README.md — Email Domain Setup Checker

# Email Domain Setup Checker

A read-only command-line skill for checking the public email setup of a domain. It inspects MX, SPF, DMARC, DKIM, TLS-RPT, MTA-STS, and BIMI and explains findings in plain English. It does not change DNS or require credentials.

## Quick start

Requires Python 3.10 or newer and network access to a declared DNS-over-HTTPS resolver.

```bash
python3 scripts/email_domain_setup_checker.py check example.com
python3 scripts/email_domain_setup_checker.py check example.com --dkim-selector mail --json
python3 scripts/email_domain_setup_checker.py check example.com --resolver cloudflare --mta-sts
```

Google Public DNS is selected by default. `--mta-sts` adds one HTTPS policy request to the checked domain's `mta-sts` subdomain. The tool also probes seven common DKIM selectors. The absence of a probed selector is informational; supply the actual selectors for a meaningful DKIM check.

The default report marks each finding `error`, `warning`, `info`, or `ok`. SPF output is a static lookup count following RFC 7208 processing order: include, a, mx, ptr, exists and redirect count recursively, terms after all are ignored, and redirect is ignored when all is present. The walker does not evaluate macros or match a sender IP, so it does not provide a definitive SPF pass/fail evaluation. Void lookups are not measured. Macro include/redirect targets are not followed: they produce a warning and mark the static count partial and the report incomplete. Duplicate redirect modifiers produce a warning citing RFC 7208 section 6; neither redirect is followed or counted, and the report is incomplete. An eleventh counted term stops further SPF lookups and produces a warning: "static lookup count is N, above the 10-lookup limit; evaluation can stop earlier for a matching sender". This warning alone does not cause exit 3. A ceiling of 60 DNS queries per run stops the check with an incomplete result. Incomplete reports exit 2 unless `--allow-partial` is selected; otherwise error findings give exit 3 and no error findings give exit 0. With `--allow-partial`, inspect `incomplete` and the skipped-check list before relying on the report. External text is escaped onto single lines in human-readable output; `--json` emits JSON.

Invalid command-line input or fixture setup also exits 2. With `--allow-partial`, an incomplete report exits 3 if it contains error findings and 0 otherwise.

## Safety

The checker only reads public records. It has no credentials, telemetry, or output files. It validates HTTPS destinations and redirects. DNS records can change or vary by resolver, and their presence does not prove mail delivery, enforcement, or security. Review proposed DNS changes with the domain's mail provider.

The CLI contacts `dns.google` or `cloudflare-dns.com`. Recursive SPF checks look up include and redirect targets named in DNS records, which can be unrelated third-party domains; those names are sent to the selected resolver. With `--mta-sts` it also contacts `mta-sts.<checked-domain>`. Python urllib honors `HTTPS_PROXY`, `https_proxy`, `NO_PROXY`, `no_proxy`, and macOS or Windows system proxy settings. TLS still terminates at the destination host.

See [SETUP.md](SETUP.md) for installation and testing, [SKILL.md](SKILL.md) for agent workflow, and [references/email-records.md](references/email-records.md) for record interpretation.

Version 0.1.1. Free under the MIT license; see [LICENSE.txt](LICENSE.txt). Distributed through Skills Outpost.

Google Public DNS is a Google service. Cloudflare is a trademark of Cloudflare. This product is independent and has no affiliation with either provider.

By Zero Width Lab (zerowidthlab.com)

License: MIT (read it).

Back to the listing