Skip to content

MailVakt

by mailvakt.com · remote · no sign-in to list tools · v0.1.1 · published by com.mailvakt

Use when email lands in spam: audits SPF, DKIM, DMARC, MX and returns the DNS records to fix it.

Changes · 4
CompareRegistry entry

8 tools: 4 change things and 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http mailvakt https://mcp.mailvakt.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warngenerate_dns_records

    The server marks "generate_dns_records" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "generate_dns_records" says "generate": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 4Claude Code: ask
  • add_domainAdd a domain to the signed-in user's MailVakt account for DMARC report collection.No findings

    Why it is in this group

    • The name "add_domain" says "add": a word for a change.
    Description, as the server wrote it
    Add a domain to the signed-in user's MailVakt account for DMARC report collection. Takes a domain; returns its DMARC reporting (rua) address and account entry. Repeated calls for the same account and domain return the existing entry. Requires domains:write permission. Does not verify domain ownership, modify DNS, or start receiving reports until the user publishes the reporting address in DNS.

    Annotations the server declares

    • title: Add domain
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • diagnose_domainAudit a domain's SPF, DKIM, DMARC, MX, alignment, BIMI, MTA-STS and TLS-RPT setup and check it against free public blocklists (not Spamhaus) when troubleshooting email authenticati…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Audit a domain's SPF, DKIM, DMARC, MX, alignment, BIMI, MTA-STS and TLS-RPT setup and check it against free public blocklists (not Spamhaus) when troubleshooting email authentication or spam delivery. Takes a domain, optional checks and DKIM selectors, and fresh=true to bypass cached results. Returns a graded scorecard, findings, proposed DNS fixes and a public report permalink. Uses DNS and policy-file lookups; never changes DNS or guarantees inbox placement.

    Annotations the server declares

    • title: Diagnose email domain
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • generate_dns_recordsPropose email-authentication DNS records and policy files for a domain using its DNS configuration and optional provider names or IDs.1 finding

    Why it is in this group

    • The name "generate_dns_records" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_dns_records" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "generate_dns_records" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Propose email-authentication DNS records and policy files for a domain using its DNS configuration and optional provider names or IDs. Supports baseline (monitoring) or enforce goals; baseline is the default. Returns typed SPF, DKIM, DMARC, MTA-STS and TLS-RPT proposals or provider setup instructions where applicable. Provider-specific values and reporting addresses may need user input. Uses public DNS/policy lookups, possibly cached. Does not publish records or change DNS.

    Annotations the server declares

    • title: Generate email DNS records
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • start_inbox_testCreate an email-receipt test in MailVakt.No findings

    Why it is in this group

    • The name "start_inbox_test" says "start": a word for a change.
    Description, as the server wrote it
    Create an email-receipt test in MailVakt. Takes an optional expected sender domain; returns a test ID, unique recipient address and expiry time. The user must send a test message to that address before expiry, then use get_inbox_test to read the result. Creates a new test on each call. Does not send email or measure inbox-versus-spam placement at Gmail, Outlook or other mailbox providers.

    Annotations the server declares

    • title: Start inbox test
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
Only reads 4Claude Code: allow
  • analyze_email_headersAnalyze raw email headers supplied by the user to investigate authentication or delivery issues.No findings

    Why it is in this group

    • The name "analyze_email_headers" says "analyze": a word for reading.
    Description, as the server wrote it
    Analyze raw email headers supplied by the user to investigate authentication or delivery issues. Returns the SPF, DKIM and DMARC results reported in those headers, alignment, the sending IP, whether that IP and the From domain are on free public blocklists (not Spamhaus), and detected issues. It does not independently verify DKIM signatures or establish the receiving provider's exact spam-filter decision. Provide headers only, not the message body.

    Annotations the server declares

    • title: Analyze email headers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • get_dmarc_summarySummarize received DMARC aggregate reports for a domain already in the signed-in user's MailVakt account.No findings

    Why it is in this group

    • The name "get_dmarc_summary" says "get": a word for reading.
    Description, as the server wrote it
    Summarize received DMARC aggregate reports for a domain already in the signed-in user's MailVakt account. Takes the domain and a 1-to-90-day window (default 7); returns report and message totals, DMARC pass/fail counts, and per-source SPF/DKIM alignment and receiver actions. Requires domains:read and reports:read permissions. Returns zero totals if no reports were received, or an error if the domain is not in the account. Does not add domains or generate report traffic.

    Annotations the server declares

    • title: DMARC report summary
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_inbox_testRead a MailVakt email-receipt test using the ID returned by start_inbox_test.No findings

    Why it is in this group

    • The name "get_inbox_test" says "get": a word for reading.
    Description, as the server wrote it
    Read a MailVakt email-receipt test using the ID returned by start_inbox_test. Returns pending, received or expired status and, when processed, the received message's authentication, unsubscribe, content and deliverability findings. Reports processing failures as errors. Anyone with the test ID can retrieve it; use only an ID supplied by the user or created in this conversation. Does not measure placement at other mailbox providers.

    Annotations the server declares

    • title: Get inbox test result
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_domainsList domains in the signed-in user's MailVakt account, including each domain's DMARC reporting address.No findings

    Why it is in this group

    • The name "list_domains" says "list": a word for reading.
    Description, as the server wrote it
    List domains in the signed-in user's MailVakt account, including each domain's DMARC reporting address. Takes no input and requires domains:read permission. Returns an empty list if the account has no domains. Use to find the account's available domains before requesting DMARC summaries; does not enumerate domains belonging to other users.

    Annotations the server declares

    • title: List domains
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http mailvakt https://mcp.mailvakt.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__mailvakt__analyze_email_headers",
      "mcp__mailvakt__get_inbox_test",
      "mcp__mailvakt__list_domains",
      "mcp__mailvakt__get_dmarc_summary"
    ],
    "ask": [
      "mcp__mailvakt__diagnose_domain",
      "mcp__mailvakt__generate_dns_records",
      "mcp__mailvakt__start_inbox_test",
      "mcp__mailvakt__add_domain"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as mailvakt. Review it before you use it.