Tech Stack Recon

Reverse-engineer a company's sales, marketing, and outbound infrastructure from public signals. No login, no API access to their tools needed — everything is derived from DNS records, website source code, technology profiling, blacklist databases, and public complaints.

What It Detects

How It Works

The skill runs 5 layers of detection, each revealing different signals:

Layer 1: DNS Records (Free, instant)

MX     → Primary email provider (Google Workspace, Microsoft 365, etc.)
SPF    → Every service authorized to send email on their behalf
DKIM   → Cryptographic proof of which tools actually send email
DMARC  → Email authentication policy (how strict they are)
TXT    → Misc verifications (Smartlead tracking domains, tool verifications)
CNAME  → Subdomains pointing to third-party services

This is the highest-signal layer. SPF and DKIM don't lie — if SendGrid is in their SPF, they use SendGrid.

Layer 2: Website Source Inspection (Free, instant)

Fetches the target website and searches HTML for:

• Tracking pixels (Apollo, REB2B, HubSpot, Facebook, LinkedIn)
• Script tags loading third-party tools
• Meta tags and framework signatures
• Hidden form handlers and API endpoints

Layer 3: Apify Technology Profiler (Pay-per-use, ~$0.005/domain)

Runs justa/technology-profiling-engine actor for deep detection of 7,000+ technologies using 8-tier inspection with confidence scores. Catches tools that don't appear in source code (loaded dynamically, via GTM, etc.).

Layer 4: Blacklist Checks (Free, instant)

Queries 6 major DNS-based blacklists:

• Spamhaus (zen.spamhaus.org)
• Barracuda (b.barracudacentral.org)
• SpamCop (bl.spamcop.net)
• SORBS (dnsbl.sorbs.net)
• SURBL (multi.surbl.org)
• URIBL (black.uribl.com)

Layer 5: Public Complaint Search (Free)

Web searches for spam complaints on Trustpilot, Reddit, SpamCop forums, and general web. Also searches for the company + tool names to find public mentions of their stack.

Cost

Typical costs:

Skip the Apify profiler with --no-apify for free-only analysis (DNS + source + blacklists).

Setup

1. Required

# dig (DNS lookups) — included on macOS/Linux
which dig
 
# curl (website source fetch) — included on macOS/Linux
which curl
 
# Python 3 with requests + dotenv
pip3 install requests python-dotenv

2. Optional (for Apify Technology Profiler)

# Get your token at https://console.apify.com/account/integrations
# Add to .env:
APIFY_API_TOKEN=apify_api_YOUR_TOKEN_HERE

Usage

Single Company

python3 scripts/recon.py --domains pump.co

Batch of Companies

python3 scripts/recon.py --domains "dili.ai,pump.co,runautomat.com"

Free-Only Mode (No Apify)

python3 scripts/recon.py --domains pump.co --no-apify

Output to File

python3 scripts/recon.py --domains "dili.ai,pump.co" --output /path/to/report.md

JSON Output

python3 scripts/recon.py --domains pump.co --json

What the Script Does

For each domain:

1. DNS Scan — Queries MX, SPF, DKIM (18 common selectors), DMARC, TXT records, and 30+ common subdomains (email, tracking, click, bounce, send, smtp, mail, etc.)
2. Website Source Scan — Fetches the homepage HTML and greps for 40+ known tool signatures (script URLs, pixel IDs, tracking domains)
3. Apify Technology Profile (optional) — Runs deep 8-tier technology detection for 7,000+ technologies with confidence scores
4. Blacklist Check — Queries 6 DNS-based blacklists for the domain
5. Outbound Domain Detection — Checks if common variations of the domain exist (get[name].com, try[name].com, [name]reach.com, etc.) and analyzes their DNS for cold outbound patterns
6. Report Generation — Produces a structured markdown report with confirmed tools, evidence, email auth assessment, blacklist status, and an overall assessment

Agent Integration

When using this skill as an agent, follow this flow:

1. User provides one or more company domains
2. Run recon.py for all domains (confirm Apify cost if > 5 domains)
3. Present the report — group findings by:
   • Confirmed tools (with evidence)
   • Email authentication (SPF/DKIM/DMARC assessment)
   • Deliverability (blacklist status + spam complaints)
   • Notable signals (outbound domains, missing DMARC, SPF gaps)
4. If batch, include a comparative summary table at the end

Agent Without the Script

The agent can perform all checks manually using built-in tools:

DNS checks — Use Bash tool:

dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT selector._domainkey.example.com
dig +short CNAME subdomain.example.com

Website source scan — Use Bash tool:

curl -sL https://www.example.com | grep -oi 'pattern1\|pattern2\|pattern3' | sort -u

Blacklist checks — Use Bash tool:

dig +short example.com.zen.spamhaus.org A

Apify profiler — Use Bash tool with Python:

# See scripts/recon.py for the full implementation

Spam complaints — Use WebSearch tool:

"example.com" spam OR unsolicited OR "cold email" OR blacklist

DNS Record Cheat Sheet

SPF Includes → Tool Identification

DKIM Selectors → Tool Identification

TXT Records → Tool Identification

Website Source Patterns → Tool Identification

Cold Outbound Domain Patterns

A separate domain is being used for cold email if it has:

• Google Workspace MX (or similar) but no product/marketing email tools in SPF
• SPF that only includes _spf.google.com (sending from raw mailboxes)
• A 301/302 redirect to the company's primary domain
• No website content of its own
• Domain name follows patterns like: [brand]reach.com, get[brand].com, try[brand].com, meet[brand].com, [brand]hq.com

DMARC Assessment Guide

Troubleshooting

"No tools detected"

• The company may be very early-stage with minimal tooling
• Some tools (like Apollo used only for prospecting, not sending) leave no DNS trace
• LinkedIn Sales Navigator, Clay enrichment, and similar tools don't leave public signals
• Try the Apify profiler if you only ran free-only mode

"SPF has Google only but they use Smartlead/Instantly"

• This is normal. Smartlead and Instantly typically connect to Google Workspace mailboxes via SMTP and send through Google — so SPF passes via Google's include. The cold email tool itself doesn't need its own SPF entry.
• Look for Smartlead's open.sleadtrack.com in TXT records or website source as confirmation.

"Apify profiler timed out"

• Some sites take longer to load. The profiler has a 3-minute timeout.
• Retry once. If it fails again, rely on DNS + source code analysis.

"artisan.ai resolves but redirects to Afternic"

• The domain is parked/for sale. Check common alternatives: .co, .com, .io.
• Wildcard DNS (all subdomains resolve to the same IP) is a sign of a parked domain.

Links

• Apify Technology Profiling Engine
• Apify API Token
• MXToolbox — manual verification
• Spamhaus Domain Lookup