I read the public DNS records of 44 AI companies: Cursor's verification token is on 27 of them, more than OpenAI's or Anthropic's

Every company leaves a trail of small notes in its public DNS. When an admin connects a domain to a SaaS tool (to turn on SSO, claim a workspace or send email), the tool usually asks for a TXT record like slack-domain-verification=.... The records stay there, and anyone can read them.

On 3 November 2026 I looked up 45 domains of well-known AI companies: model labs, inference clouds, vector databases, AI coding tools and automation platforms. 44 resolved; black-forest-labs.com is not registered (the company uses a different domain), so it drops out.

Disclosure: I built the domain lookup tool used for this. How to reproduce it with ten lines of Python is at the end.

The headline: Cursor beats the model labs

Counting how many of the 44 domains carry a verification record for each vendor:

Cursor (cursor-domain-verification-...) appears on 27 domains, Anthropic on 26, OpenAI on 21 if you exclude its own domain. Among them are inference providers (Groq, Together AI, Fireworks), automation tools (Zapier, Make, n8n), Hugging Face, Perplexity, Vercel and Supabase.

What this does and does not say:

• A verification record means someone claimed the domain in that product, usually to set up a company workspace, SSO or domain-wide sign-up. It is a strong hint of a team account.
• It does not say how many seats, how much usage, or whether the account is still active. Records are often left behind after a tool is dropped.
• Many companies carry both Anthropic and OpenAI records. Treat it as "has an org account", not "picked a side".

Still, it is a rare public signal on AI tool adoption inside AI companies, and the AI coding tool comes out on top.

Email: everyone is on Google

• 43 of 44 domains route mail to Google Workspace. The one exception, magic.dev, has no MX record that maps to a known provider.
• All 44 publish an SPF record.
• DMARC policy: 24 reject, 15 quarantine, 5 none.

The five at p=none (monitoring only, spoofed mail is still delivered) are deepmind.google, huggingface.co, stability.ai, qdrant.tech and aleph-alpha.com. Moving to quarantine after checking the DMARC reports is usually a small, free fix.

llms.txt: just over half

llms.txt is a proposed file that gives language models a clean, Markdown map of a site. 25 of 44 (57%) serve one at the root of their main domain.

Some names you might expect to have one did not at the time of the check: openai.com, anthropic.com, x.ai, perplexity.ai, huggingface.co, langchain.com and groq.com. Two caveats:

1. I only checked the main domain. Several companies publish llms.txt on their docs subdomain instead which is arguably the more useful place.
2. openai.com, perplexity.ai, character.ai and midjourney.com returned HTTP 403 to the home page check. These sites block automated clients, so "no llms.txt" there can also mean "could not see it".

Hosting: Cloudflare in front, Vercel behind

• DNS provider: Cloudflare 25, Amazon Route 53 8, Google Cloud DNS 6, Namecheap 2, Azure, Vercel and one unknown.
• Server header on the home page: cloudflare 21, Vercel 16, Netlify 2, then single cases (Google Frontend, nginx, Squarespace).
• TLS: all 44 negotiated TLS 1.3. 40 send HSTS.
• Certificates: Google Trust Services 21, Let's Encrypt 20, Amazon 3.
• DNSSEC is rare: only 8 of 44 domains are signed.

16 marketing sites served by Vercel is a lot for one host. Next.js was detected on 21 home pages and React on 23.

The newest companies own the oldest domains

RDAP creation dates are a nice side effect of this kind of lookup. Many young AI companies run on domains registered in the 1990s, which means they bought an aged .com from a previous owner:

Cursor's domain is older than Google. The pattern is consistent: once a company has traction, it trades the .ai / .dev / .sh name for the short .com. In this run, runwayml.com already redirects to runway.com and cognition.ai to cognition.com.

A caution on .ai: x.ai, harvey.ai, sierra.ai, cognition.ai and together.ai all show a creation date of 15–16 December 2017. That is almost certainly an artifact of how the .ai registry migrated its records, not the real registration date. Don't use .ai creation dates for "domain age" without checking.

How to reproduce this

The verification part needs nothing but a DNS resolver. With dnspython:

import re, collections, dns.resolver

domains = ["openai.com", "anthropic.com", "huggingface.co", "vercel.com"]
seen = collections.Counter()
for d in domains:
    try:
        records = [r.to_text().strip('"') for r in dns.resolver.resolve(d, "TXT")]
    except Exception:
        continue
    vendors = set()
    for t in records:
        m = re.match(r"^([a-z0-9]+)[-_](?:domain|site)[-_]verification", t.lower())
        if m:
            vendors.add(m.group(1))
        if t.startswith("MS="):
            vendors.add("microsoft")
    seen.update(vendors)
print(seen.most_common())

For the rest (RDAP registration dates, MX-based email provider, SPF/DMARC parsing, the TLS handshake, llms.txt/robots.txt checks and tech detection from headers and HTML) I used the domain lookup tool I built for my own Apify actors. The full run over 45 domains took 8 seconds and cost about $0.0001 in compute. It returns one flat JSON row per domain, which is what made the counting above a few Counter calls.

If you do sales or security research, run the same snippet on your target list. A new cursor-domain-verification or anthropic-domain-verification record usually appears when a company starts a team rollout, which makes it an early buying signal.

Data: public DNS, RDAP and HTTPS checks of 45 domains, 3 November 2026. Counts are a snapshot; DNS records change often.