Arcamira
Free · No signup · No credentials

What SaaS is your company actually using?

Your public DNS already names a good number of your suppliers. Type a domain and see what it gives away — in about a second, without connecting anything.

No domain to hand? Try , or .

Reads public DNS only — the same records any lookup returns. Nothing is probed, connected to, or stored.

How it works

Four public records, four kinds of supplier.

Nothing here is clever or covert. Organisations have to publish DNS records for email and third-party services to function at all, and those records name suppliers by design. The scan reads four families and matches what it finds against a list of known vendor fingerprints.

SPF v=spf1

Lists every service permitted to send email as you. This is the richest signal by far — your CRM, marketing platform, helpdesk, invoicing tool and transactional email provider all have to appear here or their mail bounces.

MX mail exchanger

Names who runs your mail, and often the security layer in front of it — Microsoft 365, Google Workspace, Proofpoint, Mimecast. One record, two suppliers, and usually the two most expensive ones.

DMARC _dmarc

The reporting address gives away your email security or deliverability vendor, because aggregate reports have to be sent somewhere a product can read them.

TXT verification tokens

The strings SaaS vendors ask you to paste into DNS to prove you own the domain. They are rarely removed once added, so they accumulate into a quiet archaeological record of everything anyone ever signed up for.

Why the leftovers matter: a verification token for a product nobody remembers buying is one of the cheapest shadow-IT signals there is. It costs nothing to publish, nothing to keep, and it outlives the person who added it.

What to do with the answer

A vendor list is not the point. What it overlaps with is.

Knowing you run sixteen SaaS products is mildly interesting. Knowing that three of them do the same job, that one is billed to a department that no longer exists, and that a fourth is the single point of failure for something the business actually depends on — that is worth acting on.

That is the work Arcamira is built for: taking an estate you can finally see and answering the questions that follow. What overlaps. What has no owner. What is past end of support and now an insurance and audit problem. What breaks if you turn any of it off.

Start where you are. A domain scan, a CSV of your app list, or a read-only collector you run yourself and inspect before anything leaves your network. Whichever you pick, the estate lights up in about an hour — no framework programme first.

Questions

The obvious objections.

How can you see our SaaS without any credentials?
Every organisation publishes DNS records so that email and third-party services work. SPF lists who may send mail on your behalf, MX names your mail host, DMARC names your reporting vendor, and TXT records carry the verification tokens SaaS vendors ask you to add. Each of those names a supplier. The scan reads only these public records — the same thing any DNS lookup returns.
Is this a security scan or a penetration test?
No. Nothing is probed, connected to, or logged into. The scan performs ordinary public DNS lookups and matches the answers against a list of known vendor fingerprints. It is entirely passive and touches no system belonging to the domain — which is also why you can run it against a domain you do not own, and why the results contain nothing confidential.
Why does the scan miss some of our SaaS?
DNS only reveals SaaS that touches your mail flow or asked you to verify your domain. Anything bought on a credit card, signed in with Google, or used entirely in the browser leaves no DNS trace. That is usually the larger half of a real estate, and it is exactly why we treat the outside view as a starting point rather than an inventory.
Do you store the domains people scan?
Results are cached briefly so a shared link does not re-resolve DNS for every reader. Nothing is written to a database and no account is created. If you send us your email to ask for a fuller picture, that goes to a person, not a marketing automation platform.
Can I see more than DNS can show?
Yes, and it is a meaningful step up. Connecting an identity provider surfaces every application anyone signs into, with owners and last-used dates. There is also a read-only collector you run inside your own environment — it authenticates as you, writes an inspectable file, and uploads nothing unless you choose to. The docs cover both.