Company Domain Profiler: Contacts, Tech Stack, Socials & DNS

What does Company Domain Profiler do?

Company Domain Profiler turns a company domain into one clean JSON profile. Send stripe.com and you get back one row: the company name, contact emails and phones, social profiles, tech stack, email provider (MX), SPF and DMARC, domain age (RDAP), SSL certificate expiry, and links to the pricing, careers, docs, blog and status pages.

One run replaces a contact-details scraper, a tech-stack lookup and a DNS/WHOIS tool, with no joins and no guesswork. It uses plain HTTP and public standards (DNS, RDAP, TLS, schema.org), so it's fast and cheap. It's built for lead enrichment in Clay, n8n and Make, and for AI agents researching a company over MCP.

30-second example

Input:

{ "domains": ["stripe.com"] }

Output (real run on Apify, trimmed):

{
    "input": "stripe.com",
    "domain": "stripe.com",
    "status": "ok",
    "finalUrl": "https://stripe.com/",
    "company": {
        "name": "Stripe",
        "description": "Stripe powers online and in-person payment processing and financial solutions for businesses of all sizes.",
        "language": "en-us"
    },
    "contacts": {
        "emails": [
            {
                "value": "privacy@stripe.com",
                "type": "role",
                "sameDomain": true,
                "source": "https://stripe.com/privacy"
            },
            {
                "value": "careers@stripe.com",
                "type": "role",
                "sameDomain": true,
                "source": "https://stripe.com/careers"
            }
        ],
        "phones": [{ "value": "+18889262289", "source": "https://stripe.com/" }]
    },
    "socials": {
        "linkedin": "https://www.linkedin.com/company/stripe",
        "x": "https://x.com/stripe",
        "facebook": "https://www.facebook.com/StripeHQ",
        "instagram": "https://www.instagram.com/stripehq",
        "youtube": "https://www.youtube.com/@stripe",
        "tiktok": null,
        "github": "https://github.com/stripe"
    },
    "techStack": [
        { "name": "Nginx", "categories": ["Web servers", "Reverse proxies"], "confidence": 100, "source": "website" },
        { "name": "Salesforce", "categories": ["CRM"], "confidence": 100, "source": "dns" },
        { "name": "Linear", "categories": ["CRM"], "confidence": 100, "source": "dns" },
        { "name": "DigiCert", "categories": ["SSL/TLS certificate authorities"], "confidence": 100, "source": "tls" }
    ],
    "emailInfra": {
        "mxProvider": "Google Workspace",
        "acceptsMail": true,
        "spf": { "present": true, "allQualifier": "~all", "includes": ["spf1.stripe.com", "_spf.qualtrics.com"] },
        "dmarc": { "present": true, "policy": "reject", "pct": 100 }
    },
    "domainInfo": { "registeredAt": "1995-09-12T04:00:00.000Z", "ageDays": 11336, "registrar": "SafeNames Ltd." },
    "ssl": { "issuer": "DigiCert Inc", "validTo": "2026-11-12T23:59:59.000Z", "daysUntilExpiry": 48, "trusted": true },
    "keyPages": {
        "pricing": "https://stripe.com/pricing",
        "careers": "https://stripe.com/careers",
        "docs": "https://docs.stripe.com/",
        "status": "https://status.stripe.com/",
        "changelog": "https://docs.stripe.com/changelog",
        "llmsTxt": "https://stripe.com/llms.txt"
    },
    "pagesFetched": 6,
    "durationMs": 2312,
    "errors": []
}

Why use Company Domain Profiler?

• One row per domain, always. Every input domain returns exactly one item, in the order you sent them, with your original input echoed back for joins. Dead or parked domains come back too, as status: "unreachable".
• Predictable price. You pay per domain profiled, not per page crawled, so a site with 3,000 pages costs the same as one with 3. Unreachable and parked domains are free.
• More than contacts. Email security posture (SPF/DMARC), email provider, domain age and SSL expiry are what agencies and sales teams use to qualify and personalise outreach ("your DMARC policy is none").
• Fast and reliable. HTTP only, no headless browser. On a 500-domain benchmark: 3.7 minutes, 0 crashes, a result for every live domain, a median of ~2.5 s per domain. A failure in one part (say, RDAP) never loses the rest of the profile: it's listed in errors[] and the item still returns.
• Agent-ready. Small, stable, documented JSON that works well as an MCP tool for Claude, ChatGPT and other agents.

Use cases

• Lead enrichment: add company name, generic contact emails, LinkedIn and email provider to a list of domains in Clay, HubSpot or a spreadsheet.
• Prospect audits for agencies: find sites with no DMARC, an expiring SSL certificate, or an outdated CMS.
• Market mapping: see which tools a segment uses (Shopify vs WooCommerce, HubSpot vs Salesforce, Google Workspace vs Microsoft 365).
• AI research agents: give an agent one tool call that returns a whole company profile.

How to use Company Domain Profiler

1. Open the Actor and go to the Input tab.
2. Paste your domains into Company domains, one per line. URLs are fine; they're normalised to the domain.
3. Optionally pick Modules to collect only what you need (all are on by default).
4. Click Start. A few hundred domains usually take a few minutes.
5. Download the results as JSON, CSV or Excel, or use the API and integrations below.

Want to see it first? Run a ready-made example: Profile 10 SaaS companies or the Email security audit (MX, SPF, DMARC and SSL for 10 domains).

Input

Field	Type	Default	Description
domains	array of strings	(required)	Company domains or URLs. Deduplicated; output keeps input order.
modules	array	all	Any of identity, contacts, socials, techStack, emailInfra, domainInfo, ssl, keyPages.
maxPagesPerDomain	integer 0–20	5	Extra pages read besides the homepage (contact, about, impressum, careers…). 5 are included in the price.
excludePersonalEmails	boolean	false	Return only role addresses (info@, sales@…), dropping ones that look like a person's.
maxConcurrency	integer	25	Domains processed in parallel.

Output fields

You can download the dataset in formats such as JSON, CSV, Excel or HTML. Each item has these fields:

Field	What it contains	Source
status	ok, partial (site blocked or a module failed; DNS/SSL/RDAP still filled) or unreachable (no website or parked; not charged)	—
company	name, description, logo, favicon, address, foundingDate, language	schema.org JSON-LD, Open Graph, <title>
contacts.emails[]	value, type (role/personal), sameDomain, source page	mailto: links, page text (including [at] and Cloudflare-obfuscated emails), JSON-LD
contacts.phones[]	E.164 number + source page	tel: links, JSON-LD, formatted numbers in text (validated)
socials	linkedin, x, facebook, instagram, youtube, tiktok and github company pages (share links and personal profiles dropped)	Links and JSON-LD sameAs
techStack[]	name, categories, confidence, version, source (website, dns or tls)	7,600+ open-source fingerprints over headers, HTML, scripts, meta, cookies and DNS
emailInfra	mxRecords, mxProvider, acceptsMail, spf (record, includes, ~all/-all), dmarc (policy, subdomain policy, pct)	DNS
domainInfo	registeredAt, expiresAt, updatedAt, ageDays, registrar, rdapServer	RDAP (null for TLDs without RDAP, e.g. .de)
ssl	host, issuer, validFrom, validTo, daysUntilExpiry, subjectAltNames, trusted	TLS handshake
keyPages	pricing, careers, docs, blog, status, changelog, contact, about, llmsTxt, robotsTxt, sitemapXml	Site links, ATS hosts (Lever, Greenhouse…), well-known files
errors[]	module, code, message for anything that failed	—
input, domain, finalUrl, httpStatus, redirectedToDomain, parked, pagesFetched, durationMs, profiledAt	Run metadata	—

Pairs well with Company Hiring Signals: the same accounts' open roles, hiring velocity and hiring_sales / hiring_engineering signals, $0.006 a company.

How much does it cost to profile company domains?

Pricing is pay-per-event:

Event	Free plan	Starter	Scale	Business
Domain profiled (ok or partial)	$0.006	$0.0055	$0.005	$0.0045
Unreachable or parked domain	free	free	free	free
Extra page beyond 5 per domain (only if you raise maxPagesPerDomain)	$0.001	$0.0009	$0.0008	$0.0007

1,000 domains ≈ $6 on the free plan ($4.50 on Business). A list of 10,000 domains with ~15% dead or parked costs about $51. Apify's free plan credit covers roughly the first 800 domains each month.

Integrations

API (one call, results back)

curl -X POST "https://api.apify.com/v2/acts/vicarious_film~domain-profiler/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domains": ["stripe.com", "allbirds.com"]}'

n8n

Use the Apify node (Run an Actor and get dataset → Actor vicarious_film/domain-profiler, input {"domains": ["{{ $json.domain }}"]}), or an HTTP Request node that POSTs to the run-sync-get-dataset-items URL above. Each output item maps 1:1 to an input domain.

Make

Add Apify → Run an Actor (Actor: vicarious_film/domain-profiler, "Run synchronously" on), then Apify → Get Dataset Items with the run's defaultDatasetId.

Clay

Add an HTTP API enrichment column: method POST, URL https://api.apify.com/v2/acts/vicarious_film~domain-profiler/run-sync-get-dataset-items?token=YOUR_TOKEN, body {"domains": ["{{Domain}}"]}. Then map company.name, contacts.emails, socials.linkedin and emailInfra.mxProvider into columns.

AI agents (MCP)

Add Apify's MCP server with this Actor as a tool, e.g. for Claude:

{ "mcpServers": { "apify": { "url": "https://mcp.apify.com/?actors=vicarious_film/domain-profiler" } } }

Then ask: "Profile stripe.com and tell me their email provider and DMARC policy."

Tips

• Only need email security? Set modules to ["emailInfra", "ssl", "domainInfo"]. No website pages are fetched, so it's very fast. The Email security audit task is set up this way.
• Homepage only: set maxPagesPerDomain to 0. You'll get fewer contacts but faster runs.
• Joining back to your list: use input (your original value) or domain (normalised).
• Want to know who's hiring? keyPages.careers tells you a careers page exists; Company Hiring Signals turns the same domains into open roles, new roles in 30 days and ready-to-filter signals like hiring_sales.

FAQ

Why are some emails missing? The Actor only returns contacts the company publishes in its site's HTML (homepage plus up to 5 pages such as contact, about and impressum). Sites that load contacts with JavaScript, or behind forms, return fewer contacts; their errors[] then includes JS_RENDERED. You're charged the same flat price either way, never per page.

What does partial mean? The website blocked automated access (e.g. a Cloudflare challenge) or one module failed. DNS, SSL and RDAP data are still returned. errors[] says what happened.

Will I be charged for dead domains? No. unreachable (no website, DNS failure, parked or for-sale) is never charged.

Is the tech stack accurate? Detection uses 7,600+ community-maintained fingerprints from open-source Wappalyzer data, matched against headers, HTML, scripts, cookies, meta tags and DNS records. source: "dns" entries come from DNS verification records (e.g. a company that verified its domain with a SaaS tool), which shows tools they use even when those tools aren't on the website.

Do you scrape LinkedIn or other platforms? No. We only link to the company pages the site itself links to. Everything comes from the company's own website and public internet infrastructure (DNS, RDAP, TLS).

Results come back in a different order? They don't: output order always matches input order, and duplicates are removed.

GDPR and legal

This Actor collects only information a company publishes about itself on its own website, plus public DNS, RDAP and TLS data. Some returned emails may belong to individuals (type: "personal"); under GDPR and similar laws, you are responsible for having a lawful basis to process them. Use excludePersonalEmails: true to keep only role addresses (info@, sales@…). RDAP registrant personal data is never collected. Don't use the results for unsolicited bulk email where that's illegal. See Apify's guide to ethical scraping.

Support

Found a wrong or missing field? Open an issue on the Issues tab with the domain and what you expected. Issues get a reply within 24 hours. Need a custom field or integration? Ask in an issue.