Skip to content

Email Auth Checker

by email-auth-check.quietworklabs.workers.dev · remote · no sign-in to list tools · v1.0.0 · published by dev.workers.quietworklabs.email-auth-check

SPF, DKIM, DMARC, MTA-STS and domain-expiry checks for any domain, with SPF lookup counts.

Changes · 2
CompareRegistry entry

4 tools: 2 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http email-auth-check https://email-auth-check.quietworklabs.workers.dev/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 2Claude Code: ask
  • domain_expiryRegistration data for a domain from the registry's RDAP server (IANA bootstrap): registrar, created/updated/expiry dates, days until expiry with ok/expiring_soon/expired status, EP…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Registration data for a domain from the registry's RDAP server (IANA bootstrap): registrar, created/updated/expiry dates, days until expiry with ok/expiring_soon/expired status, EPP status codes, nameservers and DNSSEC. Works for gTLDs and ccTLDs that publish RDAP. Deterministic, no AI. Price: $0.002 USDC per call via x402 (Base); the first 5 calls per day per client are free.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • email_auth_reportFull email-auth report for a domain: SPF (recursive 10-lookup count, void lookups, +all/?all, terms after all), DMARC (policy, pct, alignment, rua authorization), DKIM (keys and RS…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Full email-auth report for a domain: SPF (recursive 10-lookup count, void lookups, +all/?all, terms after all), DMARC (policy, pct, alignment, rua authorization), DKIM (keys and RSA key bits at common selectors or your own via selectors=), MX/null MX, MTA-STS policy, TLS-RPT, BIMI, and a Gmail/Yahoo/Outlook bulk-sender readiness verdict. Deterministic DNS-over-HTTPS, no AI. Price: $0.003 USDC per call via x402 (Base); the first 5 calls per day per client are free.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
Only reads 2Claude Code: allow
  • dmarc_checkFinds and validates a domain's DMARC record (falls back to the organizational domain): policy, subdomain policy, pct, alignment modes, rua/ruf, and whether external report domains …No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Finds and validates a domain's DMARC record (falls back to the organizational domain): policy, subdomain policy, pct, alignment modes, rua/ruf, and whether external report domains authorized reports (RFC 7489 7.1). Deterministic, no AI. Price: $0.001 USDC per call via x402 (Base); the first 5 calls per day per client are free.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • spf_lookup_countExpands a domain's SPF record recursively (include/redirect) like a receiver does and counts DNS-querying terms against the RFC 7208 limit of 10 and void lookups against the limit …No findings

    Why it is in this group

    • The name "spf_lookup_count" says "lookup": a word for reading.
    Description, as the server wrote it
    Expands a domain's SPF record recursively (include/redirect) like a receiver does and counts DNS-querying terms against the RFC 7208 limit of 10 and void lookups against the limit of 2. Returns per-term lookup costs, problems (permerror causes) and warnings. Deterministic, no AI. Price: $0.001 USDC per call via x402 (Base); the first 5 calls per day per client are free.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http email-auth-check https://email-auth-check.quietworklabs.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__email-auth-check__spf_lookup_count",
      "mcp__email-auth-check__dmarc_check"
    ],
    "ask": [
      "mcp__email-auth-check__email_auth_report",
      "mcp__email-auth-check__domain_expiry"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as email-auth-check. Review it before you use it.