Bulk DNS Lookup - MX, SPF, DMARC, DKIM, TXT, A & NS Records

Check DNS records for hundreds or thousands of domains in one run: A, AAAA, MX, NS, TXT, CNAME, SOA and CAA, plus a full email-authentication audit - parsed SPF (all-mechanism, includes), DMARC policy / pct / rua, DKIM keys found on common selectors, BIMI, the email provider behind the MX (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho...) and a 0-100 email-security score with a list of issues. Input can be domains, URLs or email addresses. Uses DNS-over-HTTPS (Cloudflare, with Google fallback) - 4 domains in well under a second.

Who uses it

• Cold-email & deliverability agencies: audit prospects' or clients' SPF/DMARC/DKIM before a campaign; find domains with weak DMARC (a sales trigger for your service).
• B2B sales & lead enrichment: tag leads by email provider (Google Workspace vs Microsoft 365) to personalise outreach and segment lists.
• Security / IT / MSPs: bulk-check client domains for missing DMARC, permissive SPF (+all, ?all), CAA and nameserver changes.
• Domain investors & migrations: verify where hundreds of domains point (A, NS, CNAME) after a move.
• Automation: schedule it and alert on changes via n8n / Make / Zapier / the Apify API.

Input

Field	Description
domains	Domains, URLs or emails - the domain is extracted and deduplicated.
recordTypes	A, AAAA, MX, NS, TXT, CNAME, SOA, CAA (default all).
checkEmailSecurity	SPF/DMARC/DKIM/BIMI audit, provider and score (default on).
dkimSelectors	Selectors to probe (default google, selector1, selector2, default, k1, s1, mail).
concurrency	Domains in parallel (default 10).

{ "domains": ["stripe.com", "https://www.hubspot.com/pricing", "info@microsoft.com"], "recordTypes": ["A", "MX", "TXT"] }

Output (one row per domain)

{
  "domain": "stripe.com", "status": "ok", "dnsStatus": "NOERROR",
  "a": ["198.202.176.161", "198.137.150.161"],
  "mx": [{ "priority": 10, "host": "aspmx.l.google.com" }, { "priority": 20, "host": "alt1.aspmx.l.google.com" }, "..."],
  "ns": ["..."], "txt": ["MS=ms80697640", "..."],
  "emailProvider": "Google Workspace", "hasMx": true, "nullMx": false,
  "spf": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
  "spfValid": true, "spfAll": "~", "spfIncludes": ["spf1.stripe.com", "greenhouse-outbound-mail.stripe.com", "_spf.qualtrics.com"],
  "dmarc": "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;",
  "dmarcPolicy": "reject", "dmarcPct": 100, "dmarcRua": ["mailto:dmarc-reports@stripe.com"],
  "dkimSelectorsFound": ["google", "s1"], "bimi": null,
  "emailSecurityScore": 95, "emailSecurityIssues": []
}

Unregistered domains return status: "nxdomain". Invalid inputs are listed with status: "invalid" and not charged.

Score: MX 20 + SPF 25 (15 if permissive) + DMARC 35 reject / 30 quarantine / 15 none + DKIM found 15 + BIMI 5. DKIM can only be detected for the selectors probed - a missing DKIM result does not prove the domain has no DKIM.

Pricing (pay per event)

• $0.002 per domain checked (domain-dns) - 1,000 domains = $2, with all record types and the email audit included.
• Tiny start fee per run (apify-actor-start). Invalid domains and lookup errors are not charged. Set "Maximum cost per run" to cap spend.

Notes

• Only public DNS data is queried; nothing is sent to the domains themselves. Results reflect public resolvers at run time (TTL caching may delay very recent changes by minutes).
• Need mailbox-level checks? See our Email Verifier (MX + disposable) Actor. Need WHOIS / expiry? See Bulk Domain WHOIS (RDAP).