Tech Enricher — Website Stack & Email/DNS Detector

Give it a list of domains. Get back the CMS, ecommerce, analytics, marketing, support, hosting/CDN, and frontend framework technologies each one runs — plus its email provider and DNS host, from public DNS records.

A pay-as-you-go alternative to Wappalyzer and BuiltWith. No subscription, no seat fees.

What you get per domain

Field	Example
input	https://www.Stripe.com/pricing: the input exactly as you gave it, on every row (including duplicates, skipped and not-found rows), so each row joins back to your list
domain	stripe.com: the domain the input reduces to (see "Input")
technologies	React, Next.js, Cloudflare, Google Analytics
technologiesByCategory	{"Frontend": ["React"], "Hosting": ["Cloudflare"]}
emailProvider	Google Workspace, Microsoft 365, Zoho Mail, or a mail security gateway in front of the mailbox (Mimecast, Proofpoint, Cisco Secure Email, Broadcom/Symantec MessageLabs, Barracuda), from MX records, lowest preference number first (the server mail is actually delivered to; higher-numbered records are backups). null when no MX host is a recognised provider (e.g. self-hosted mail)
dnsProvider	Cloudflare DNS, AWS Route 53, Google Cloud DNS, Google Domains, Google (own nameservers, e.g. google.com), Azure DNS, Vercel DNS, Netlify DNS, NS1, CSC, MarkMonitor, Akamai Edge DNS, GoDaddy DNS, … (from NS records). null when the nameservers aren't a recognised provider
spfSenders	third-party services allowed to send mail as this domain, from SPF include: and redirect= targets (up to 10). The domain's own SPF hosts (e.g. _spf.example.com) aren't listed; the services they include are, one level deep. Empty when the policy only lists IP ranges
server, finalUrl, httpStatus	raw signal for debugging
parked	true on a free found: false row for a parked or for-sale domain (see "Pricing")
noSignal	true on a free found: false row for a live homepage where nothing at all was detected
dnsOnly	true on a free found: false row whose homepage couldn't be read (unreachable, robots-blocked, error, bot-challenge or SSO sign-in redirect page) but whose email/DNS profile could; technologies is absent

How it works

100% public data, no logins:

• Fetches the domain's homepage (https, falling back to http) and matches its HTML, script tags, response headers, and Content-Security-Policy (which reveals tags loaded dynamically via a tag manager, not just static <script> tags) against fingerprints for 84 technologies: Analytics 15, CMS 11, Frontend 10, Hosting/CDN 9, Marketing 9, Support 7, CRM 5 (Salesforce, HubSpot CRM, Pipedrive, Zoho SalesIQ, Freshsales), Ecommerce 4, Recruiting/ATS 4, Payments 3, Video 3, Fonts 2, A/B testing 2. CRM fingerprints only count a script the page actually loads (a <script src> or the CSP), not a link or a mention in the text, so a link to a Salesforce login page or a domain like workforce.com doesn't read as "uses Salesforce".
• Looks up MX, NS, and TXT (SPF) records over DNS-over-HTTPS to identify the email provider, DNS host, and third-party mail senders.
• Respects robots.txt: skips domains that disallow root-path fetches.

Use cases

• Sales & RevOps: find accounts running the stack you integrate with or replace (e.g. "on WooCommerce, not Shopify").
• Recruiting agencies / hiring-signals pairing: cross-reference detected ATS (Greenhouse/Lever/Ashby/Workable) with Hiring Signals for a full pipeline.
• Competitive & market research: track which analytics/marketing tools a market segment standardizes on.
• Security/IT vendor risk: inventory external services a domain depends on (CDN, email, chat, forms) without agent installs.

Input

Domains, URLs, or email addresses. Each is reduced to its hostname: scheme, www., user@, port, path, ?query and #fragment are dropped, so https://www.stripe.com/pricing?ref=abc and jane@stripe.com both become stripe.com. A mistyped scheme (http:/stripe.com, https:stripe.com) is repaired the same way.

Pricing

$0.02 per profiled domain ($20 per 1,000), versus $250–450/month for Wappalyzer or BuiltWith plans. Unreachable, robots-blocked and bot-protected domains (an HTTP 4xx/5xx error, or a bot-challenge or SSO sign-in redirect page served in place of the homepage), domains whose DNS lookup fails (retry those), parked or for-sale domains (a redirect to a domain-marketplace sale listing, parking-provider nameservers or mail servers, or a parking lander such as "This domain may be for sale"; the row carries parked: true), homepages where no technology, email provider, DNS provider or SPF sender is detected at all (a live but self-hosted or minimal site; the row carries noSignal: true), and unparseable, bare-IP and localhost / private-network inputs are free (returned as found: false with an error). When the homepage can't be read but the DNS lookups succeed and find at least one of an email provider, DNS provider or SPF sender (common for large sites behind bot protection), the free row also carries dnsOnly: true with emailProvider, dnsProvider and spfSenders, so you still get the email and DNS profile at no charge. If those DNS lookups fail, the row has dnsLookupFailed: true instead; retry the domain for its DNS profile. IP addresses and private names are rejected before anything is fetched. Set a max charge per run and you're never charged more than that: once it's reached, every remaining input still gets a short free row with skipped: true and a reason (bare-IP, localhost and private-network inputs keep their own error row), so no input goes missing from the dataset.

Duplicates are charged once. Inputs are deduplicated on the domain they reduce to, before anything is fetched: stripe.com, STRIPE.COM, www.stripe.com and stripe.com?ref=abc in one run give one charged profile. Each later duplicate still gets its own row, free, with its own input and duplicateOf set to the input that was profiled.

Use it in Clay

Clay has a built-in Apify integration, so this works as a per-row enrichment column:

1. In your Clay table, add an enrichment, search Apify, and choose Run Apify Actor.
2. Connect your Apify account with your Apify API token (Apify Console → Settings → Integrations).
3. Pick this Actor and enter the input as JSON, putting the row's value into the domains list. Clay's Apify integration guide shows how to insert a column into the JSON.
4. Run the column. Each row's result comes back into Clay, where you can split fields such as technologies into their own columns.

Billing: Apify charges $0.02 per profiled domain (unreachable domains are free) to your Apify account, with no per-run start fee. Clay counts the Action on its side but uses no Clay data credits when you bring your own Apify account.

Limits & honesty

• Covers 84 widely used technologies, not BuiltWith's or Wappalyzer's full catalogue.
• Homepage-only detection: technologies used exclusively on subpages (e.g. checkout, docs) won't show up.
• Signatures favor precision over recall — some technologies won't be flagged if they don't leave a homepage-visible marker. Report found: false and inaccuracies as an issue; fingerprints get added on request.
• No firmographic data (employee count, revenue, etc.) is included — none of that is available from public, unauthenticated sources without violating a platform's terms.

Related tools

• Buyer Intent Signals: combines this tech-stack check with a hiring score into one 0–100 intent score per company, scored higher (×1.5, capped at 100) when a hiring company doesn't run the tool category you sell.
• Hiring Signals: a company's open jobs, recent posting velocity and hiring score from its public job board.

Support

Open an issue on the Actor's Issues tab or email hello@siftsmith.com. Issues are read daily and fixed promptly.

More tools from Siftsmith (formerly ToolFoundry): siftsmith.com.