DNS intelligence

Know what any organization actually runs.

Look up any company to see who handles its mail, how well it is protected and which vendors it uses. Then watch every domain you care about in DNSai Domain Manager.

Try openai.com nvidia.com delta.com

OpenAI

openai.com

Labelled

  1. MXaspmx.l.google.comGoogle Workspacemail platform
  2. TXThubspot-developer-verification=NDFmMGNm…HubSpotverified in DNS
  3. TXTdocker-verification=e315e0c2…Dockerverified in DNS
  4. TXTonetrust-domain-verification=7acf44f5…OneTrustverified in DNS
  5. DMARCv=DMARC1; p=reject; rua=mailto:…Spoofing blockedp=reject
Watch records like these on every domain you care about

For your own domains and anyone else’s:customers, partners, prospects, competitors, etc.

100 domains freeNo card required

How it works

One domain in. A plain‑English answer out.

  1. 01

    Enter a domain

    Your own, a customer’s, a prospect’s or a competitor’s. Any public domain works.

  2. 02

    DNSai reads its DNS

    Every record that matters, from MX and TXT to SPF, DKIM and DMARC, plus a live fetch of the website.

  3. 03

    Get a plain‑English answer

    Each record is matched to the vendor behind it: mail platform, gateway, authentication, the SaaS it uses and its website platform.

What you see

What DNSai reads from a domain

Raw DNS is hard to read. DNSai turns it into six answers you can act on.

Mail platform

Who handles its email

Microsoft 365, Google Workspace, Zoho or another provider, read straight from the MX records, so you know where a company’s mail actually lands.

Email gateway

Which gateway sits in front

Proofpoint, Mimecast, Barracuda and more, matched against the domain’s mail records.

250+gateway signatures

Email authentication

Whether it can be spoofed

SPFpublished
DKIMsigning

DMARC p=none only reports. p=reject blocks spoofed mail.

Vendors in DNS

Which vendors it has set up

Vendors ask customers to prove they own their domain. Those proofs stay public, and DNSai matches them against 1,000+ vendor signatures across SaaS, security, mail and infrastructure.

Salesforce Atlassian DocuSign Stripe Anthropic OpenAI Okta HubSpot Zoom 1Password and many more

Mail signing

Who signs its mail

The DKIM selector a domain publishes names the service that signs its messages.

350+DKIM selector families

Website platform

What its website runs on

A live fetch of the site names the platform behind the page.

100+platform signatures

WordPressShopifyWebflowWixSquarespaceDrupalHubSpot CMSNext.js

Vendors DNSai identifies in public DNS

Read from public DNS

Examples of vendors DNSai identifies in records companies publish. A record proves a relationship, not seat count or spend. Trademarks belong to their owners.

DNSai Domain Manager

Every domain you care about, in one place.

Add your own domains, or your customers’, partners’, prospects’ and competitors’. Domain Manager profiles every one and tells you when a record changes.

  • Profile a whole list

    Import domains into folders and tags. Each gets a full profile: mail, security and the platforms behind it.

  • Know when anything changes

    Change alerts when a record moves, with history on every domain.

  • Take it anywhere

    CSV export, plus the REST API and MCP connector for Claude on Enterprise.

Try DNSai Domain Manager Compare plans

100 domains freeNo card requiredResults in minutes

  1. yourbrand.exampleMicrosoft 365reject31
  2. yourbrand-uk.exampleMicrosoft 365none12
  3. yourbrand-shop.exampleGoogle Workspacequarantine8
  4. client-one.exampleGoogle Workspacereject22
  5. prospect-co.exampleProofpointreject40
Record changedyourbrand-uk.example · DMARC p=none → p=quarantine
just now
Illustration. Your dashboard shows your own domains.

Bulk DNS lookup on your desktop

DNS Explorer scans up to 1,000,000 domains per run on Windows 11 and macOS, with CSV and PDF reports.

Get DNS Explorer

DNS tools

Or run a single DNS tool

Every check has its own page. No account needed.

Look up DNS records

Check email authentication

Investigate ownership

Who it’s for

Same records, six different questions

One domain publishes one set of records. What you read out of them depends on the job in front of you.

  • 01Sales and RevOps

    Qualify an account before the first call by what it already runs.

  • 02Security and IT

    Confirm SPF, DKIM and DMARC on your own domains, and find the gap an attacker would use.

  • 03MSPs and agencies

    Profile a client domain at onboarding and catch the misconfiguration first.

  • 04Analysts and investors

    Vendor adoption you can audit, traced to records companies publish themselves.

  • 05Brand and portfolio

    Profile any domain on demand, and keep the whole portfolio current.

  • 06M&A and due diligence

    Read a target’s mail setup, authentication posture and vendors before close.

FAQ

Questions, answered

How DNSai reads a domain, and what the results mean.

What is DNSai Domain Manager?

The DNS intelligence platform at app.dnsai.com. You add domains, your own or anyone else’s, and it reads their public DNS, returns a full profile of each one (records, mail provider, authentication posture, hosting and the platforms behind it) and alerts you when a record changes.

You can start with 100 domains at no cost and without a card. Larger portfolios, team seats, the REST API and the MCP connector are on paid plans.

What does a DNS lookup show?

A DNS lookup returns the records a domain publishes: A and AAAA for its servers, MX for its mail, NS for who hosts its DNS, TXT for verifications and policies, and SOA for the zone itself. DNSai runs the lookup and labels every record in plain English, so you see who runs the mail and which vendors the company works with, not just the raw values.

How does DNSai know which vendors a company uses?

Before a vendor lets a company send mail through it, sign documents or log users in, it asks the company to prove it owns the domain, usually by publishing a record in DNS. Those records stay public.

DNSai matches them against more than 1,000 vendor signatures, 250+ email-gateway signatures and 350+ DKIM selector families, and fetches the website to name the platform it runs on.

What are SPF, DKIM and DMARC?

SPF is a TXT record listing the servers allowed to send mail for a domain. It blocks spoofing, and it names in public every service the company sends mail through.

DKIM is a cryptographic signature proving a message was not altered in transit. The selector it is published under names the vendor doing the signing.

DMARC tells receivers what to do when SPF or DKIM fails: p=none reports only, p=quarantine sends to spam, p=reject blocks the message outright. Check any domain with the SPF Analyzer, DKIM Lookup or DMARC Lookup.

Is a published record proof of a paying customer?

No. A record proves the domain set the vendor up, which is what turns the product on. It does not show seats, spend or whether the contract is still live.

Where does the data come from?

Public DNS, plus a live fetch of the company’s own website to name the platform behind it. Nothing is installed and nothing is asked of the company: no logins, no crawling behind authentication, and no names or contact details of people.

Can I check a whole list of domains?

Yes. DNSai Domain Manager profiles a list in your browser and alerts you when a record changes, and the DNS Explorer desktop app scans up to 1,000,000 domains per run. Developers can use the API and MCP connector.

Put every domain in one place.

Add your own domains, or your customers’, partners’, prospects’ and competitors’. DNSai Domain Manager profiles each one and keeps watching.

Try DNSai Domain Manager Compare plans

100 domains freeNo card requiredResults in minutes

Check one company first All DNS tools API & MCP