Auth Posture — Email Deliverability & Spoofability Audit

app.rowb.auth-posturePublished by auth-posture.rowb.appOfficial publisherv1.0.0Updated Oct 24, 2026

One-call domain audit: MX receiving, SPF/DMARC/DKIM spoofing protection, disposable-address risk.

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant audit an email domain in one call for mail receiving, spoofability and disposable-address risk.

What you can do
Exposes one tool, audit_domain, that audits an email domain in a single call. It checks whether the domain can receive mail (MX), whether it can be spoofed based on SPF, DMARC and DKIM posture, and whether it is a disposable address. Results include can_receive, can_be_spoofed, score, reasons and checks.
When to use it
Use it when you need a quick check of whether a domain can receive mail, how easily its sender address could be spoofed, or whether it looks like a disposable address. Fits list cleanup, pre-send checks, and basic security hygiene.
Requirements
Remote service reached over streamable HTTP at the provider endpoint; no local runtime needed. Free tier allows 3 audits per day without signup; a key from the provider's signup page raises this to 50 audits per month and is sent in the Authorization header.
Before you install
Requires a Bearer API key in the Authorization header; keep it private. Domain names are sent to a third-party service for auditing. The no-signup allowance is limited, so continued use needs a signup.

Installation

In SourceWeft

  1. Open Auth Posture — Email Deliverability & Spoofability Audit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/app.rowb.auth-posture%2Faudit/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "auth-posture-email-deliverability-spoofa": {
      "type": "http",
      "url": "https://auth-posture.rowb.app/mcp"
    }
  }
}

Tools

1

audit_domain

Audit an email domain in one call: can it receive mail (MX), can it be spoofed (SPF/DMARC/DKIM posture), disposable check. Returns {can_receive, can_be_spoofed, score, reasons, checks}.

Parametersdomainrequired

Version history

1
  1. v1.0.0LatestSep 23, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.