Email authentication

Audit SPF, DKIM, DMARC, and related DNS for sending domains with the email-authentication Agent Skill — a read-only check for missing or misconfigured records.

When to use: “Check SPF/DKIM/DMARC”, mail in spam, or you’re standing up a new sending domain.

What it does

Email authentication runs read-only DNS lookups for SPF, DKIM, DMARC (and related records like MX/PTR when relevant). It scores what’s published vs missing. It does not change DNS or ESP settings.

Try saying this

Mail is landing in spam or you just bought a sending domain

You

Check SPF, DKIM, and DMARC for send.acme-outbound.com.

AgentSkill · email-authentication

I’ll look up DNS for SPF/DKIM/DMARC (and related records), score each factor, and tell you what’s missing — read-only; I won’t change DNS.

What you’ll get

A healthy / needs work / unverified verdict with a gauge per domain (SPF, DKIM, DMARC, MX, alignment)
One card per domain with a line per record, plus PTR / BIMI / MTA-STS advisories where they apply
A Next list with the exact DNS record to publish when a fix is a record
No silent “all good” when a lookup failed or there are no sample headers — unverified stays unverified

Sample output

One healthy brand domain; one cold domain with a PermError SPF and no DMARC. Illustrative data — more states in examples.md.

## Authentication needs work

```text
Overall                ████████████▒▒░░░░░░  6/10 · needs work · 1 unverified

acme.example.com       ████████████████████  ✓ 5/5
tryacme.example.com    ████▒▒▒▒░░░░░░░░░░░░  ✗ 1/5 · 1 unverified
```

### acme.example.com
`reply-receiving · brand · Microsoft 365`

- · SPF — 1 record · 9 lookups · -all (close to the 10-lookup limit)
- ✓ DKIM — selector1, selector2 · 2048-bit RSA
- ✓ DMARC — p=quarantine · rua present
- ✓ MX — acme-example-com.mail.protection.outlook.com
- ✓ Alignment — DKIM d=acme.example.com aligned with From
- · PTR — N/A, hosted mailbox
- · MTA-STS — missing (expected on a brand domain)

### tryacme.example.com
`reply-receiving · cold outbound · Google Workspace`

- ✗ SPF — 2 v=spf1 records (PermError)
- · DKIM — not found at probed selectors (google, selector1, selector2, s1, s2, k1, dkim); selector may be custom
- ✗ DMARC — missing
- ✓ MX — aspmx.l.google.com + 4 backups
- ✗ Alignment — SPF PermError and no DKIM signature on the sample
- · PTR — N/A, hosted mailbox

### Next
1. Merge the two SPF records on tryacme.example.com into one
   `v=spf1 include:_spf.google.com ~all`
2. Publish a DMARC record on tryacme.example.com
   `_dmarc.tryacme.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@acme.example.com"`
3. Turn on DKIM signing in Google Workspace for tryacme.example.com and tell me the selector
4. Trim SPF lookups on acme.example.com before adding another sender

Get started

No OutboundSync API key. Install:

npx skills add outboundsync/skills --skill email-authentication -g

More setup: Install skills. Lookup methods: skills/email-authentication/.