SecLens.ONE Email Security

one.seclensPublished by seclens.oneOfficial publisherv1.0.0Updated Oct 30, 2026

Assess any domain's email security across SPF, DMARC, DKIM, MTA-STS, DNSSEC, DANE, and TLS-RPT.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that runs public email-security assessments of a domain (SPF, DMARC, DKIM, MTA-STS, DNSSEC, DANE, TLS-RPT) and returns scored results.

What you can do
  • Start a public email-security assessment for a domain and poll for its result
  • Fetch the latest stored assessment for a domain, including remediation packs and BIMI when assessed
  • Fetch the live public corpus snapshot of aggregate results
When to use it
Useful when you want an assistant to check or explain a domain's email authentication and transport-security posture, or to look up existing public assessment results, without running any tooling locally.
Requirements
A remote Streamable HTTP endpoint; no package, account, API key or environment variable is declared. The server itself performs DNS lookups and one HTTPS request to the MTA-STS policy endpoint.
Before you install
Assessments are public and stored, so submitted domain names and results are visible to others. The server queries third-party DNS resolvers (Cloudflare by default) and the target domain's MTA-STS endpoint. It does not send mail.

Installation

In SourceWeft

  1. Open SecLens.ONE Email Security in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/one.seclens%2Fseclens/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "seclens-one-email-security": {
      "type": "http",
      "url": "https://seclens.one/mcp"
    }
  }
}

README

SecLens.ONE email security assessor

Standalone Go CLI for the public email-security checks on SecLens.ONE.

Scored protocols are SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DANE, and DNSSEC. BIMI is informational and does not change the score. The assessor uses passive DNS and one HTTPS GET to the MTA-STS policy endpoint. It does not send mail.

Protocol logic lives in internal/assessor/rfc*/ packages. Thin bridge files wire DNS lookups and scoring.

Source is https://github.com/42Sec-Pte-Ltd/seclens.

Checks

  • SPF (RFC 7208). Presence, qualifiers, lookup limits, and common misconfiguration hints.
  • DMARC (RFC 7489). Policy, reporting tags, and enforcement.
  • DKIM (RFC 6376). Common selector discovery.
  • MTA-STS (RFC 8461). DNS advertisement, one HTTPS GET of the policy, and MX matching.
  • TLS-RPT (RFC 8460). _smtp._tls advertisement and reporting URIs.
  • DANE (RFC 7672). TLSA records for discovered MX hosts.
  • DNSSEC (RFC 4034 and RFC 4035). DS presence and the DoH AD-bit signal.
  • BIMI. Informational only. It does not change the score.
  • Null MX (RFC 7505). Detects domains that do not receive mail.

Bulk assessment uses bounded concurrency. Output is text, JSON, or JSONL. JSON DoH resolvers default to Cloudflare. Google and Quad9 are supported.

MCP Server

Anonymous Streamable HTTP at https://seclens.one/mcp.

Tools are get_result, assess_domain, and get_summary.

Cursor 1-Click Install opens Add SecLens.ONE.

mcp.json:

json
{  "mcpServers": {    "seclens": {      "type": "http",      "url": "https://seclens.one/mcp"    }  }}

Dependencies

Core DNS and HTTP use the Go standard library. One module dependency handles internationalized domain names.

Run go list -m all after go mod download to inspect the module graph.

Build

bash
go build -o seclens ./cmd/seclens

Assess

bash
./seclens assess cloudflare.com./seclens assess --format jsonl example.com google.comcat domains.txt | ./seclens assess --stdin --concurrency 12 --format jsonl > results.jsonl./seclens assess --file domains.txt --resolver google,cloudflare

Resolver flag values are cloudflare, google, and quad9. Separate a pool with commas.

Tests

bash
go test ./...

Research

The CLI measures the same controls as the SecLens Top-1M studies:

License

Licensed under the Apache License, Version 2.0.

Source: README.md at commit cb192bf

Tools

3

assess_domain

Assess Domain Email Security

Start a public SecLens.ONE email-security assessment for a domain. Poll get_result afterwards.

Parametersdomainrequired

get_result

Get Stored Domain Assessment

Fetch the latest stored public SecLens.ONE assessment for a domain. The JSON includes Remediation.packs, matching the HTML remediation pack. BIMI is included when assessed and does not change the score.

Parametersdomainrequired

get_summary

Get Global Pulse Corpus Summary

Fetch the live public SecLens.ONE corpus snapshot.

Takes no parameters.

Version history

1
  1. v1.0.0LatestOct 30, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts