operations / skill
Email Domain Setup Checker
Check an email domain's DNS setup and explain findings without changing records.
At a glance
- Purpose
- Check an email domain's DNS setup and explain findings without changing records.
- Runs in
- Local agent with shell
- Operating systems
- Not stated
- Needs
- Runtime: Python 3.10+, standard library only; Needs internet: Yes; Needs accounts or API keys beyond your agent: No
- Files and data
- Reads files: Not stated; Writes files: No; Sends data to other services: Yes
- Tool type
- Skill
- Delivery
- Download from Skills Outpost
- Version
- 0.1.1
- ZIP SHA-256
- f99d855cd1abebb18d947029077ffdd76516986efa97488ba14bd745744a3b96
- Access
- Download from Skills Outpost
- Compatibility
- Requires Python 3.10 or newer and an Agent Skills compatible harness that can run a command-line Python script. Uses only the Python standard library. DNS queries use Google Public DNS by default or Cloudflare's DNS-over-HTTPS JSON endpoint by choice. HTTPS access is required to the selected resolver; optional MTA-STS policy retrieval also reaches mta-sts.<checked-domain>. Recursive SPF checks look up include and redirect targets named in DNS records, which can be unrelated third-party domains; those names are sent to the selected resolver.
- External costs
- The skill is free under the MIT license. It uses public DNS-over-HTTPS endpoints and requires no paid account. Your network provider may charge for connectivity; consult its terms for any usage limits.
- Permissions
- Read-only HTTPS requests to dns.google or cloudflare-dns.com for DNS-over-HTTPS JSON. With --mta-sts, read-only HTTPS to mta-sts.<checked-domain> for its policy. No credentials, DNS modification or file output. Python urllib honors HTTPS_PROXY, https_proxy, NO_PROXY and no_proxy; macOS or Windows system proxy settings may also apply. Tests only: EMAIL_DNS_FAKE_RESPONSES names a synthetic fixture and EMAIL_DNS_FAKE_TRANSPORT_TEST_ACK=1 enables the fake transport. Recursive SPF checks look up include and redirect targets named in DNS records, which can be unrelated third-party domains; those names are sent to the selected resolver.
- Usage terms
- MIT license. Copyright 2026 Zero Width Lab. Google Public DNS is a Google service and Cloudflare is a trademark of Cloudflare; this product is independent and has no affiliation with either provider. By Zero Width Lab (zerowidthlab.com)
Download from Skills Outpost
Get this version
FreeStatic source, format, secret-pattern and declaration checks with independent human source review.
- SHA-256 of the released ZIP
f99d855cd1abebb18d947029077ffdd76516986efa97488ba14bd745744a3b96
The creator shows this version's package files publicly: anyone can read SKILL.md and the other files under Files, without an account. The ZIP download needs the version in your Library (how it works).
Sign in to add this version to your library and follow its creator for free.
Sign in to get freeA creator follow is free, not a paid membership. Your email is not shared with the creator.
Files
Version 0.1.1, shown publicly by its creator, exactly as in this version's ZIP. ZIP SHA-256: f99d855cd1abebb18d947029077ffdd76516986efa97488ba14bd745744a3b96. License: MIT (read it).
Each file has its own address. Read one as a web page at https://, or as JSON at https://; replace SKILL.md with any path below.
- manifest.json · 2.6 KiB
- LICENSE.txt · 1.0 KiB
- README.md · 3.6 KiB
- SETUP.md · 5.0 KiB
- SKILL.md · 6.2 KiB
- agents/email-domain-setup-checker-agent.md · 3.1 KiB
- references/email-records.md · 5.4 KiB
- scripts/email_domain_setup_checker.py · 18.9 KiB
- source-package.json · 4.7 KiB
- tests/test_email_domain_setup_checker.py · 21.9 KiB
- tests/test_hygiene.py · 5.0 KiB
MIT
MIT LicenseCopyright (c) 2026 Zero Width Lab
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Version history
- Version 0.1.1 Current
No release notes for this version.
What it does
Email Domain Setup Checker is a read-only Agent Skill that reviews email DNS records and explains likely setup issues. An agent harness is software that installs the skill and runs its Python command for you. It needs Python 3.10 or newer and HTTPS access to a public DNS-over-HTTPS resolver, with no account or credentials. It is free under the MIT license. This listing delivers the complete package with scripts.The checker reports MX presence; SPF record count, DNS-querying terms across nested policies, loops and risky mechanisms; DMARC policy, reporting, alignment and subdomain settings; supplied and common DKIM selector probes; and TLS-RPT, MTA-STS and BIMI records. Select Google Public DNS or Cloudflare for DNS queries. An optional flag fetches the MTA-STS policy from the checked domain. Findings use plain language and error, warning, info or ok severity, with JSON output for automation.
The tool only reads. An approval-gated action would require a reviewed preview before a change; this skill performs no DNS changes or other consequential actions. SPF output is a static lookup count following RFC 7208 processing order: include, a, mx, ptr, exists and redirect count recursively, terms after all are ignored, and redirect is ignored when all is present. The walker does not evaluate macros or match a sender IP, so it does not provide a definitive SPF pass/fail evaluation. An eleventh counted term stops further SPF lookups and warns that evaluation can stop earlier for a matching sender. Macro targets warn that they are not followed and the count is partial. Duplicate redirects warn with RFC 7208 section 6; neither is followed or counted. These skipped cases, failed lookups or the 60-query DNS ceiling mark the report incomplete, with skipped checks listed.
Recursive SPF checks look up include and redirect targets named in DNS records, which can be unrelated third-party domains; those names are sent to the selected resolver.
Who it is for
Domain owners, administrators, and support teams reviewing email delivery and authentication setup with an agent harness.Example tasks
Check whether an email domain has MX records and exactly one SPF record.Count SPF DNS-querying terms across nested policies, identify counts above the limit and loops, and flag unsafe all mechanisms.
Review DMARC policy, reporting addresses, alignment and subdomain policy.
Probe supplied DKIM selectors and a documented set of common selectors.
Check TLS-RPT, MTA-STS and BIMI records, and optionally fetch an MTA-STS policy.
Get machine-readable JSON findings for a support ticket.
Getting started
SKILL.md and the scripts can be read without an account: SKILL.md at https://
From the package directory, run:
python3 scripts/email_domain_setup_checker.py check example.org
python3 scripts/email_domain_setup_checker.py check example.org --dkim-selector mail --resolver cloudflare --json
python3 scripts/email_domain_setup_checker.py check example.org --mta-sts
Replace the example domain and selector with values you own or are authorized to inspect. A failed lookup, skipped SPF macro target, duplicate redirects or the 60-query DNS ceiling marks the report incomplete and exits 2; --allow-partial opts into using the available findings. Invalid input or fixture setup also exits 2. With --allow-partial, error findings exit 3 and no errors exit 0. The fake-transport environment variables are for bundled tests only.
Recursive SPF checks look up include and redirect targets named in DNS records, which can be unrelated third-party domains; those names are sent to the selected resolver.
Limitations
DNS results are a point-in-time view from the selected public resolver. Records can differ by cache, location or propagation state. A common DKIM selector missing from DNS is informational; it does not prove DKIM is broken. The checker does not send a message, test inbox placement, verify ownership, change records or certify deliverability. MTA-STS policy retrieval is optional and fetches from the domain being checked. SPF is a static lookup count in RFC 7208 processing order, without macro evaluation or sender-IP matching; it provides no definitive SPF pass/fail result. Void lookups are not measured. Macro targets warn that they are not followed and the static count is partial; duplicate redirects warn with RFC 7208 section 6 and neither is followed or counted. Both cases mark the report incomplete. Above-10 counts warn that evaluation can stop earlier for a matching sender; a 60-query DNS ceiling stops the run with an incomplete result.Version 0.1.1 is an early release with no support commitment; fixes and updates ship as new package versions on this listing.