emailsecops
Menu
MCP server · Claude · ChatGPT · Cursor

Hand email security to your agent. Keep the keys.

EmailSecOps checks SPF, DKIM, DMARC, MTA-STS, BIMI and blacklists every day, then gives your agent ten tools to audit, explain and draft the fix. It reads your DNS and never writes it.

Connect your agent → Run a free check
Example: an AI agent answering with EmailSecOps tools
claude · connected to emailsecops scope: read-only
you ›Is acme-logistics.example ready for p=reject?
emailsecops.dmarc_advice(domain="acme-logistics.example", days=30)

Not yet. 97.4% of 41,208 messages align, but two senders still fail:

Zendesk1,022 msgsDKIM signs as zendesk.com
203.0.113.1461 msgslegacy relay, not in SPF

Fix Zendesk's DKIM first, then step up to quarantine at 25%:

v=DMARC1; p=quarantine; pct=25; rua=mailto:k3f9x2v8@rua.emailsecops.com

I can't edit DNS. Paste this at your provider when you're ready.

you ›What changed in our DNS since Monday?
TOOL TRACE · TODAY
04:00check_domain ×12ok
04:00list_domain_changes1 drift
09:41dmarc_adviceok
09:41list_dkim_selectors1 old key
09:42list_alertsok
CONNECT
$ claude mcp add --transport http emailsecops https://emailsecops.com/mcp

No agent yet? Check any domain.

Free · no account · results in seconds

Or one record: spf · dkim · dmarc · mx · mta-sts · bimi · blacklist · all 17 tools →

Drift gets caught overnight, not by your customers.

→ email · Slack · signed webhook
TUE 03:12 HIGH acme-logistics.example DKIM selector s1 removed
TUE 04:00 HIGH northwind.example DMARC weakened p=reject → p=none
WED 04:00 WARN acme-logistics.example SPF at 9 of 10 DNS lookups
THU 04:00 OK 12 domains No changes
01 / Drift → alert

Every record, snapshotted and diffed

A removed DKIM key, a weaker DMARC policy or a new blacklist listing reaches you the morning it happens.

02 / Reports → decision

DMARC reports that end in a verdict

Sources, alignment and volume, parsed. The advisor tells you when quarantine and reject are safe, and hands you the record.

03 / One → hundreds

Built for portfolios

Clients, seats, CSV import, share links and branded reports. Domains are sorted worst-first.

One engine. Your team, your backend and your agent all read the same records.

Dashboard Record ledger, change history, DMARC sources, enforcement advisor.
REST API 
GET /api/v1/intel/domain
  ?domain=acme.example
Authorization: Bearer eso_live_…
Domains, checks, DMARC, DKIM, alerts and webhooks. OpenAPI 3.1 reference. MCP for agents list_dkim_selectorsdmarc_advicelist_domain_changeslist_alertscheck_domain +5 more One OAuth sign-in. A public server runs the checks with no account.
Trust model

Read-only on your DNS. By design, not by policy.

Nothing in EmailSecOps holds DNS credentials or sends mail as your domain. Every fix is a value you paste yourself, so neither we nor your agent can break your mail flow.

# emailsecops.scope
dns.readallow
mta_sts.fetchallowhttps only
dmarc.reportsallowyou route rua to us
dns.writedenyalways
mail.send_as_youdenyalways

Who runs it

MSPs → Every client domain in one list. Branded reports prove the value. SaaS senders → Many providers, one domain. Stay under the SPF lookup limit and keep DMARC enforced. Agencies → Onboard clients with exact records. Share a read-only page they understand. Compliance → Meet bulk-sender rules, keep meeting them, and have the evidence when someone asks.

Start with one domain.
Free, for good.

Start monitoring → 1 TXT record · first check within a minute