A domain is the cheapest B2B identifier in the world — it falls out of a form fill, an email signature, a scraped listing. But on its own it is just a hostname. Turning it into something a sales or RevOps team can act on means reconstructing the company behind it: how big it is, what it does, what it runs, and how to reach a human there. This article walks the actual reconstruction, link by link, instead of pretending a magic API just "knows."
The inference chain, one link at a time
Each step takes the output of the previous one and adds a layer. Nothing here is a single oracle call; it is signals stacked until a profile emerges.
- Resolve the domain. Confirm it is live, follow redirects (a lot of
acme.iodomains 301 toacme.com), and settle on the canonical host so you don't enrich the same company twice under two names. - Read the homepage and key pages. The
/about,/team,/careersand footer carry the legal name, tagline, locations and often a headcount or "founded" year stated in the company's own words — the highest-trust source there is. - Fingerprint the tech stack. Response headers, script tags, cookie names and DNS records expose the CMS, analytics, ecommerce platform, CDN and marketing tools. Shopify, HubSpot, Segment and Cloudflare all leave signatures.
- Pull DNS and MX records. The MX host tells you the email provider (Google Workspace, Microsoft 365, Proofpoint in front of one of them) and is the anchor for everything email-related that follows.
- Classify the industry. Map the description and keywords to a NAICS or SIC code so the result is filterable, not a free-text guess.
- Infer the email pattern. From any real addresses on the site plus the dominant public format, derive the template — then construct a likely address for a named decision-maker.
- Score and assemble. Attach a confidence value to each field based on how many sources agreed and how directly it was observed, then return one structured record.
The two hard problems: email patterns and confidence
Why email-pattern inference is the trickiest link
There is no public directory mapping every employee to an address. So pattern inference works backwards from evidence. If the careers page lists jobs@acme.com and a press release quotes jane.doe@acme.com, you have one structural address and one personal sample. The personal sample reveals the template — here {first}.{last}. Given a target like "Marcus Lee, VP Sales," you can then construct marcus.lee@acme.com as the most probable address.
Common templates worth recognising:
| Template | Example for John Smith | Typical context |
|---|---|---|
{first}.{last} | john.smith@acme.com | The most common corporate default |
{first} | john@acme.com | Small companies and startups |
{f}{last} | jsmith@acme.com | Older / enterprise IT conventions |
{first}{last} | johnsmith@acme.com | Frequent at mid-size tech firms |
{last}{f} | smithj@acme.com | Some European and finance orgs |
This is a construction, never a confirmed lookup. The MX record tells you whether the mailbox could exist on that provider, but only an SMTP probe or an actual send proves deliverability. Treat the constructed address as a strong hypothesis and verify before you bulk-mail — that is the difference between a clean sender reputation and a spam-trap problem.
What a confidence score actually encodes
Confidence is not vibes. A defensible 0–1 score blends three things:
- Source agreement — how many independent sources reported the same value.
- Recency — a headcount seen this quarter beats one cached from two years ago.
- Directness — observed on the company's own site outranks inferred from a third party.
So a headcount stated on the about page and corroborated externally might land at 0.93, while an email pattern extrapolated from a single sample sits around 0.6. The score is what lets you set a threshold: auto-accept above 0.8, queue 0.5–0.8 for review, drop the rest. Enrichment that returns fields without confidence forces you to trust everything equally, which is how bad data quietly poisons a CRM.
What a single enriched record looks like
One domain in, one structured object out. The shape that downstream tooling actually wants:
{
"domain": "acme.com",
"companyName": "Acme Robotics Inc.",
"description": "Industrial automation and warehouse robotics",
"firmographics": {
"employeeRange": "51-200",
"foundedYear": 2014,
"headquarters": "Austin, TX, US",
"naics": "333922",
"naicsLabel": "Conveyor & Conveying Equipment Mfg"
},
"techStack": ["HubSpot", "Cloudflare", "Segment", "Webflow"],
"emailProvider": "Google Workspace",
"emailPattern": "{first}.{last}",
"sampleContacts": [
{ "name": "Jane Doe", "title": "Head of Ops",
"email": "jane.doe@acme.com", "confidence": 0.86 }
],
"confidence": { "firmographics": 0.91, "techStack": 0.88, "emailPattern": 0.6 }
}Where it differs from Clearbit, Apollo and Clay
The incumbents are excellent but they share two traits: a fixed monthly seat or credit commitment, and a closed database you cannot inspect. The trade-offs in plain terms:
| Dimension | Bundled SaaS (Clearbit / Apollo) | Pay-per-result Actor |
|---|---|---|
| Pricing model | Monthly seats or credit blocks, often annual | Pay only for domains you actually enrich |
| Data origin | Proprietary, opaque cache | Live signals you can trace back to a source |
| Confidence visibility | Usually hidden behind a binary match | Per-field score returned in the payload |
| Coverage of obscure domains | Strong on well-known firms, gaps on the long tail | Runs the chain on any live domain on demand |
| Lock-in | Seat-based, hard to pause | Stateless API call, nothing to cancel |
None of this means "scrape instead of buying Clearbit." It means: if your volume is bursty, your domains are long-tail, or you need to see why a field is trusted, an on-demand enrichment Actor fits where a seat licence does not.
Run it as one API call. Feed a list of domains, get back enriched records with confidence scores — no key exchange, no minimum commitment.
curl -X POST "https://api.apify.com/v2/acts/renzomacar~company-enrichment/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"domains": ["acme.com", "globex.io", "initech.co"],
"includeContacts": true,
"minConfidence": 0.5
}'Append &format=csv to the dataset URL to hand RevOps a spreadsheet instead of JSON.
Turn a list of domains into a clean company table
Firmographics, tech stack, NAICS and a confidence-scored email pattern — per result, no seat licence. Free Apify credits to start.
Get the Company Enrichment Actor → Or get done-for-you leadsDisclosure: the links to Apify on this page are affiliate links. If you create a paid account through them we may earn a commission, at no extra cost to you. We recommend Apify because we build and ship the Company Enrichment Actor on it ourselves.