Email Auth Checker

dev.workers.quietworklabs.email-auth-checkPublished by email-auth-check.quietworklabs.workers.devOfficial publisherv1.0.0Updated Oct 27, 2026

SPF, DKIM, DMARC, MTA-STS and domain-expiry checks for any domain, with SPF lookup counts.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that audits a domain's email authentication setup — SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI — plus domain expiry data.

What you can do
  • Run a full email-auth report for a domain covering SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT, BIMI and Gmail/Yahoo guidance
  • Expand an SPF record recursively and count DNS-querying terms and void lookups against RFC 7208 limits, with per-term costs and errors
  • Validate a domain's DMARC record, including policy, pct, alignment, rua/ruf and external report authorization
  • Look up domain registration data via RDAP: registrar, dates, days until expiry, EPP status, nameservers and DNSSEC
When to use it
Useful when checking why mail from a domain is failing authentication, preparing or reviewing SPF/DKIM/DMARC records, or monitoring domain expiry and DNSSEC status. Handy for deliverability troubleshooting and pre-send configuration reviews.
Requirements
A remote streamable HTTP endpoint; no local runtime, account or API key is declared. Calls are paid per use in USDC via x402 on Base, with a small number of free calls per tool. Network access to the endpoint and to public DNS/RDAP data is implied.
Before you install
Each tool call costs USDC via x402 on Base after the free allowance, so a wallet and spending are involved. The server queries public DNS and RDAP records for whatever domains you submit, so queried domain names are disclosed to the service and to those lookups.

Installation

In SourceWeft

  1. Open Email Auth Checker in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.quietworklabs.email-auth-check%2Femail-auth-check/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "email-auth-checker": {
      "type": "http",
      "url": "https://email-auth-check.quietworklabs.workers.dev/mcp"
    }
  }
}

Tools

4

email_auth_report

Full email authentication report for a domain

Full email-auth report for a domain: SPF (recursive 10-lookup count, void lookups, +all/?all, terms after all), DMARC (policy, pct, alignment, rua authorization), DKIM (keys and RSA key bits at common selectors or your own via selectors=), MX/null MX, MTA-STS policy, TLS-RPT, BIMI, and a Gmail/Yahoo/Outlook bulk-sender readiness verdict. Deterministic DNS-over-HTTPS, no AI. Price: $0.003 USDC per call via x402 (Base); the first 5 calls per day per client are free.

Parametersdomainrequiredselectors

spf_lookup_count

SPF record tree with RFC 7208 lookup and void-lookup counts

Expands a domain's SPF record recursively (include/redirect) like a receiver does and counts DNS-querying terms against the RFC 7208 limit of 10 and void lookups against the limit of 2. Returns per-term lookup costs, problems (permerror causes) and warnings. Deterministic, no AI. Price: $0.001 USDC per call via x402 (Base); the first 5 calls per day per client are free.

Parametersdomainrequired

dmarc_check

DMARC record parse and validation

Finds and validates a domain's DMARC record (falls back to the organizational domain): policy, subdomain policy, pct, alignment modes, rua/ruf, and whether external report domains authorized reports (RFC 7489 7.1). Deterministic, no AI. Price: $0.001 USDC per call via x402 (Base); the first 5 calls per day per client are free.

Parametersdomainrequired

domain_expiry

Domain registration and expiry date via RDAP

Registration data for a domain from the registry's RDAP server (IANA bootstrap): registrar, created/updated/expiry dates, days until expiry with ok/expiring_soon/expired status, EPP status codes, nameservers and DNSSEC. Works for gTLDs and ccTLDs that publish RDAP. Deterministic, no AI. Price: $0.002 USDC per call via x402 (Base); the first 5 calls per day per client are free.

Parametersdomainrequired

Version history

1
  1. v1.0.0LatestOct 18, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.