AstraVerify Domain Trust Check

Check email security (MX, SPF, DKIM, DMARC)

check_email_security

Read-onlyIdempotent

Check whether anyone can send email as this domain, and whether its own mail reaches the inbox. Use when the person asks about email security, spoofing or phishing risk, SPF, DKIM or DMARC setup, or why their mail goes to spam. Input: a bare domain like example.com - no scheme, no path. Given a URL or an email address, extract the domain and say what you extracted. Subdomains score in their own right: mail from the apex is not evidence about mail.example.com. Returns an Email Security score 0-100 broken into MX (25), SPF (25), DKIM (20) and DMARC (30), the status of each published record, the mail provider identified from MX, and the exact DNS record to publish for every finding. DNS-only, so it answers in about a second; cached 15 minutes, and refresh is for when DNS has just changed. One caveat to pass on rather than hide: DKIM selectors cannot be enumerated from DNS. They are found by probing the selectors known for the mail provider plus a list of a few hundred common names. A provider that issues random selectors - Amazon SES and Postmark among them - can only be confirmed from a live email, so report DKIM as not found by probing, never as proof the domain does not sign.

Input Schema

Name	Required	Description	Default
`domain`	Yes	The domain to check, as the person gave it (no scheme, no path). Reserved names such as example.com are refused.
`refresh`	No	Force a fresh scan instead of the cached result (rate limited)

Output Schema

Name	Required	Description
`raw`	No	What the components add up to, before the cap
`grade`	Yes	A+ to F
`score`	Yes	Out of 100, exactly as astraverify.com shows it
`capped`	No
`domain`	Yes
`null_mx`	No	The domain declares that it sends and receives no mail
`records`	No	DNS records found, keyed mx, spf, dkim, dmarc
`provider`	No	Mail provider detected from MX; null when not recognised
`held_back`	No	Points the cap holds back while a fix is open (89 cap) or a critical one is (69). Not taken from any component: sum(components.points) - held_back = score
`components`	No
`open_fixes`	No	Findings above info level
`report_url`	No	The report page for this domain on astraverify.com
`request_id`	No	req_... for this call. Quote it when reporting a problem with the result.
`recommendations`	No
`cache_age_seconds`	No	Age of the result; 0 means it was scanned just now

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedSep 27, 2026

addedOutput schema / properties / request_id

Added value: +{
+  "description": "req_... for this call. Quote it when reporting a problem with the result.",
+  "type": "string"
+}

Changed2 schema fields changedSep 27, 2026

changedOutput schema / properties / provider / description

Previous value: -"Mail provider detected from MX"New value: +"Mail provider detected from MX; null when not recognised"

changedOutput schema / properties / provider / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

Changed2 schema fields changedSep 27, 2026

addedOutput schema / properties / held_back

Added value: +{
+  "description": "Points the cap holds back while a fix is open (89 cap) or a critical one is (69). Not taken from any component: sum(components.points) - held_back = score",
+  "type": "integer"
+}

changedOutput schema / properties / raw / description

Previous value: -"Before the cap rules that hold the headline back while a fix is open"New value: +"What the components add up to, before the cap"

Changed9 schema fields changedSep 26, 2026
- changedOutput schema / properties / recommendations / items / properties / fix / description
```
Previous value: -"The exact change to publish: a DNS record (name, type, value) or a file or tag (kind, label, value, where)"New value: +"The exact change to publish: a DNS record (name, type, value) or a file or tag (kind, label, value, where). Null when there is nothing to publish, for example \"turn on DKIM in your provider\"."
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / kind / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / label / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / name / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / note / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / type / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / value / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / where / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```

Changed1 schema field changedSep 23, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "cache_age_seconds": {
+      "description": "Age of the result; 0 means it was scanned just now",
+      "type": "integer"
+    },
+    "capped": {
+      "type": "boolean"
+    },
+    "components": {
+      "items": {
+        "description": "One scored area of the domain",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "key": {
+            "type": "string"
+          },
+          "max": {
+            "type": "integer"
+          },
+          "name": {
+            "type": "string"
+          },
+          "points": {
+            "type": "integer"
+          },
+          "summary": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "key",
+          "name",
+          "points",
+          "max"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "domain": {
+      "type": "string"
+    },
+    "grade": {
+      "description": "A+ to F",
+      "type": "string"
+    },
+    "null_mx": {
+      "description": "The domain declares that it sends and receives no mail",
+      "type": "boolean"
+    },
+    "open_fixes": {
+      "description": "Findings above info level",
+      "type": "integer"
+    },
+    "provider": {
+      "description": "Mail provider detected from MX",
+      "type": "string"
+    },
+    "raw": {
+      "description": "Before the cap rules that hold the headline back while a fix is open",
+      "type": "integer"
+    },
+    "recommendations": {
+      "items": {
+        "properties": {
+          "component": {
+            "type": "string"
+          },
+          "fix": {
+            "description": "The exact change to publish: a DNS record (name, type, value) or a file or tag (kind, label, value, where)",
+            "properties": {
+              "kind": {
+                "type": "string"
+              },
+              "label": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "note": {
+                "type": "string"
+              },
+              "type": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              },
+              "where": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "id": {
+            "type": "string"
+          },
+          "scan": {
+            "enum": [
+              "email",
+              "discoverability"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "enum": [
+              "critical",
+              "important",
+              "info"
+            ],
+            "type": "string"
+          },
+          "tags": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "title": {
+            "type": "string"
+          },
+          "why": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "severity",
+          "title"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "records": {
+      "additionalProperties": {
+        "items": {
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "description": "DNS records found, keyed mx, spf, dkim, dmarc",
+      "type": "object"
+    },
+    "report_url": {
+      "description": "The report page for this domain on astraverify.com",
+      "type": "string"
+    },
+    "score": {
+      "description": "Out of 100, exactly as astraverify.com shows it",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "domain",
+    "score",
+    "grade"
+  ],
+  "type": "object"
+}

First observedSep 21, 2026

TDQS

A4.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the safety profile is covered and the bar is lower. The description nonetheless adds real behavioral context the annotations cannot: DNS-only, roughly one-second latency, a 15-minute cache, and the important DKIM selector enumeration caveat that a random-selector provider like SES or Postmark can never be proven unsigned by probing. That disclosure is well beyond the structured fields, so it sits above a 3 in substance, but it discloses no auth needs or rate-limit specifics beyond a passing mention.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads purpose, then usage triggers, then input handling, then output shape, then the DKIM caveat, so a skimming agent still gets the essentials first. Every sentence carries information; the length is warranted by the caching and DKIM-probing caveats rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, yet the description sensibly previews the 0-100 score weighting and per-record status anyway. Combined with latency, caching, input extraction rules and the honesty caveat about DKIM false negatives for random-selector providers, an agent has everything needed to call this correctly and interpret the result without overclaiming.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3 and the schema already documents both parameters. The description adds meaning beyond it: the domain must be bare with no scheme or path, it must be extracted from a URL or address with the extraction reported back, subdomains are scored in their own right rather than inheriting the apex, and refresh is tied to a specific condition. That is substantive param-level guidance rather than restatement.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with unusual precision: checking whether anyone can send mail as the domain, and whether its own mail reaches the inbox. This is clearly distinct from siblings like check_discoverability, fetch_as_crawler, get_report and verify_fix, and an agent can route to it without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names explicit trigger conditions (email security, spoofing/phishing risk, SPF/DKIM/DMARC setup, mail going to spam) and gives input-handling rules for the non-bare forms (URL or email address must be reduced to a domain). It also states when to use refresh versus the cache ('refresh is for when DNS has just changed'), which is a genuine when/when-not distinction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All AstraVerify Domain Trust Check tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?