Fingerprint Outbound Infrastructure
fingerprint_outbound_infrastructureAnalyze a company domain to detect if it runs cold email outbound, identify the sending stack, and reveal email infrastructure signals.
Instructions
Given a company domain, determine whether that company runs cold email outbound and on what stack. Returns a runs_outbound verdict of program (a deliberate cold outbound setup), light (one weak signal), none, or unknown, plus the evidence behind it. The strongest signal is the lookalike sending domains a real outbound program leaves behind: domains like getcompany.com or company-mail.com that carry their own mail and redirect back to the primary site. Also returns the inbox provider (Google Workspace, Microsoft 365 and others) for the primary domain and each sending domain, any detected sending platform (Outreach, Salesloft, Lemlist, Instantly, Smartlead, Apollo and more), registration clusters showing sending domains bought on the same day, cold email infrastructure vendors, and deliverability posture (SPF, DKIM, DMARC). Note that sending platform recall is partial by design: sequencers that connect over OAuth to a customer's own mailbox leave no DNS trace, so an empty sending_platforms means little while a populated one is solid. Public DNS and HTTP redirects only, no login, no mailbox access. Returns flat Clay-ready JSON. Read-only; requires an APIFY_TOKEN and consumes Apify credits per domain analyzed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | A single company domain, e.g. smartlead.ai. Provide either domain or domains. | |
| domains | No | Batch mode: several company domains analyzed in one call. Takes precedence over domain. | |
| skipCache | No | Force a fresh analysis and ignore the 7 day result cache. | |
| check_deliverability | No | Add a blacklist check and a 0-100 health score by running the separate Domain Deliverability Checker actor, which bills its own per-domain rate on top of this one. Default false. SPF, DKIM and DMARC are read from DNS either way. | |
| scan_sending_domains | No | Scan for lookalike sending domains. Default true. This is the strongest signal and the slowest step; turning it off makes runs fast but caps the verdict at what platform and deliverability signals alone can prove. | |
| sending_domain_depth | No | deep (default) checks .com, .co, .io, .net and .org. standard drops .net and .org for slightly fewer DNS lookups, at the cost of missing sending domains on those TLDs. |