Domains, URLs, or email addresses. Each is reduced to its hostname: scheme, www., user@, port, path, ?query and #fragment are dropped, so https://www.stripe.com/pricing?ref=abc and jane@stripe.com both become stripe.com. A mistyped scheme (http:/stripe.com, https:stripe.com) is repaired the same way.

Pricing

$0.02 per profiled domain ($20 per 1,000), versus $250–450/month for Wappalyzer or BuiltWith plans. Unreachable, robots-blocked and bot-protected domains (an HTTP 4xx/5xx error, or a bot-challenge, CDN error, SSO sign-in redirect or other page with no title and almost no text of its own (200 characters or fewer) served in place of the homepage, or a script-only redirect stub to another page on the same site, or a markdown, JSON or plain-text answer instead of an HTML page), domains whose DNS lookup fails (retry those), parked or for-sale domains (a redirect to a domain-marketplace sale listing, parking-provider nameservers or mail servers, a parking lander or registrar parking redirect stub, a page such as "This domain may be for sale", "Buy this domain", "example.ai is for sale", "example.ai - Available for purchase" or "example.ai - Domain Name for Sale" (also in the other languages listed below, such as "Die Domain example.de steht zum Verkauf", "Domena example.pl na sprzedaż" or "Doména example.cz je na prodej"), an owner's sale page on the domain itself with few links of its own, titled like "example.de - Premium Domain kaufen" or "example.de kaufen | Premium-Domain", a tiny page titled with just the domain or its name, calling itself a domain, over a heading that only says it is for sale ("Datastudio doména" over "Jsem na prodej"), or, with no links and almost no text, described as "Domain for Sale", a redirect to another site's sale listing that names the domain, or to a listing page whose web address names the domain and that shows no heading of its own, or to another site's page whose web address carries the domain as a value (?domain=example.at) and that never names it otherwise, a registrar's parking page titled "Parking Page" or "Domain parked by

Duplicates are charged once. Inputs are deduplicated on the domain they reduce to, before anything is fetched: stripe.com, STRIPE.COM, www.stripe.com and stripe.com?ref=abc in one run give one charged profile. Each later duplicate still gets its own row, free, with its own input and duplicateOf set to the input that was profiled.

Use it in Clay

Clay has a built-in Apify integration, so this works as a per-row enrichment column:

1. In your Clay table, add an enrichment, search Apify, and choose Run Apify Actor.
2. Connect your Apify account with your Apify API token (Apify Console → Settings → API & Integrations).
3. Pick this Actor and enter the input as JSON, putting the row's value into the domains list. Clay's Apify integration guide shows how to insert a column into the JSON.
4. Run the column. Each row's result comes back into Clay, where you can split fields such as technologies into their own columns.

Billing: Apify charges $0.02 per profiled domain (unreachable domains are free) to your Apify account, with no per-run start fee. Clay counts the Action on its side but uses no Clay data credits when you bring your own Apify account.

Limits & honesty

• Covers 152 widely used technologies, not BuiltWith's or Wappalyzer's full catalogue.
• Homepage-only detection: technologies used exclusively on subpages (e.g. checkout, docs) won't show up.
• Signatures favor precision over recall — some technologies won't be flagged if they don't leave a homepage-visible marker. Report found: false and inaccuracies as an issue; fingerprints get added on request.
• No firmographic data (employee count, revenue, etc.) is included — none of that is available from public, unauthenticated sources without violating a platform's terms.

How-to guides

• Check which technologies a list of websites uses: how detection works from source, headers and DNS, and how to profile a whole list with this Actor.

Related tools

• Buyer Intent Signals: combines this tech-stack check with a hiring score into one 0–100 intent score per company, scored higher (×1.5, capped at 100) when a hiring company doesn't run the tool category you sell.
• Hiring Signals: a company's open jobs, recent posting velocity and hiring score from its public job board.
• Company Jobs: one row per open job from a company's public job board (8 ATSes), at $0.001 per job row. Use it to see which roles a company is hiring for.

Support

Open an issue on the Actor's Issues tab or email hello@siftsmith.com. Issues are read daily and fixed promptly.