How we detect tools
Our stack detector identifies the email tools a domain uses by reading its public DNS records and matching them against known signatures. Here is exactly how it works — and what it does not do.
What we read
- MX records — reveal the mailbox provider that receives the domain's mail.
- SPF includes — each
include:in an SPF record points to a service authorized to send, which often names the tool. - DKIM selectors — many providers use recognisable selector names, so we probe a list of common ones. A selector that several vendors share (like
s1ork1) is only attributed when its CNAME target names the vendor, and a zone that answers for every selector (a wildcard) is treated as having no usable DKIM evidence. - DMARC — tells us the domain's enforcement policy, not the tools, but completes the picture.
How matching works
We keep a library of signatures that map a DNS fingerprint to a named tool and the layer it occupies — mailbox, marketing, transactional, and so on. When a domain's records match a signature, we report the tool and show the exact record that revealed it. We never guess without evidence.
What we can't see
A tool used only to read mail leaves no sending fingerprint. A domain behind a custom or white-labelled setup may not match a known signature. And a provider we do not yet fingerprint will be missed until we add it. Detection is best-effort, and we would rather show nothing than show a guess.
Privacy
Everything is read from public DNS. We do not access inboxes, we do not send mail, and the browser-based checks never transmit the domain you enter to our servers.