Any website's tech stack and email security, one call

Who it's for

Anyone who needs to know what a company's website runs on and how its email is set up, for one domain or a whole list.

Try it

Type any domain, URL or work email. Prefilled with a real site.

Real sample output

Captured from a live call to this API.

{
  "check": "report",
  "results": [
    {
      "input": "stripe.com",
      "domain": "stripe.com",
      "reachable": true,
      "errors": [],
      "dns": {
        "a": [
          "198.137.150.41",
          "198.202.176.41"
        ],
        "aaaa": [],
        "ns": [
          "ns-1087.awsdns-07.org",
          "ns-1882.awsdns-43.co.uk",
          "ns-423.awsdns-52.com",
          "ns-705.awsdns-24.net"
        ]
      },
      "email": {
        "mxProvider": "Google Workspace",
        "mx": [
          "aspmx.l.google.com",
          "alt1.aspmx.l.google.com",
          "alt2.aspmx.l.google.com",
          "aspmx2.googlemail.com",
          "aspmx3.googlemail.com"
        ],
        "spf": {
          "present": true,
          "record": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
          "allQualifier": "softfail",
          "includes": [
            "spf1.stripe.com",
            "greenhouse-outbound-mail.stripe.com",
            "_spf.qualtrics.com"
          ],
          "multipleRecords": false
        },
        "dmarc": {
          "present": true,
          "record": "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;",
          "policy": "reject",
          "subdomainPolicy": null,
          "pct": 100,
          "rua": true
        }
      },
      "verifications": [
        "apple",
        "atlassian",
        "canva",
        "docker",
        "facebook",
        "google"
      ],
      "url": "https://stripe.com/",
      "finalUrl": "https://stripe.com/",
      "statusCode": 200,
      "blocked": false,
      "title": "Stripe | Financial Infrastructure to Grow Your Revenue",
      "description": "Stripe is a financial services platform that helps all types of businesses accept payments, build flexible billing models, and manage money movement.",
      "language": "en-US",
      "technologies": [
        {
          "name": "Next.js",
          "category": "JS framework",
          "evidence": "html: /_next/static/"
        }
      ],
      "securityHeaders": {
        "strictTransportSecurity": true,
        "contentSecurityPolicy": true,
        "xFrameOptions": true,
        "xContentTypeOptions": true,
        "referrerPolicy": true,
        "permissionsPolicy": false,
        "score": "5/6"
      },
      "registration": {
        "registrar": "SafeNames Ltd.",
        "createdAt": "1995-09-12T04:00:00Z",
        "updatedAt": "2025-10-01T01:39:51Z",
        "expiresAt": "2027-09-11T04:00:00Z",
        "ageDays": 11342,
        "status": [
          "client delete prohibited",
          "client transfer prohibited",
          "client update prohibited",
          "server delete prohibited",
          "server transfer prohibited",
          "server update prohibited"
        ]
      },
      "files": {
        "robotsTxt": true,
        "sitemapXml": false,
        "llmsTxt": true,
        "securityTxt": true
      },
      "exists": true,
      "summary": "stripe.com: email on Google Workspace, DMARC p=reject, domain 31y old.",
      "analyzedAt": "2026-10-01T07:47:30.978Z",
      "cached": false
    }
  ],
  "count": 1
}

Limits, plainly

Free and rate limited so it stays fast for everyone. Loop over longer lists (report: 1 domain per call; email-security: 5; tech: 3; registration: 10). For 10,000-domain lists, CSV export, TLS certificate checks and a monitor mode that returns only changed domains, the DomainDNA tool on the Apify Store does the same checks in bulk.

• Domains per call: /api/report 1, /api/email-security 5, /api/tech 3, /api/registration 10; 10 calls a minute per IP on the free tier.
• Free tier: 25 domains a day per IP, no key. Paid keys from $5 (one-time pack) or $19/month (see Get an API key).
• Each domain in a call counts as one check (duplicates in the same call count once). Failed calls are not counted. Answers are cached for 1 hour per domain and check (cached: true).
• Tech detection reads the homepage the way a browser would (first 300 KB); sites behind a bot wall come back with blocked: true and a partial list. No TLS certificate check (Workers cannot read certificates; the Apify tool has it).
• Registration dates come from the registry's own RDAP server; a few country TLDs publish none, and some registries (.org) rate-limit busy periods (registration: null with the reason in errors; retry later, and successful answers are cached).

How the price compares

Per domain looked up. Rival list prices were read from their public pricing pages on 1 Oct 2026.

Wappalyzer and BuiltWith crawl the web and keep history; DomainDNA reads the site, DNS and RDAP live on each call, adds the email side (provider, SPF, DMARC) and domain age in the same answer, and shows the evidence behind every technology.

Checking 10,000 domains, or watching a list?

DomainDNA on the Apify Store runs the same checks on lists of any size, adds the TLS certificate (issuer, expiry), exports CSV/Excel, and has a monitor mode that returns only the domains whose stack, email setup or registration changed since the last run.

Get an API key

Domain intelligence API: a website's tech stack with the evidence for each technology, its email provider (Google Workspace, Microsoft 365, Proofpoint...), SPF and DMARC policy, DNS, domain age, registrar and expiry (RDAP), security headers and robots/sitemap/llms/security.txt, read live per call. BuiltWith and Wappalyzer API alternative. Keys work on the REST API and the MCP server; no Apify account needed.

14-day money-back promise: if it doesn't work as described, email us within 14 days and we fix it or refund you in full. Refund terms.

Pay with card, Apple Pay, Google Pay or Link through Stripe Checkout (sales tax/VAT handled by Stripe). Your key appears on the page you return to right after checkout: save it. Manage or cancel any time at domaindna-api.cybermax-tools.workers.dev/manage. Send it as x-api-key: YOUR_KEY (or Authorization: Bearer YOUR_KEY, which MCP clients support). Check usage at /key. Failed calls are not counted. Tech-lookup APIs are priced for big crawled databases: Wappalyzer Pro $250/month for 5,000 API credits ($50 per 1,000), BuiltWith from $295/month, host.io Basic $99/month for 10,000 requests, TheirStack $49/month for about 500 company tech stacks (pricing pages read 1 Oct 2026). DomainDNA: $5 pay-as-you-go for 1,000 domain checks (no expiry) or Scout $19/month for 5,000 ($3.80 per 1,000), with email security and domain age in the same answer.

curl -s "https://domaindna-api.cybermax-tools.workers.dev/api/report?..." -H "x-api-key: YOUR_KEY"

# MCP (Claude Desktop, Cursor, VS Code)
{ "mcpServers": { "domaindna-api": { "type": "http", "url": "https://domaindna-api.cybermax-tools.workers.dev/mcp",
  "headers": { "Authorization": "Bearer YOUR_KEY" } } } }

# Usage so far
curl -s https://domaindna-api.cybermax-tools.workers.dev/key -H "x-api-key: YOUR_KEY"

Use the API

JSON over HTTPS, CORS enabled, no key. GET for quick calls, POST a JSON body for lists. Spec: openapi.json · llms.txt

curl -s "https://domaindna-api.cybermax-tools.workers.dev/api/report?domain=stripe.com"

# lists: POST a JSON body
curl -s -X POST https://domaindna-api.cybermax-tools.workers.dev/api/report \
  -H "content-type: application/json" \
  -d '{"domains":["stripe.com"]}'

import requests

r = requests.post("https://domaindna-api.cybermax-tools.workers.dev/api/report",
                  json={"domains":["stripe.com"]}, timeout=30)
r.raise_for_status()
for row in r.json()["results"]:
    print(row)

Endpoints: /api/report everything about one domain: tech stack, email security, dns, registration, site files · /api/email-security email provider, spf and dmarc for up to 5 domains · /api/tech tech stack of up to 3 websites, with evidence · /api/registration domain age, registrar and expiry for up to 10 domains (rdap)

Add it to your AI agent (MCP)

A remote MCP server at https://domaindna-api.cybermax-tools.workers.dev/mcp (streamable HTTP, no auth). Read-only tools with JSON schemas, so agents know exactly what to send.

// Claude Desktop, Cursor, VS Code, any MCP client (remote, no key)
{
  "mcpServers": {
    "domaindna-api": { "type": "http", "url": "https://domaindna-api.cybermax-tools.workers.dev/mcp" }
  }
}

# Claude Code
claude mcp add --transport http domaindna-api https://domaindna-api.cybermax-tools.workers.dev/mcp

# Tools: domain_report, email_security, tech_stack, domain_registration
# e.g. domain_report({"domains":["stripe.com"]})

• domain_report
  Tech stack (with evidence), email provider, SPF, DMARC, DNS, RDAP registration (age, registrar, expiry), security headers and site files for one domain, URL or email.
• email_security
  MX provider, SPF record and all qualifier, DMARC policy, pct and rua, A/AAAA/NS and TXT verifications for 1-5 domains.
• tech_stack
  Technologies (CMS, e-commerce, frameworks, analytics, tag managers, CDN, chat...) with the evidence for each, plus security headers, for 1-3 websites.
• domain_registration
  RDAP registration (registrar, created, updated, expires, age in days, status) for 1-10 domains.

FAQ