Skip to the content
Agent Tools

How Domain Mail Check works

Domain Mail Check reads the mail records a domain publishes in public DNS and says how well they stop someone from sending mail in its name.

POLICYSPFDMARCREPORTSFGRADEINBOXSPAMREJECT
The part that acts: the record added, the policy lever and the flap, the forged letterPublished records on the front: SPF, DMARC and REPORTS; the window reads the gradeHow Domain Mail Check grades a domain. It reads the public DNS records: no SPF and no DMARC is an F, one of them a D, both with p=none a C, an enforcing policy a B, and an enforcing policy with a strict SPF and reports turned on an A. The trays show what happens to a forged letter in each case.

Move the pointer over the picture, tap it, or use the arrow keys to step through it. Its steps:

  1. no SPF, no DMARC · F
  2. SPF only · grade D
  3. DMARC p=none · grade C
  4. p=quarantine · grade B
  5. reject + reports · A

What the picture leaves out

SPF lists the servers allowed to send for the domain. DMARC tells a receiving server what to do with mail that fails the check: nothing (p=none), put it in spam (quarantine) or refuse it (reject).

A grade of A also needs a strict SPF ending and a reports address, so the owner hears about mail sent in their name. The check reads public records only and changes nothing.

Use it

Add the MCP server https://mailcheck.openkrill.app/mcp to your agent client; no key is needed. Install steps for ChatGPT, Claude, Cursor, VS Code, Pi.

More pictures like this one: how the tools work.