DNS

Email provider lookup by domain

Every domain publishes where its email goes (MX records) and who may send email for it (SPF, a TXT record). Both are public DNS data, so you can tell whether a company runs on Google Workspace or Microsoft 365, and which tools send its newsletters and receipts, without contacting anyone.

3 min readUpdated October 2026By Rimu Labs

Option 1: look it up from the command line

On Windows, macOS or Linux:

nslookup -type=mx stripe.com
nslookup -type=txt stripe.com

On macOS or Linux, dig gives shorter output:

dig mx stripe.com +short
dig txt stripe.com +short

Then match the mail servers against this table:

MX host containsEmail provider
smtp.google.com, aspmx.l.google.comGoogle Workspace
mail.protection.outlook.comMicrosoft 365 (Exchange Online)
mx.zoho.com (or .eu, .in…)Zoho Mail
protonmail.chProton Mail
messagingengine.comFastmail
mx.cloudflare.netCloudflare Email Routing (forwards to another inbox)
mimecast.com, pphosted.com, barracudanetworks.comA security gateway (Mimecast, Proofpoint, Barracuda) in front of the real mailbox provider

When a gateway sits in front, check the SPF record for the mailbox provider behind it. SPF also lists the services allowed to send as the domain:

SPF includeSending service
_spf.google.comGoogle Workspace
spf.protection.outlook.comMicrosoft 365
sendgrid.netSendGrid
mailgun.orgMailgun
amazonses.comAmazon SES
servers.mcsv.net, spf.mandrillapp.comMailchimp, Mandrill
hubspotemail.netHubSpot
_spf.salesforce.comSalesforce
mail.zendesk.comZendesk
spf.mtasv.netPostmark

TXT records often also hold domain verifications such as atlassian-domain-verification=… or facebook-domain-verification=…, which show tools the company has connected its domain to.

Option 2: check a list of domains at once

Our Tech Stack Detector reads the MX, SPF and other TXT records for every domain in a list, alongside its website technologies. The email column holds the provider and sending services, and verifiedSaas lists tools found through verification records.

from apify_client import ApifyClient  # pip install apify-client (3.x)

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("rimulabs/tech-stack-detector").call(run_input={
    "domains": ["apify.com", "stripe.com", "notion.so"],
    "includeDns": True,
})
for site in client.dataset(run.default_dataset_id).iterate_items():
    print(site["domain"], "| email:", site["email"], "| verified SaaS:", site["verifiedSaas"])

For apify.com on 18 October 2026, the email column read Amazon SES, Google Workspace, Mailgun: Google Workspace for staff mailboxes, and two services that send product email.

Is this allowed?

Yes. MX and TXT records are published so that mail servers everywhere can read them. The lookup touches only public DNS and returns no personal data: provider names, not addresses.

Cost: $3.00 per 1,000 domains checked, with website technologies included.

Rimu Labs builds and maintains the Actor mentioned in this guide. The guide was written with help from our AI assistant and checked against real runs in October 2026. Questions or corrections: support@rimulabs.com.