Domain Mail Check in Pi
Email DNS and domain check. The MCP server is https://mailcheck.openkrill.app/mcp. No key. The steps below are only for Pi. A call to check_email_auth was checked against that server on 2026-10-01.
What this server answers
Check how a domain is set up for email and who it is registered with, from public DNS and registry data.
Ask "is DMARC set up correctly for github.com?", "check SPF and DKIM for example.com", "which mail provider does acme.io use?" or "when does openai.com expire?".
The email check reads the domain's SPF record (following include and redirect, counting DNS lookups against the limit of 10), its DMARC policy, the MX records and, when you give a DKIM selector, whether the DKIM key is published. It returns a grade from A to F for protection against spoofing, the problems it found and a short list of fixes. The DNS records tool reads A, AAAA, MX, TXT, CAA and NS records with their TTLs, which also shows which mail provider a domain uses and which certificate authorities may issue for it. The registration tool reads the domain's registry record over RDAP: registrar, creation and expiry dates, status flags and name servers.
DNS answers come from Cloudflare's DNS over HTTPS service with Google Public DNS as a fallback, and registration data from the registry of the domain's ending, found through IANA's RDAP directory. Every answer names its source and the date it was read.
It does not send or test mail, read mailboxes, find subdomains, or return who owns a domain: registrant and contact details are never read or returned. It checks the exact domain you give, so a parent domain's SPF or DMARC record is not inherited. The domains you ask about are not stored; the only lasting record is a daily count of calls per tool.
What it can do
- Reads a domain's SPF record, counts its DNS lookups and flags weak or broken policies
- Reads the DMARC policy, percentage and report address
- Checks whether DKIM keys are published for up to 5 selectors you name
- Grades email spoofing protection from A to F with a short list of fixes
- Reads A, AAAA, MX, TXT, CAA and NS records with TTLs and names the mail provider from the MX records
- Shows registrar, creation and expiry dates, status flags and name servers from the registry over RDAP
- Never returns registrant or contact details; names its sources and dates
Tools
check_email_auth, Check email authentication. Use this when the user asks whether a domain's email is set up correctly, such as "is DMARC set up for github.com?" or "check SPF and DKIM for example.com". Pass the domain and, if known, up to 5 DKIM selector names. Returns SPF (policy, DNS lookup count, issues), DMARC (policy, percentage, report address, issues), DKIM per selector, the MX hosts and mail provider, a grade from A to F, a list of fixes, and the source and as_of date. It reads public DNS only: it does not send mail, test delivery or read mailboxes.check_dns_records, Look up DNS records. Use this when the user asks for a domain's DNS records, its mail provider or which certificate authorities may issue for it, such as "which mail provider does acme.io use?" or "show the MX and CAA records for github.com". Pass the domain and optionally up to 6 record types from A, AAAA, MX, TXT, CAA and NS (default: all). Returns each type's records with TTL, the mail provider named by the MX hosts, and the source and as_of date. It reads public DNS only; it cannot list subdomains or other record types.lookup_domain_registration, Look up domain registration. Use this when the user asks who a domain is registered with or when it expires, such as "when does openai.com expire and who is the registrar?". Pass the domain. Returns whether it is registered, the registrar, creation, update and expiry dates, days until expiry, registry status flags, name servers, and the source and as_of date. Registrant and contact details are never returned, so it cannot say who owns a domain.
Add Domain Mail Check in Pi
Pi does not speak MCP on its own. The pi-mcp-adapter extension (these steps match version 2.34.0) loads remote servers and keeps their schemas out of the prompt until you ask. Install it once, then restart Pi:
pi install npm:pi-mcp-adapterAdd the server to a shared MCP file. Use .mcp.json in the project if only that project needs Domain Mail Check, or ~/.config/mcp/mcp.json if you want it in every project. Pi also reads ~/.agents/mcp.json. A Pi-only override lives in ~/.pi/agent/mcp.json or .pi/mcp.json and wins over the shared file.
{
"mcpServers": {
"mailcheck": {
"url": "https://mailcheck.openkrill.app/mcp"
}
}
}The url is enough. Do not set command: that field is for a local process. No API key header. After restart, run /mcp and confirm the server is listed. The first call connects lazily. Ask: Is DMARC set up correctly for github.com? The adapter should offer check_email_auth, check_dns_records, lookup_domain_registration.
Leave directTools off unless you want those schemas in every turn. With a handful of tools the cost is small. The default proxy is the better fit: search for the tool, then call it. /mcp disable mailcheck writes a project override in .pi/mcp.json without editing the shared file. Run /reload after that change.
Pi will not find this server by scanning Cursor or Claude config unless you run /mcp setup and import it. Putting the url in .mcp.json is the direct path and the one this page tests against. The server is the same public endpoint the other clients use, with the same limits and the same privacy rules.
A call checked on 2026-10-01
github.com publishes SPF and DMARC. The grade is a reading of those records, not a security audit. The request below was posted to https://mailcheck.openkrill.app/mcp as tools/call. HTTP 200. Source: the Domain Mail Check server, read 2026-10-01.
{
"method": "tools/call",
"params": {
"name": "check_email_auth",
"arguments": {
"domain": "github.com"
}
}
}- status. ok
- grade. A
- as of. 2026-10-01
- source. Cloudflare DNS over HTTPS (cloudflare-dns.com)
- notice. Checks the exact domain given: SPF and DMARC records of a parent domain are not inherited here. The grade rates protection against spoofing only; it does not read mail or test delivery, and DKIM needs a selector name fro
- dkim status. unknown
Repeat the call yourself if you need a newer reading. Cached answers expire. A rate limit is not a result: wait and try again. Nothing in the call is a ranking, a filing, or advice.