Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    DNS Email Security Check

    1

    Audit SPF, DMARC, and DKIM records to fix email deliverability and prevent domain spoofing.

    $15

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    DNS Email Security Check

    DNS Email Security Check

    Example session with this skill installed

    Audit the email security for example.com. It seems like our marketing emails are going to junk, and I want to make sure our SPF and DMARC are set up correctly.

    • Read your context and instructions
    • Compiled the dns email security

    I have completed the security audit for example.com. The scan identified a critical SPF lookup failure and a weak DMARC policy that are likely causing your deliverability issues.

    Email security posture: example.com (1 Pass / 2 Warn / 1 Fail / 1 Unknown)

    IDCheckStatusTitleRationale
    spf-lookupsSPFFAILToo many DNS lookupsYour record requires 12 lookups, exceeding the RFC limit of 10. This causes a PermError.
    dmarc-policyDMARCWARNPolicy set to p=noneThe current policy only monitors traffic and does not prevent spoofing.
    dmarc-ruaDMARCWARNMissing reporting URINo aggregate reports are being sent, providing no visibility into who is sending mail.
    mx-healthMXPASSValid MX recordsMail exchangers are correctly pointed to reachable hosts.
    dkim-foundDKIMUNKNOWNProbed selectors missedNo keys found at default selectors; verify your specific s= tag in headers.

    Fix first

    • spf-lookups — Reduce DNS lookups by flattening includes or removing unused services — current: v=spf1 include:_spf.google.com include:nodes.sendgrid.net include:mail.zendesk.com include:spf.protection.outlook.com -all

    Recommended upgrades

    • dmarc-policy — Update record to v=DMARC1; p=quarantine; rua=mailto:security@example.com to start filtering unauthorized mail.

    Not determined

    • dkim-undetermined — I could not find a DKIM record using common selectors like 'default' or 'google'. Inspect the DKIM-Signature header of a sent email to find your selector.

    Next steps

    • Update the SPF record at your DNS provider to stay under the 10-lookup budget.
    • Change the DMARC policy to p=quarantine after verifying valid mail flows.
    • Re-run this check with --selectors=... once you identify your DKIM selector.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Mail landing in spam or concerns about domain spoofing often stem from misconfigured DNS records. This skill audits the public email security posture of a domain you own to identify critical vulnerabilities in SPF, DMARC, and DKIM configurations. It replaces manual lookups and RFC cross-referencing with a systematic scan and a prioritized remediation plan.

    What it does

    • SPF Audit identifies missing records, multiple conflicting records, and policy strength, including the 10-DNS-lookup budget limit.
    • DMARC Analysis checks policy enforcement levels (reject, quarantine, none) and aggregate reporting (rua) configurations.
    • DKIM Detection probes common selectors to verify public key availability and revocation status.
    • MX Health Check validates mail exchanger records to ensure they are resolvable and not pointing to dead hosts.
    • TLS Inspection optionally checks port 443 for certificate expiry and handshake validity.

    How it works

    1. Execution involves running the bundled check.mjs script via Node.js for a specific domain with optional flags for TLS or custom selectors.
    2. Analysis parses the resulting JSON report, which categorizes findings into pass, warn, fail, or unknown statuses.
    3. Triage prioritizes critical anti-spoofing failures and delivery blockers over policy hardening and reporting upgrades.
    4. Remediation provides the specific TXT records and DNS changes required to fix identified issues.

    Frameworks & tools

    Built with a zero-dependency Node.js script (requires Node 18+). It uses standard DNS query types (TXT, MX, A/AAAA) and basic TLS handshakes.

    Why this beats prompting it yourself

    Generic LLM prompts often hallucinate SPF lookup counts or fail to catch the nuance of ~all versus -all policies. This skill uses a local script to fetch live DNS data, ensuring the advice is based on your actual current records rather than outdated training data.

    Use cases

    • Fixing Spam Issues by identifying SPF PermErrors caused by exceeding the 10-lookup limit.
    • Hardening Anti-Spoofing by moving DMARC policies from monitoring to enforcement.
    • Pre-deployment Audits to verify new mail provider records before going live.
    • Automated Monitoring by integrating the script into CI/CD to alert on certificate expiry or DNS regressions.

    Known limitations

    Does not perform zone transfers or brute-force subdomain enumeration. DKIM status is marked as undetermined if common selectors are not found, as selectors can be any arbitrary string.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Requires

    Node.js 18+

    Listed3 days ago
    Updated1 day ago

    What's inside

    Frequently Asked Questions