Skip to content

scan.mx Email Diagnostics

by scan.mx · remote · no sign-in to list tools · v1.1.0 · published by mx.scan

Email deliverability check: MX, SPF, DKIM, DMARC, blacklists, MTA-STS, DNSSEC, BIMI. Graded, no key.

Changes · 9
CompareRegistry entry

9 tools: 9 change things.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http diagnostics https://api.scan.mx/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warncheck_domain

    The server marks "check_domain" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Changes things 9Claude Code: ask
  • check_bimiCheck the domain BIMI record at default._bimi: the SVG logo URL, the VMC/CMC certificate, and the DMARC enforcement BIMI needs.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check the domain BIMI record at default._bimi: the SVG logo URL, the VMC/CMC certificate, and the DMARC enforcement BIMI needs.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_blacklistCheck whether the domain and its mail server IPs are listed on the Spamhaus (ZEN, DBL, ZRD, AuthBL), SpamCop, GBUdb and PSBL blocklists.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check whether the domain and its mail server IPs are listed on the Spamhaus (ZEN, DBL, ZRD, AuthBL), SpamCop, GBUdb and PSBL blocklists.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_dkimCheck DKIM signing keys for a domain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check DKIM signing keys for a domain. Without a selector, common provider selectors are probed. Pass an explicit selector to look up that exact key at selector._domainkey.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_dmarcCheck the domain DMARC policy at _dmarc: presence, policy strength (none/quarantine/reject), and reporting.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check the domain DMARC policy at _dmarc: presence, policy strength (none/quarantine/reject), and reporting.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_dnssecCheck DNSSEC validation and DNS health: delegation, nameserver count, SOA, and reverse DNS of the mail servers.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check DNSSEC validation and DNS health: delegation, nameserver count, SOA, and reverse DNS of the mail servers.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_domainRun the full email and DNS deliverability check for a domain: MX, SPF, DKIM, DMARC, DNS health, provider detection, and blacklists.1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "check_domain" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run the full email and DNS deliverability check for a domain: MX, SPF, DKIM, DMARC, DNS health, provider detection, and blacklists. Returns a letter grade (A+ to F, where specific weaknesses cap the grade), a 0 to 100 score, and every individual check with its RFC reference. Set include_smtp to also run a live SMTP probe of the mail servers: the probe is non-blocking, so when smtp_status is "pending" or "running" call this tool again (poll_after_seconds hints how long to wait) until smtp_status is "complete" and the SMTP checks appear in checks.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_mta_stsCheck the domain MTA-STS policy (_mta-sts TXT and the HTTPS policy file, mode and MX coverage) and its TLS-RPT reporting record.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check the domain MTA-STS policy (_mta-sts TXT and the HTTPS policy file, mode and MX coverage) and its TLS-RPT reporting record.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_mxCheck the MX records of a domain: presence, hostnames, resolution, null-MX, and common misconfigurations.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check the MX records of a domain: presence, hostnames, resolution, null-MX, and common misconfigurations.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • check_spfCheck the domain SPF policy: presence, syntax, the all qualifier, and the 10-lookup limit.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check the domain SPF policy: presence, syntax, the all qualifier, and the 10-lookup limit.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http diagnostics https://api.scan.mx/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__diagnostics__check_domain",
      "mcp__diagnostics__check_mx",
      "mcp__diagnostics__check_spf",
      "mcp__diagnostics__check_dmarc",
      "mcp__diagnostics__check_blacklist",
      "mcp__diagnostics__check_mta_sts",
      "mcp__diagnostics__check_dnssec",
      "mcp__diagnostics__check_bimi",
      "mcp__diagnostics__check_dkim"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as diagnostics. Review it before you use it.