Remote MCP server that lets an assistant run graded email deliverability and DNS checks on a domain, covering MX, SPF, DKIM, DMARC, blacklists and more.
What you can do
Run a full graded deliverability check on a domain, returning a letter grade, a 0 to 100 score and each individual check with its RFC reference, optionally including SMTP probes via include_smtp. Check MX records for presence, hostnames, resolution, null-MX and misconfigurations. Check SPF policy syntax, the all qualifier and the 10-lookup limit. Check DMARC policy strength and reporting, and DKIM keys by probing common provider selectors or an explicit selector. Check blacklist listings across Spamhaus, SpamCop, GBUdb and PSBL. Check MTA-STS and TLS-RPT, DNSSEC and DNS health, and BIMI records with logo URL, certificate and DMARC enforcement.
When to use it
Useful when you need to diagnose why email from a domain may be rejected, filtered or spoofable, or to audit a domain's DNS email configuration before or after setup. Good for quick, no-key checks of SPF, DKIM, DMARC, blacklists and related records.
Requirements
Remote streamable HTTP endpoint at api.scan.mx; no packages, environment variables, headers or authentication are declared. Network access to the endpoint and to the domain's DNS records is needed.
Before you install
Checks are read-only lookups, but the domain names you submit are sent to a third-party service. Setting include_smtp may cause the service to connect to the domain's mail servers. No credentials are requested.
Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/mx.scan%2Fdiagnostics/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.
Run the full email and DNS deliverability check for a domain: MX, SPF, DKIM, DMARC, DNS health, provider detection, and blacklists. Returns a letter grade (A+ to F, where specific weaknesses cap the grade), a 0 to 100 score, and every individual check with its RFC reference. Set include_smtp to also run a live SMTP probe of the mail servers: the probe is non-blocking, so when smtp_status is "pending" or "running" call this tool again (poll_after_seconds hints how long to wait) until smtp_status is "complete" and the SMTP checks appear in checks.
Parametersdomainrequiredinclude_smtp
check_mx
Check MX records
Check the MX records of a domain: presence, hostnames, resolution, null-MX, and common misconfigurations.
Parametersdomainrequired
check_spf
Check SPF
Check the domain SPF policy: presence, syntax, the all qualifier, and the 10-lookup limit.
Parametersdomainrequired
check_dmarc
Check DMARC
Check the domain DMARC policy at _dmarc: presence, policy strength (none/quarantine/reject), and reporting.
Parametersdomainrequired
check_blacklist
Check blacklists
Check whether the domain and its mail server IPs are listed on the Spamhaus (ZEN, DBL, ZRD, AuthBL), SpamCop, GBUdb and PSBL blocklists.
Parametersdomainrequired
check_mta_sts
Check MTA-STS
Check the domain MTA-STS policy (_mta-sts TXT and the HTTPS policy file, mode and MX coverage) and its TLS-RPT reporting record.
Parametersdomainrequired
check_dnssec
Check DNSSEC and DNS health
Check DNSSEC validation and DNS health: delegation, nameserver count, SOA, and reverse DNS of the mail servers.
Parametersdomainrequired
check_bimi
Check BIMI
Check the domain BIMI record at default._bimi: the SVG logo URL, the VMC/CMC certificate, and the DMARC enforcement BIMI needs.
Parametersdomainrequired
check_dkim
Check DKIM
Check DKIM signing keys for a domain. Without a selector, common provider selectors are probed. Pass an explicit selector to look up that exact key at selector._domainkey.
Parametersdomainrequiredselector
Version history
2
v1.1.0LatestOct 13, 2026
v1.0.0Sep 16, 2026
Score
72%
72% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Publish an icon in the registry entry.
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
LicenseNot applicable
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.
