AI agents (MCP)

List the team's monitored domains with score, grade, DMARC policy and verification state.

Run a live email sender-policy check (SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, reverse DNS, DNS blacklists) for any domain and return score, grade, records and prioritised recommendations with exact DNS fixes.

Live DKIM lookup for any domain. With selectors: checks exactly those. Without: scans the default selectors of every major provider. Per selector: key type, bits and SHA-256 fingerprint, CNAME delegation and the owning provider (Microsoft 365, SendGrid, …), testing/revoked flags, every RFC 6376/8301/8463 defect, and a corrected record when the fix is mechanical. Selectors of Amazon SES, Postmark and HubSpot are random or dated and cannot be discovered; ask for them or use list_dkim_selectors on a monitored domain.

For a domain the team monitors: every DKIM selector we know (discovered, added, or seen signing in DMARC reports) with status, health, provider, key type/bits/fingerprint, key age and age bucket, rotation count and key history size, plus which selectors and signing domains (d=) actually sign mail and how often they pass, and findings that need history (keys due for rotation, selectors failing in reports, unpublished signing selectors, third-party signers that do not align). Answers "which DKIM keys are old?", "is SendGrid signing with our domain?", "why does DKIM fail for X?".

Cryptographically re-verify every DKIM-Signature in a raw RFC 5322 message (all headers, a blank line, then the body exactly as received): canonicalization, body hash (bh=), RSA or Ed25519 signature (b=) against the key published in DNS, expiry, and alignment of d= with the From domain. Explains failures (body modified, header changed, key missing/revoked, SHA-1 retired). Does not trust Authentication-Results headers. Up to 1 MB.

Add a DKIM selector to a monitored domain so every check watches it (needed for selectors that cannot be discovered, e.g. Amazon SES tokens or dated Postmark keys). Looks it up immediately and returns its status. Requires a token with write access (or a team owner/admin). Adding an existing selector changes nothing.

What changed between consecutive checks of a monitored domain, newest first: records added/removed/changed (SPF, DMARC, BIMI, MTA-STS, TLS-RPT, MX), DMARC policy changes, DKIM selectors added/removed, DKIM key rotations and revocations, blacklist listings, score moves — each with severity and old/new values. Answers "what changed on example.com this week?".

The team's alerts, newest first: DNS drift (SPF/DKIM/DMARC/MX changes), score drops, blacklist listings, DMARC failure spikes, expiring registrations or certificates, and DKIM findings (keys due for rotation, failing or unpublished selectors). Filter by domain and open (unresolved) only.

For a monitored domain, summarise DMARC aggregate-report data (alignment rate, top sources, failing known senders) and say whether it is safe to move to p=quarantine / p=reject, with the exact record to publish.

Introduction/KYC-style check of a single email address: syntax, MX, provider, free/disposable/role flags, the domain's SPF/DKIM/DMARC strength, and a risk score with reasons.