Check a domain's SPF, DKIM, DMARC and MX from live DNS, the Gmail/Yahoo rules, and fix records.
Scored across 2 tools
Both tools check SPF/DMARC/DKIM via DNS, and their trigger examples overlap heavily (e.g. 'is my SPF right?' or 'I added SendGrid, did I break SPF?'). The record-level versus domain-level distinction is described, but the boundary is not clean enough to prevent misselection.
Both names follow the same stamp_check_<object> snake_case pattern with clear object nouns (dns_record, email_domain). There are no mixed conventions or vague verbs.
Only two tools exist; while each covers a real use case (single-record validation vs full domain audit), the set feels thin for an email-DNS diagnostics server. The rubric treats 1-2 tools as borderline.
Core email-authentication DNS coverage is strong: SPF, DMARC, DKIM, MX, provider sender requirements, and copy-ready fix records. Missing advanced DNS hygiene checks such as MTA-STS, TLS-RPT, BIMI, or DNSSEC are minor gaps for the stated purpose.
Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks "is this right?". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | Optional: the domain the record is for, so SPF a and mx terms can be checked. | |
| record | Yes | The TXT record value, e.g. "v=spf1 include:_spf.google.com ~all" or "v=DMARC1; p=none; rua=mailto:dmarc@mycompany.com". Quoted chunks ("..." "...") are joined. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive), so the description correctly spends its space on behavior instead: it performs live DNS lookups, follows every include and redirect, counts them against the 10-lookup limit, and reports void lookups and loops, plus what is returned (valid true/false, errors, warnings, publish location). That is valuable context an agent could not get from the annotations. It does not discuss latency or failure behavior when DNS is unreachable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded: the usage trigger comes first, then the per-record-type capabilities, then the return shape. Each sentence is informative, though the enumeration of DMARC tags (p, sp, pct, rua/ruf, adkim/aspf, fo) is slightly listy. Overall the density is justified for a validating tool with three distinct validation modes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of describing returns, and it does: valid true/false, errors, warnings, and where to publish. It also explains the three validation modes, the live-DNS lookup behavior, and the one non-obvious parameter. Nothing an agent needs in order to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, giving a baseline of 3. The description restates the domain parameter's purpose, adding only the nuance that it lets a/mx terms without a value be resolved; that is a small increment over the schema's own wording. It adds nothing about the record parameter beyond what the schema example already shows.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it checks SPF, DMARC and DKIM TXT records, auto-detects the type, and validates them per RFC 7208/7489. This distinguishes it from the sibling stamp_check_email_domain implicitly, because this tool's input is a single record rather than a domain. However, the sibling is never named, so the agent has to infer that split from the parameter shape.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear trigger conditions: when you or the user are about to publish or edit a record, after adding a sending service, or when a pasted record prompts 'is this right?'. That is concrete and actionable. It does not name when-not to use it or point to stamp_check_email_domain as the alternative for whole-domain checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. "why are my emails going to spam?", "is my SPF/DKIM/DMARC right?", "do I meet Gmail and Yahoo's sender requirements?" or "I added SendGrid, did I break SPF?". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). Use the real result instead of guessing from memory; DNS cannot list DKIM selectors, so if none is found ask for the provider's selector (the s= value in a DKIM-Signature header) and check again. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS.
| Name | Required | Description | Default |
|---|---|---|---|
| fresh | No | true to skip the 5-minute cache, e.g. right after a DNS change. | |
| domain | Yes | The sending domain, e.g. mycompany.com. An email address (you@mycompany.com) or a URL also works. | |
| dkim_selectors | No | Extra DKIM selectors to try besides the common ones, e.g. ["mxvault"]. Find it as s= in a DKIM-Signature header or in the provider's setup page. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/idempotent/non-destructive, yet the description still adds substantive behavior: reads are public DNS over DNS-over-HTTPS, results are cached 5 minutes with a fresh override, and DNS cannot enumerate DKIM selectors so the caller must supply the s= value. Those are exactly the operational facts an agent needs and none are in the annotation block.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is front-loaded with the usage trigger and every clause carries information, including the example utterances. It is a single dense run-on block that would read faster as short bullets, but there is no filler sentence to cut.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema available, the description carries the return contract itself: grade A-F, verdict, per-check pass/warn/fail/info, Gmail/Yahoo/Outlook.com rule compliance, and copy-ready fix records. It also covers accepted input forms (domain, email, URL) and the cache/refresh story, so nothing essential is missing for a read-only diagnostic.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameters are already documented and a 3 would be defensible. The description goes further by explaining the practical consequence of dkim_selectors (selectors cannot be discovered via DNS, so ask for the provider's s= value and re-check) and by tying fresh=true to the post-DNS-change moment.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact verb and resource set: it checks SPF (include following, RFC 7208 lookup counting), DMARC (RFC 7489, alignment, pct, inherited policy), DKIM (17 common selectors, key size) and MX (provider, null MX) from live DNS. That enumeration distinguishes it clearly from the generic sibling stamp_check_dns_record without needing to name it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Trigger conditions are unusually explicit: 'why are my emails going to spam', 'is my SPF/DKIM/DMARC right', pre-launch checks for newsletters, cold outreach, transactional email and new sending services, plus 'use the real result instead of guessing from memory'. It lacks an explicit when-not case or a named alternative tool, which keeps it short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
stamp_check_dns_recordstamp_check_email_domainScan and fix a domain's email deliverability (SPF, DKIM, DMARC, MTA-STS, BIMI, DNS blocklists).
Check a domain's email authentication: SPF, DKIM, DMARC, BIMI, MX, MTA-STS, TLS-RPT. Score + fixes.
Checks any domain's DMARC, SPF, MX and DKIM setup, scores it 0-100, and ranks the fixes.
Check a domain's email DNS, whether Gmail and Outlook accept its mail, and its registration.
Add one secure layer between your agents and this server.
