The AI Vendors Hiding in Public DNS
DNSai.com
DNSai Security Intelligence
Share

SaaS Intelligence: The AI Vendors Hiding in Public DNS

On pfizer.com, in a place almost nobody looks, is a line that reads anthropic-domain-verification-dygje9. A few lines away sits one for OpenAI. Then one for Cursor.

None of it is hidden. These are DNS TXT records, observed on October 7. That matters, because one of the week's AI stories was the opposite: AI money nobody can see.

Neon illustration of DNS records glowing against a dark background

Every domain publishes its records to anyone who asks.

The spending nobody can see

On September 30, Boston Consulting Group reported that corporate AI spending had grown from about 1.7% of revenue in late 2025 to 3.3%. Then the line that should make CIOs wince.

More than 80% of AI spending now sits outside enterprise IT.

— Boston Consulting Group, “AI Is Starting to Pay Off. Almost 50% of Companies Now Generate Value with It.”, September 30, 2026

BCG's Vlad Lukic, quoted by CIO Dive, said CIOs "do need visibility and a common management model across that spend." A day later, a Security Boulevard commentary argued that most organizations can't see which AI services their employees use.

Here's the backwards part. When a team buys an AI tool properly, with single sign-on, the vendor makes it prove it owns the domain. Anthropic's SSO setup hands the admin a TXT record beginning anthropic-domain-verification-, and SSO is available for Team, Enterprise and Console organizations. Cursor offers SSO on Teams and Enterprise plans. The paperwork of buying AI gets filed in public. Call it the sign-in sheet.

Security intelligence: the same records, a different reader

A security team reading pfizer.com sees more than AI vendors. Its MX records point to Proofpoint-hosted servers, and its DMARC record says reject.

pfizer.com. 242 IN MX 10 mxa-00013f02.gslb.pphosted.com. _dmarc.pfizer.com. IN TXT "v=DMARC1;p=reject;fo=1;rua=mailto:[email protected],mailto:[email protected];ruf=mailto:[email protected],mailto:[email protected]"

Stripe reads differently. Its MX points straight at Google, and its DMARC is p=reject at pct=100. Under RFC 9989 section 4.7, reject means the owner treats failures as a clear sign the use of the domain is not valid. Why mail posture matters at all: a Barracuda summary of the FBI IC3 report puts 2025 business email compromise losses at roughly $3 billion. Reject applies to mail that uses the domain in its From address; lookalike domains are outside its reach.

A missing gateway proves nothing, though. API-based and post-delivery products never appear in MX. DNSai matches MX records against 279 gateways (a list that counts mailbox providers and hosts, too) and SPF, TXT, DMARC and NS records against 1,131 vendors. It's dictionary heuristics with known gaps and known errors, not AI detection. More on the method in reading the gateway from MX.

Business intelligence: who has verified a domain with which AI vendor

Hand the same records to a sales analyst. stripe.com, zapier.com and pfizer.com each publish OpenAI, Anthropic and Cursor verification records. shopify.com publishes three OpenAI records and no Anthropic or Cursor record at the apex. That's a competitive map sketched in TXT, and a timely one: on October 6, Anthropic offered startups a free year of Claude Team plus $1,000 in API credits.

Now the limit. A verification record shows someone verified the domain at some point. It says nothing about seats, spend or current use. On October 5, a report said Meta and Microsoft were scaling back internal use of Claude. DNS wouldn't show that. It misses employees on personal accounts, too, and Mistral verifies at _mistral-verification, where an apex lookup never looks.

From one domain to thousands

A single snapshot is the weak version, and the single-domain lookup tools on dnsai.com check one domain at a time and keep no history.

Lists of domains belong to Domain Manager at app.dnsai.com. The bulk lookup page describes what it returns for a list: the email gateway, AI vendors, SPF, DKIM and DMARC validation, and 50+ record types exported as CSV. Domain Manager also does change detection, so you "know when a record changes." Plans run from 100 domains free up to 500,000 on Enterprise, the tier where the page lists a REST API and MCP connector. There is no CRM integration. DNS Explorer covers large-scale lookups from the desktop.

Track changes across a domain list

Profile up to 100 domains in Domain Manager and see gateway, DMARC posture and published vendors side by side. Matching is dictionary-based, so expect gaps, and a record is not proof of use.

Try Domain Manager →

Go back to that line on pfizer.com. It can't tell you who uses Claude, or how much, only that someone signed the sheet. Watch it over time and you'll see the day a name appears, or quietly disappears.

Sources

  1. AI Is Starting to Pay Off. Almost 50% of Companies Now Generate Value with It. — Boston Consulting Group, 2026-09-30. bcg.com
  2. CIOs need transparent view of AI deployment — CIO Dive (Paige Gross), 2026-09-30. ciodive.com
  3. Shadow AI Is Already Inside Your Organization — Security Boulevard (Jim Sherlock), 2026-10-01. securityboulevard.com
  4. Anthropic is giving startups a free year of Claude Team and $1,000 in credits — TechCrunch (Russell Brandom), 2026-10-06. techcrunch.com
  5. Meta and Microsoft scale back internal use of Anthropic's Claude, report says — Investing.com via Yahoo Finance, 2026-10-05. finance.yahoo.com
  6. Set up single sign-on (SSO) — Anthropic (Claude Help Center). support.claude.com
  7. SSO — Cursor (Anysphere) docs. cursor.com
  8. Configure SSO and domain verification — Mistral AI docs. docs.mistral.ai
  9. Google Public DNS JSON API: stripe.com TXT — Google Public DNS, observed 2026-10-07. dns.google
  10. Google Public DNS JSON API: pfizer.com TXT — Google Public DNS, observed 2026-10-07. dns.google
  11. Google Public DNS JSON API: zapier.com TXT — Google Public DNS, observed 2026-10-07. dns.google
  12. Google Public DNS JSON API: shopify.com TXT — Google Public DNS, observed 2026-10-07. dns.google
  13. Google Public DNS JSON API: pfizer.com MX — Google Public DNS, observed 2026-10-07. dns.google
  14. Google Public DNS JSON API: _dmarc.pfizer.com TXT — Google Public DNS, observed 2026-10-07. dns.google
  15. Google Public DNS JSON API: stripe.com MX — Google Public DNS, observed 2026-10-07. dns.google
  16. Google Public DNS JSON API: _dmarc.stripe.com TXT — Google Public DNS, observed 2026-10-07. dns.google
  17. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) — IETF / RFC Editor, May 2026. rfc-editor.org
  18. Why Cybercrime Losses Hit $21 Billion in 2025 — Barracuda blog (Tony Burgess), 2026-05-26. blog.barracuda.com
  19. DNSai Domain Manager — Monitor and Profile Thousands of Domains — DNSai, 2026-10-07. dnsai.com
  20. Bulk Domain Discovery & DNS Lookup for Accounts — DNSai, 2026-10-07. dnsai.com
  21. DNS Explorer — Bulk Domain DNS Record Lookup Tool — DNSai, 2026-10-07. dnsai.com

Share this article

Related Articles