PLATFORM CAPABILITIES & DATA DICTIONARY

Deep Mailbox & Identity Telemetry at the Edge

DomainSignal inspects cloud identity, enterprise federation, security gateways, and DNS protocols in under 25ms. Here is the full data schema powering modern outbound pipelines.

Try the live sandbox OpenAPI spec

Signal families

What a single probe returns

MX, DMARC, BIMI, DKIM, nameservers, and a bounded HTTP HEAD fingerprint settle together in one probe. Existing fields stay stable; web, DKIM, NS, and DMARC-reporting keys are additive.

Module 01

Cloud Identity & Tenancy

Live Microsoft Entra ID and Google Workspace discovery—not MX guesswork. Surfaces Okta / Ping federation, parent tenant GUID, sovereign GovCloud, and verified corporate legal name.

identity_and_sso.tenant_guid
identity_and_sso.sso_vendor
verified_company_name
corporate_umbrella.parent_tenant_guid

Module 02

Email Security Gateway Defense

Proofpoint and Mimecast cluster detection when public MX is masked as “Other.” Automated link-safety flags so sandboxes do not detonate tracking pixels on protected tenants.

mailbox_infrastructure.security_gateway_detected
outbound_guidance.link_safety
outbound_guidance.outbound_playbook

Module 03

Protocol Health & RFC Compliance

DMARC presence, policy, and reporting vendor parsed from rua / ruf—including Internal / In-House when rua is the target domain. DKIM via parallel google._domainkey and selector1._domainkey TXT. RFC 7208 nested SPF counter and MTA-STS.

security_posture.dmarc_reporting_vendor
security_posture.is_dmarc_monitored
mailbox_infrastructure.dkim_detected
deliverability_and_spf_health.spf_lookup_count

Module 04

Firmographic Account Tiering

Seat-size inference from identity and mail posture—Enterprise 500+, mid-market, SMB—plus IT budget signals. MarkMonitor or CSC nameservers add an enterprise registrar signal and can elevate estimated_company_tier. No cookie scrapes.

firmographic_inferences.estimated_company_tier
web_and_dns_infrastructure.nameserver_provider
web_and_dns_infrastructure.nameserver_tier

Module 05

Brand Authority & Anti-Spoofing

BIMI from the existing default._bimi lookup (no extra DNS hop)—also nested as mailbox_infrastructure.bimi. VMC certificates, official inbox logo URL, and impersonation risk when DMARC is missing or p=none.

mailbox_infrastructure.bimi
brand_authority.has_vmc_certificate
impersonation_risk.vulnerability_level

Module 06

Web & DNS Fingerprint

HTTP HEAD to https://{domain} (manual redirects, 1.2s abort): Shopify, WordPress, Next.js / Vercel, Squarespace, Wix. Ecommerce flag plus canonical_redirect_domain from 301/302 Location. Cloudflare DoH NS for registrar tier.

web_and_dns_infrastructure.web_platform
web_and_dns_infrastructure.is_ecommerce
canonical_redirect_domain

Module 07

Developer Interfaces

Global edge REST. DNS work stays in the probe abort window; HEAD is capped at 1.2s. Cache hits are a JSON read with no extra network. OpenAPI 3.0 for agents; Clay, n8n, and CSV columns for the new keys.

GET /v1/probe

Interactive response schema

Illustrative delta.com payload. Live values come from the homepage sandbox. CSV enricher maps the additive keys to ds_web_platform, ds_ns_tier, ds_dkim, ds_ecommerce, ds_dmarc_vendor, ds_dmarc_monitored, ds_ns_provider, and ds_canonical.

openapi.json

response.json · example

Field	What it tells you
verified_company_name	Legal / brand name from tenant identity—not the WHOIS registrant string.
identity_and_sso.tenant_guid	Immutable Entra ID directory GUID. Survives domain swaps; used for parent / sibling mapping.
identity_and_sso.sso_vendor	Okta, Ping, Microsoft Entra, or other IdP when federation is published.
identity_and_sso.cloud_environment	Commercial vs USGov GCC High / DoD. Flags ITAR-style sovereign tenancy.
mailbox_infrastructure.primary_provider	Google Workspace vs Microsoft 365 vs other—from identity, not gateway MX.
mailbox_infrastructure.security_gateway_detected	Proofpoint, Mimecast, Barracuda, or null. Explains “Other” MX in sequencers.
outbound_guidance.link_safety	Whether inbound SEGs sandbox tracked links. Informs HTML vs plain-text routing.
outbound_guidance.outbound_playbook	Compressed routing note: matched sender family + link posture.
security_posture.dmarc_policy	reject / quarantine / none. Reject is the anti-spoof baseline.
security_posture.dmarc_reporting_vendor	Parsed from _dmarc rua / ruf. Mapped vendor, or Internal / In-House (Unmanaged) when rua is the target domain. dmarc_vendor is a CSV alias of this field.
security_posture.is_dmarc_monitored	True if a reporting vendor matched or any rua is present.
mailbox_infrastructure.dkim_detected	Parallel TXT on google._domainkey and selector1._domainkey. Valid if v=DKIM1, k=rsa, or p= is published.
mailbox_infrastructure.active_dkim_selectors	Which of those selectors answered. CSV: ds_dkim.
mailbox_infrastructure.bimi	Same default._bimi lookup as brand_authority—no second DNS query. is_configured, has_vmc_certificate, logo_url.
web_and_dns_infrastructure.web_platform	HEAD fingerprint: Shopify, WordPress, Next.js / Vercel, Squarespace, Wix. CSV: ds_web_platform.
web_and_dns_infrastructure.nameserver_tier	Cloudflare DoH type=NS. MarkMonitor / CSC count as enterprise registrar and can lift company tier.
canonical_redirect_domain	Hostname from a 301/302 Location on HEAD. CSV: ds_canonical.
deliverability_and_spf_health.spf_lookup_count	Nested DNS lookups toward the RFC 7208 cap of 10.
outbound_guidance.mta_sts_policy	Whether MTA-STS (RFC 8461) enforces TLS on inbound SMTP.
firmographic_inferences.estimated_company_tier	Enterprise 500+ / mid-market / SMB inferred from identity + mail stack.
detected_tech_stack	CRM, marketing, support, and ESP includes decoded from SPF—no page scrape.
brand_authority.bimi_active	BIMI record present; VMC indicates a validated inbox logo.
impersonation_risk.can_be_spoofed_directly	True when DMARC does not prevent direct-domain spoofing.
deliverability_health.score	0–100 composite of SPF, DMARC, parked status, and gateway posture.
latency_ms	Server-side duration. DNS stays in the probe abort window; origin HEAD is capped at 1.2s. Cache hits are a JSON read (no extra network).

Ready to pre-flight your lead lists?

Run a live probe in the sandbox, or import the OpenAPI spec into your agent or workflow runner.

⚡ Test the live sandbox API documentation (OpenAPI) Domain CSV Enricher