AstraVerify Domain Trust Check

Check email security (MX, SPF, DKIM, DMARC)

check_email_security

Read-onlyIdempotent

Check whether anyone can send email as this domain, and whether its own mail reaches the inbox. Use when the person asks about email security, spoofing or phishing risk, SPF, DKIM or DMARC setup, or why their mail goes to spam. Input: a bare domain like example.com - no scheme, no path. Given a URL or an email address, extract the domain and say what you extracted. Subdomains score in their own right: mail from the apex is not evidence about mail.example.com. Returns an Email Security score 0-100 broken into MX (25), SPF (25), DKIM (20) and DMARC (30), the status of each published record, the mail provider identified from MX, and the exact DNS record to publish for every finding. DNS-only, so it answers in about a second; cached 15 minutes, and refresh is for when DNS has just changed. One caveat to pass on rather than hide: DKIM selectors cannot be enumerated from DNS. They are found by probing the selectors known for the mail provider plus a list of a few hundred common names. A provider that issues random selectors - Amazon SES and Postmark among them - can only be confirmed from a live email, so report DKIM as not found by probing, never as proof the domain does not sign.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`domain`	Yes	The domain to check, as the person gave it (no scheme, no path). Reserved names such as example.com are refused.
`refresh`	No	Force a fresh scan instead of the cached result (rate limited)

Output Schema

TableJSON Schema

Name	Required	Description
`raw`	No	What the components add up to, before the cap
`grade`	Yes	A+ to F
`score`	Yes	Out of 100, exactly as astraverify.com shows it
`capped`	No
`domain`	Yes
`null_mx`	No	The domain declares that it sends and receives no mail
`records`	No	DNS records found, keyed mx, spf, dkim, dmarc
`provider`	No	Mail provider detected from MX; null when not recognised
`held_back`	No	Points the cap holds back while a fix is open (89 cap) or a critical one is (69). Not taken from any component: sum(components.points) - held_back = score
`components`	No
`open_fixes`	No	Findings above info level
`report_url`	No	The report page for this domain on astraverify.com
`request_id`	No	req_... for this call. Quote it when reporting a problem with the result.
`recommendations`	No
`cache_age_seconds`	No	Age of the result; 0 means it was scanned just now

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedSep 27, 2026

addedOutput schema / properties / request_id

Added value: +{
+  "description": "req_... for this call. Quote it when reporting a problem with the result.",
+  "type": "string"
+}

Changed2 schema fields changedSep 27, 2026

changedOutput schema / properties / provider / description

Previous value: -"Mail provider detected from MX"New value: +"Mail provider detected from MX; null when not recognised"

changedOutput schema / properties / provider / type

Previous value: -"string"New value: +[
+  "string",
+  "null"
+]

Changed2 schema fields changedSep 27, 2026

addedOutput schema / properties / held_back

Added value: +{
+  "description": "Points the cap holds back while a fix is open (89 cap) or a critical one is (69). Not taken from any component: sum(components.points) - held_back = score",
+  "type": "integer"
+}

changedOutput schema / properties / raw / description

Previous value: -"Before the cap rules that hold the headline back while a fix is open"New value: +"What the components add up to, before the cap"

Changed9 schema fields changedSep 26, 2026
- changedOutput schema / properties / recommendations / items / properties / fix / description
```
Previous value: -"The exact change to publish: a DNS record (name, type, value) or a file or tag (kind, label, value, where)"New value: +"The exact change to publish: a DNS record (name, type, value) or a file or tag (kind, label, value, where). Null when there is nothing to publish, for example \"turn on DKIM in your provider\"."
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / kind / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / label / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / name / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / note / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / type / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / value / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / properties / where / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / recommendations / items / properties / fix / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```

Changed1 schema field changedSep 23, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "cache_age_seconds": {
+      "description": "Age of the result; 0 means it was scanned just now",
+      "type": "integer"
+    },
+    "capped": {
+      "type": "boolean"
+    },
+    "components": {
+      "items": {
+        "description": "One scored area of the domain",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "key": {
+            "type": "string"
+          },
+          "max": {
+            "type": "integer"
+          },
+          "name": {
+            "type": "string"
+          },
+          "points": {
+            "type": "integer"
+          },
+          "summary": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "key",
+          "name",
+          "points",
+          "max"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "domain": {
+      "type": "string"
+    },
+    "grade": {
+      "description": "A+ to F",
+      "type": "string"
+    },
+    "null_mx": {
+      "description": "The domain declares that it sends and receives no mail",
+      "type": "boolean"
+    },
+    "open_fixes": {
+      "description": "Findings above info level",
+      "type": "integer"
+    },
+    "provider": {
+      "description": "Mail provider detected from MX",
+      "type": "string"
+    },
+    "raw": {
+      "description": "Before the cap rules that hold the headline back while a fix is open",
+      "type": "integer"
+    },
+    "recommendations": {
+      "items": {
+        "properties": {
+          "component": {
+            "type": "string"
+          },
+          "fix": {
+            "description": "The exact change to publish: a DNS record (name, type, value) or a file or tag (kind, label, value, where)",
+            "properties": {
+              "kind": {
+                "type": "string"
+              },
+              "label": {
+                "type": "string"
+              },
+              "name": {
+                "type": "string"
+              },
+              "note": {
+                "type": "string"
+              },
+              "type": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              },
+              "where": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "id": {
+            "type": "string"
+          },
+          "scan": {
+            "enum": [
+              "email",
+              "discoverability"
+            ],
+            "type": "string"
+          },
+          "severity": {
+            "enum": [
+              "critical",
+              "important",
+              "info"
+            ],
+            "type": "string"
+          },
+          "tags": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "title": {
+            "type": "string"
+          },
+          "why": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "severity",
+          "title"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "records": {
+      "additionalProperties": {
+        "items": {
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "description": "DNS records found, keyed mx, spf, dkim, dmarc",
+      "type": "object"
+    },
+    "report_url": {
+      "description": "The report page for this domain on astraverify.com",
+      "type": "string"
+    },
+    "score": {
+      "description": "Out of 100, exactly as astraverify.com shows it",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "domain",
+    "score",
+    "grade"
+  ],
+  "type": "object"
+}

First observedSep 21, 2026

TDQS

Score is being calculated.

All AstraVerify Domain Trust Check tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?