Option 1: look it up from the command line
On Windows, macOS or Linux:
nslookup -type=mx stripe.com
nslookup -type=txt stripe.com
On macOS or Linux, dig gives shorter output:
dig mx stripe.com +short
dig txt stripe.com +short
Then match the mail servers against this table:
| MX host contains | Email provider |
|---|---|
smtp.google.com, aspmx.l.google.com | Google Workspace |
mail.protection.outlook.com | Microsoft 365 (Exchange Online) |
mx.zoho.com (or .eu, .in…) | Zoho Mail |
protonmail.ch | Proton Mail |
messagingengine.com | Fastmail |
mx.cloudflare.net | Cloudflare Email Routing (forwards to another inbox) |
mimecast.com, pphosted.com, barracudanetworks.com | A security gateway (Mimecast, Proofpoint, Barracuda) in front of the real mailbox provider |
When a gateway sits in front, check the SPF record for the mailbox provider behind it. SPF also lists the services allowed to send as the domain:
| SPF include | Sending service |
|---|---|
_spf.google.com | Google Workspace |
spf.protection.outlook.com | Microsoft 365 |
sendgrid.net | SendGrid |
mailgun.org | Mailgun |
amazonses.com | Amazon SES |
servers.mcsv.net, spf.mandrillapp.com | Mailchimp, Mandrill |
hubspotemail.net | HubSpot |
_spf.salesforce.com | Salesforce |
mail.zendesk.com | Zendesk |
spf.mtasv.net | Postmark |
TXT records often also hold domain verifications such as atlassian-domain-verification=… or facebook-domain-verification=…, which show tools the company has connected its domain to.
Option 2: check a list of domains at once
Our Tech Stack Detector reads the MX, SPF and other TXT records for every domain in a list, alongside its website technologies. The email column holds the provider and sending services, and verifiedSaas lists tools found through verification records.
from apify_client import ApifyClient # pip install apify-client (3.x)
client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("rimulabs/tech-stack-detector").call(run_input={
"domains": ["apify.com", "stripe.com", "notion.so"],
"includeDns": True,
})
for site in client.dataset(run.default_dataset_id).iterate_items():
print(site["domain"], "| email:", site["email"], "| verified SaaS:", site["verifiedSaas"])
For apify.com on 18 October 2026, the email column read Amazon SES, Google Workspace, Mailgun: Google Workspace for staff mailboxes, and two services that send product email.
Is this allowed?
Yes. MX and TXT records are published so that mail servers everywhere can read them. The lookup touches only public DNS and returns no personal data: provider names, not addresses.
Cost: $3.00 per 1,000 domains checked, with website technologies included.
Rimu Labs builds and maintains the Actor mentioned in this guide. The guide was written with help from our AI assistant and checked against real runs in October 2026. Questions or corrections: support@rimulabs.com.