How to Bulk Look Up DNS Records (MX, TXT, NS) in 2026

Anyone who has tried to audit DNS across more than a handful of domains knows the pain. Running dig in a shell loop works for ten domains and falls apart at a thousand — you hit local resolver rate limits, UDP DNS gets blocked in half your cloud environments, and you end up parsing inconsistent text output into a spreadsheet by hand. When you need to check MX and SPF records across an entire domain portfolio before a campaign, or snapshot every record type before a DNS migration, you want one clean table, not a pile of terminal output. This guide covers how to resolve DNS in bulk over DNS-over-HTTPS and what to watch for at scale.

What’s worth extracting

The lookup returns one row per DNS record, and each row is deliberately flat so it drops straight into a spreadsheet or database:

• domain — the queried domain, already normalized (scheme, path, port, and trailing dots stripped).
• recordType — which record type this row is: A, AAAA, MX, NS, TXT, CNAME, SOA, or CAA.
• value — the record value. For MX it includes the priority (e.g. 10 smtp.google.com); for TXT the chunks are joined into one string; trailing dots are trimmed.
• ttl — time-to-live in seconds, exactly as the resolver returned it.
• resolver — which resolver answered, cloudflare or google.
• checkedAt — an ISO 8601 timestamp of when the lookup ran.

The eight record types each tell you something different, and knowing which you need keeps runs lean:

• A / AAAA — the IPv4 and IPv6 addresses a domain points to.
• MX — mail servers and their priority; the basis of all email routing.
• NS — the authoritative name servers for the zone.
• TXT — free-text records that hold SPF, DKIM, DMARC, and domain-verification tokens.
• CNAME — canonical-name aliases.
• SOA — start-of-authority: primary NS, admin email, serial, and refresh timers.
• CAA — which certificate authorities are allowed to issue certs for the domain.

How the source works

The tool doesn’t use a local resolver or raw UDP DNS. It queries public DNS-over-HTTPS (DoH) endpoints — Cloudflare’s dns-query as the primary, with an automatic Google fallback if Cloudflare doesn’t answer. DoH returns structured JSON over HTTPS, which means it works reliably from cloud environments where outbound UDP port 53 is firewalled, and it pairs cleanly with an HTTP proxy to avoid resolver rate-limiting at volume.

You give it a list of domains and the record types you want. A full audit across a portfolio looks like this:

{
  "domains": ["google.com", "github.com", "cloudflare.com"],
  "recordTypes": ["A", "AAAA", "MX", "NS", "TXT", "CNAME", "SOA", "CAA"],
  "maxConcurrency": 10,
  "proxyConfiguration": { "useApifyProxy": true }
}

For a focused email-deliverability check, you’d narrow it to just the two record types that matter:

{
  "domains": ["acme.com", "example.org", "mail.startup.io"],
  "recordTypes": ["MX", "TXT"],
  "maxConcurrency": 20
}

Input parsing is forgiving: bare example.com and full https://example.com/path both work, schemes and paths are stripped, and duplicates are removed. Concurrency defaults to 10 and goes up to 100 — higher is faster for very large lists. Missing records (NXDOMAIN or empty answers) simply produce no rows; the run never crashes on a non-existent domain.

▶ Run the Bulk DNS Records Lookup on Apify — paste thousands of domains, pick your record types, and get one clean row per record over DNS-over-HTTPS. No API key, no local resolver. Export to CSV or JSON.

The access reality

DNS is public infrastructure metadata, so there’s no anti-bot wall here — but there are practical constraints that a naive shell-loop approach runs into:

• UDP DNS is blocked in many environments. Serverless functions, hardened containers, and some corporate networks block outbound port 53. That’s exactly why this tool uses DoH over HTTPS instead — it works where classic dig/nslookup silently fail.
• Public resolvers rate-limit at volume. Hammer Cloudflare or Google with thousands of rapid queries from a single IP and you’ll get throttled. The tool runs lookups in parallel at a configurable concurrency and routes through Apify Proxy by default so you don’t hit per-IP resolver limits on large lists.
• No single official DNS API to sign up for. There’s no vendor DNS API with a key that covers arbitrary domains. Public DoH endpoints are the practical answer, and they need no key — the tool works out of the box against them.
• Row counts explode fast. A domain with several A addresses, multiple MX hosts, and a handful of TXT entries can easily produce 15–30 rows on its own. A few hundred domains across all eight types quickly becomes thousands of rows. Select only the record types you actually need to keep runs lean.

Example output

A trimmed slice of the dataset, showing several record types across domains:

[
  { "domain": "google.com", "recordType": "A", "value": "142.250.190.78", "ttl": 300, "resolver": "cloudflare", "checkedAt": "2026-07-06T18:00:00.000Z" },
  { "domain": "google.com", "recordType": "MX", "value": "10 smtp.google.com", "ttl": 3600, "resolver": "cloudflare", "checkedAt": "2026-07-06T18:00:00.000Z" },
  { "domain": "google.com", "recordType": "TXT", "value": "v=spf1 include:_spf.google.com ~all", "ttl": 3600, "resolver": "cloudflare", "checkedAt": "2026-07-06T18:00:00.000Z" },
  { "domain": "github.com", "recordType": "NS", "value": "dns1.p08.nsone.net", "ttl": 86400, "resolver": "cloudflare", "checkedAt": "2026-07-06T18:00:00.000Z" }
]

Because every record is its own row, you filter and pivot by recordType — pull all the MX rows for an email audit, or all the CAA rows for a certificate-authority inventory.

Use cases

• Email deliverability — pull MX and TXT across a portfolio to verify mail routing and valid SPF / DKIM / DMARC policies before a send.
• Security and compliance audits — inventory CAA (which CAs may issue certs), NS delegation, and mail routing across many domains at once.
• Infrastructure and DNS migrations — snapshot every record type before a hosting or DNS-provider cutover, run again after, and diff the datasets to confirm clean propagation.
• Change monitoring — schedule recurring runs and detect when records change over time.
• Due diligence and OSINT — map infrastructure (A, AAAA, CNAME) and enrich large domain lists with live DNS metadata.

Cost and effort: build vs. managed

Rolling your own bulk DNS resolver looks trivial until you hit scale:

• Building from scratch — the dig-in-a-loop version is quick but breaks on blocked UDP, has no failover, gives you inconsistent text to parse, and gets rate-limited past a few hundred domains. Doing it properly means writing DoH client code, resolver failover, TXT-chunk joining, MX-priority parsing, concurrency control, and proxy rotation.
• Using the managed actor — paste a list and run. The public DoH endpoints are free; you pay per record resolved — a fraction of a cent per row, plus a trivial per-run fee. There’s no fixed cap: a few hundred domains across all eight types becomes thousands of rows for a few cents.

The DoH endpoints being free is the point — the cost is the engineering to query them reliably at volume, and that’s what the managed tool absorbs.

Common pitfalls

Specifics of bulk DNS that trip people up:

• TTL is a snapshot, not a promise. The ttl value is what the resolver returned at query time. It’s useful for cache-planning, but a record’s TTL can change; don’t treat a captured value as permanent.
• A - or missing status isn’t an error. For NXDOMAIN or empty answers, the tool produces no rows rather than crashing. If a domain returns fewer rows than expected, it usually means those record types simply don’t exist for it.
• TXT records are joined — parse them carefully. Long TXT records are split into chunks at the DNS layer; the tool joins them into one string. When you parse SPF or DKIM, work from the joined value, not from an assumption about chunk boundaries.
• MX priority lives inside the value. The MX value is priority host (e.g. 10 smtp.google.com), not two separate fields. Split on the first space if you need priority and host separately.
• Resolver can vary per row. Because of the Cloudflare-primary, Google-fallback design, some rows show google as the resolver. That’s normal failover, not an inconsistency — the record value is the same either way.
• Select only the types you need. Querying all eight types for a large list multiplies your row count and cost. For an email check, MX + TXT is enough; for a cert audit, CAA alone.

Wrapping up

Bulk DNS is one of those tasks that’s deceptively simple at ten domains and genuinely annoying at a thousand. DNS-over-HTTPS solves the blocked-UDP and rate-limit problems, and a one-row-per-record output turns the whole audit into a spreadsheet you can filter. If you only ever check a few domains, dig is fine. If you’re auditing email deliverability or DNS across a real portfolio, a managed DoH-backed tool saves you the resolver plumbing.

▶ Open the Bulk DNS Records Lookup on Apify — one run resolves A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA for thousands of domains over DNS-over-HTTPS, one clean row per record; no API key. Export to CSV or JSON, and start on Apify’s free monthly credit.