Email DNS Health

Language

Match user’s language: Respond in the same language the user uses.

Overview

A zero-dependency email DNS health checker that uses dig and jq to audit SPF, DKIM, DMARC, BIMI, MTA-STS, and MX records. It detects email providers, counts SPF DNS lookups against the 10-lookup limit, grades overall email health A-F, and provides actionable fix guidance.

Commands

Workflow

Progress:

• Step 1: Run preflight check
• Step 2: Determine command from user request
• Step 3: Execute command via helper script
• Step 4: Present results with actionable guidance
• Step 5: Offer follow-up actions

Step 1: Preflight

Run the helper script to check environment readiness:

bash {SKILL_DIR}/scripts/email-dns-health.sh preflight

Output is JSON. If ready is true, proceed. If false, follow the hint field.

Step 2: Determine Command

Map the user’s request to a command:

Step 3: Execute Command

Run the appropriate command:

bash {SKILL_DIR}/scripts/email-dns-health.sh <command> <args...>

All commands output JSON to stdout. Parse the JSON response.

Step 4: Present Results

Format the JSON output into a human-readable report:

For audit: Present each record type (SPF, DKIM, DMARC, BIMI, MTA-STS, MX) with status indicators, the overall grade, and specific recommendations.

For check-spf: Show the SPF record, DNS lookup count (with breakdown), and warnings if approaching the 10-lookup limit.

For check-dkim: Show key details (algorithm, key length, flags) and security assessment.

For check-dmarc: Show the DMARC policy, reporting addresses, and deployment stage assessment.

For detect-provider: Show detected provider(s) with confidence level.

For setup-guide: Read {SKILL_DIR}/references/provider-configs.md and present the step-by-step guide for the requested provider.

For fix: This is an interactive workflow. Read the audit results, identify issues, and guide the user through fixes. If the user has a Cloudflare API token (in $CLOUDFLARE_API_TOKEN or ~/.claude/email-dns-health/.env), offer to apply DNS changes automatically via the Cloudflare API. Otherwise, provide the exact DNS records to add/modify manually.

Step 5: Follow-up

After presenting results, offer relevant next steps:

• If issues found: suggest fix command
• If SPF lookups high: suggest provider-specific optimizations (read references/best-practices.md)
• If no DMARC: suggest progressive deployment plan
• If DMARC at none: suggest advancing to quarantine
• If non-sending domain detected: suggest null record setup

Degradation

Completion Report

After audit or fix commands, present:

[Email DNS Health] Audit Complete

Domain: <domain>
Grade: <A-F>

Records:
  SPF:    <status> (<lookup_count>/10 lookups)
  DKIM:   <status> (<key_length>-bit <algorithm>)
  DMARC:  <status> (policy: <policy>)
  BIMI:   <status>
  MTA-STS: <status>
  MX:     <status> (provider: <provider>)

Issues: <count>
Recommendations:
  1. <recommendation>
  2. <recommendation>

Troubleshooting

References

For detailed provider DNS configurations, read {SKILL_DIR}/references/provider-configs.md. For SPF/DKIM/DMARC best practices, read {SKILL_DIR}/references/best-practices.md. For common issues and troubleshooting, read {SKILL_DIR}/references/troubleshooting.md.