# deliverability-doctor [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Integrity-Os/deliverability-doctor  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/deliverability-doctor

## Description
Check if a domain can be email-spoofed: SPF, DMARC, DKIM, MX graded from public DNS. Authless.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What deliverability-doctor does

The deliverability-doctor MCP server evaluates whether a domain has email-authentication controls that reduce spoofing risk. It reads publicly available DNS data and produces a graded report covering SPF, DMARC, MX, and DKIM. Findings include concrete fixes, so the result can support an initial configuration review rather than only listing raw records.

The service accepts a bare domain, a URL, or an email address as input. It does not require credentials and does not store submitted domains. A second tool compares the security posture of two to five domains in a table, which is useful for reviewing several brands, environments, or customer domains at once.

## How the deliverability-doctor MCP server works

The deliverability-doctor MCP server runs as a remote, streamable HTTP MCP service. Each request gets a fresh transport and no session is retained, allowing the service to remain stateless. DNS lookups use DNS-over-HTTPS through Cloudflare, with Google as a fallback, so the implementation does not depend on Node’s `dns` module and can run locally or on Cloudflare Workers.

SPF processing accounts for multiple SPF records, which are treated according to the RFC 7208 multiple-record permerror condition. It also handles SPF `redirect=` behavior. DMARC results include the policy, reporting address, and percentage setting. DKIM checks cover seven common selectors rather than discovering arbitrary selectors.

A nonexistent domain is rejected as NXDOMAIN instead of receiving a failing grade. This separates “the domain does not exist” from “the domain exists but has weak or missing email protections.” The implementation was checked against domains with redirect-based SPF, strict DMARC, missing controls, and NXDOMAIN responses.

## Setup and configuration

Run the local service with Node after installing its dependencies:

```bash
npm install
node server.js
```

The MCP endpoint is available at `http://localhost:8787/mcp`. For a temporary public endpoint, expose the local port with Cloudflare Tunnel:

```bash
cloudflared tunnel --url http://localhost:8787
```

Use the resulting `https://<random>.trycloudflare.com/mcp` URL as the MCP connector address. The tunnel URL lasts only while the process and local machine remain available. Durable Cloudflare Workers hosting was marked as pending in the supplied project status.

No authentication or environment variables are required by the documented run procedure. The service only needs a domain-like input and access to public DNS resolution.

## Tools and capabilities

- `check_email_security(domain)` accepts a domain, URL, or email address and returns an A–F assessment.
- Checks include SPF, DMARC, MX, and DKIM at seven common selectors.
- SPF analysis includes multiple-record errors and `redirect=` handling.
- DMARC output includes policy, `rua`, and `pct` values.
- Findings include suggested fixes; the report adds the documented paid-audit line only when problems are found.
- `compare_email_security(domains[2..5])` compares two to five domains in a table.

## Limitations and notes

The deliverability-doctor MCP server is limited to information available through public DNS. It does not inspect private mail systems, authenticate to providers, or retain submitted data. DKIM coverage is limited to seven common selectors, so a key published under another selector may not be identified by the check.

The project status reports local end-to-end MCP verification and public verification through a quick tunnel. A durable hosted URL was still pending at the time of that status, and directory submissions requiring a permanent endpoint had not yet been completed. The service is therefore best suited to local use or a temporary public demonstration unless durable hosting is configured separately.

_Full upstream README: https://allmcps.com/mcp/deliverability-doctor/readme_