Email stack lookup: which email tools does a company use?
An email stack lookup shows which email tools a company uses, from its public DNS. For each domain it reads MX (the mailbox provider and any security gateway), SPF includes and DKIM selectors (sending platforms such as SendGrid, Mailchimp or HubSpot), the DMARC report address and domain verification records, and lists each platform with the record that shows it.
Sample result
acme.example runs its email on Google Workspace and sends with SendGrid and HubSpot.
- Domain
- acme.example
- Sends with
- SendGrid, HubSpot
- Verified with
- Atlassian
What this means for you
Know which platforms a prospect uses before you pitch, with the DNS record behind each one.
- Mailbox provider and security gateway from MX
- Sending platforms from SPF and DKIM
- 100 domains a run, 500 when signed in
- Filter by platform; CSV download
- ESP
- Stack
- Bulk
By SimpleVerifier Team · Last updated
How do I look up the email tools a list of companies use?
- Paste up to 100 company domains or email addresses, one per line (500 when signed in with Google), or enter one domain. You can also upload a CSV.
- Press Look up email stack. MX, the domain's TXT records, its DMARC record and about 40 DKIM selectors are read from DNS, ten domains at a time.
- Read each row: mailbox provider, security gateway, sending platforms, help desk tools, DMARC reporting and the SaaS the domain is verified with. Open Evidence for the records.
- Pick a platform from Uses to see only the companies on it, then download the CSV.
Example
- You enter
- The domain
acme.example, or a list of company domains one per line. - You get
- Mailbox provider Google Workspace (MX
smtp.google.com). Sending platforms SendGrid (SPFinclude:sendgrid.netand DKIMs1delegated tosendgrid.net) and HubSpot (SPF include onhubspotemail.net). Verified with Atlassian (anatlassian-domain-verification=TXT record). Each platform lists its evidence; download the table as CSV. - Limits
- Up to 100 domains a run without an account and 500 when signed in with Google. DNS only; about 40 DKIM selectors are tried per domain.
How do I find which email marketing platform a company uses?
Look at the DNS records the platform asked the company to publish. To send as company.com, a platform needs the domain's SPF record to include it (include:sendgrid.net, include:servers.mcsv.net for Mailchimp, include:...hubspotemail.net for HubSpot) and a DKIM key, often a CNAME to the platform's own domain, such as s1._domainkey pointing at sendgrid.net. This lookup reads both and names the platform.
The MX records show who hosts the mailboxes (Google Workspace, Microsoft 365 and about 40 others) and whether a security gateway such as Proofpoint or Mimecast sits in front. When a gateway is in front, the mailbox provider behind it is taken from SPF where it shows.
What are domain verification records?
TXT records like google-site-verification=..., MS=ms..., facebook-domain-verification=... or atlassian-domain-verification=... prove to a SaaS that the company owns its domain. Each one shows the company signed up for that service with its work domain. The lookup recognises about 40 of them and shows the record it matched.
What does likely mean?
Most platforms are named from a record that points at the platform's own domain, which is evidence. A few are named only because a DKIM key exists at a selector that platform usually uses, such as cm for Campaign Monitor; another service could have used the same name, so those are marked likely.
What can't it see?
Only what the domain publishes. A company that sends marketing from a separate domain, such as news.company.com or a different brand, shows that platform only when you look that domain up. Platforms with account-specific DKIM selectors and no SPF include, and tools that never send as the domain, don't appear. Unrecognised SPF includes are listed so nothing is hidden.
How is this different from a technology lookup tool?
| This lookup | Website technology profilers | |
|---|---|---|
| Reads | Public DNS: MX, SPF, DKIM, DMARC, TXT | The website's code and scripts |
| Best at | Email and sending platforms | Website, analytics and ad tools |
| Evidence | The DNS record for every platform | Usually a list without the source |
| Bulk | 100 domains, or 500 signed in | Often paid or browser-extension only |
Who uses this tool, and for what?
- Sales teams
- Find prospects that run a competitor's platform, or Microsoft 365 rather than Google Workspace, and tailor the pitch.
- Agencies
- See a prospect's current email platform before a migration proposal.
- Deliverability consultants
- Map every service that sends as a client's domain before moving DMARC to reject.
- Security teams
- Inventory the third parties allowed to send as the company's domains.
What can’t this tool tell you?
- Only platforms that publish a record on the domain itself are found; another sending domain needs its own lookup.
- About 40 DKIM selectors are tried; account-specific selectors can't be found from DNS.
- A platform named only from a DKIM selector's name is marked likely.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How can I tell which ESP a company uses?
- Look up its domain in an email stack lookup like this one. The SPF includes and DKIM records show the sending platforms, such as SendGrid, Mailchimp, HubSpot or Klaviyo, and each comes with the record that shows it.
- How do I know if a company uses Google Workspace or Microsoft 365?
- Its MX records say so: aspmx.l.google.com or smtp.google.com means Google Workspace, and a host ending in mail.protection.outlook.com means Microsoft 365. The lookup reads them for you, even behind a gateway when SPF shows the provider.
- Is this email stack lookup free?
- Yes. It's a free tool: 100 domains a run without an account and 500 when signed in with Google, with no card.
- Does it scan the company's website?
- No. It only reads public DNS records. Nothing is sent to the company's servers or website.
- Why is a platform I know they use missing?
- It may send from another domain or subdomain, use a DKIM selector unique to the account, or not send email as the domain at all. Look up the sending subdomain too.
- Can I export the results?
- Yes. Download a CSV with one row per domain: mailbox provider, gateway, sending platforms, help desk tools, DMARC reporting, verified SaaS and the evidence.
Sources
Authentication and capacity are half of deliverability.
The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.