email-deliverability-mcp

An MCP server that lets Claude (or any MCP client) diagnose email deliverability:

• check_domain: SPF (including the 10-DNS-lookup limit), DMARC policy and reporting, DKIM keys on common selectors, and MX records, with a ranked list of problems and the fix for each. It also names the email services a domain uses (Google Workspace, SendGrid, Amazon SES and others).
• check_sending_ip: reverse DNS (PTR) and whether it resolves back to the IP, plus listings on Spamhaus ZEN, Barracuda, SpamCop, PSBL, Mailspike and UCEPROTECT level 1.
• check_email_headers: paste a received message's headers and check them against Gmail's and Yahoo's sender requirements: SPF, DKIM, DMARC, From alignment, one-click unsubscribe (and whether DKIM covers it), TLS, reverse DNS and Message-ID.

Every tool is read-only: it reads public DNS or the text you give it. Nothing is sent anywhere else, and no account or API key is needed.

Use it without installing

A hosted copy runs at:

https://api.ownmailserver.com/tools/mcp

Add it to Claude as a custom connector (Settings → Connectors → Add custom connector), or in Claude Code:

claude mcp add --transport http email-deliverability https://api.ownmailserver.com/tools/mcp

It's free and needs no account. It's rate-limited per IP, uses public DNS resolvers (so Spamhaus results show as "refused"; see below), and stores nothing. For heavy use or a real Spamhaus answer, run your own copy.

Install

Requires Node.js 20 or later.

Claude Code

claude mcp add email-deliverability -- npx -y email-deliverability-mcp

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "email-deliverability": {
      "command": "npx",
      "args": ["-y", "email-deliverability-mcp"]
    }
  }
}

Docker

docker build -t email-deliverability-mcp .
docker run -i --rm email-deliverability-mcp

Things to ask

• "Check example.com's email setup and tell me what to fix first."
• "Why might our emails from shop.example be going to spam?" (then paste a message's headers)
• "Is 192.0.2.25 on any blocklists? Does its reverse DNS look right?"
• "Does this email meet Gmail's bulk sender rules?"
• "Our SPF record fails sometimes. Are we over the lookup limit?"

Configuration

Why BLOCKLIST_DNS matters

Spamhaus refuses queries that arrive through big public resolvers (8.8.8.8, 1.1.1.1 and the like) and answers 127.255.255.x instead. Many blocklist checkers misread that as "listed". This server reports it as refused, meaning unknown, and says so. To get a real Spamhaus answer, point BLOCKLIST_DNS at a recursive resolver of your own, such as unbound on 127.0.0.1.

How the checks work

• SPF lookups follow include: and redirect= recursively and count every include, a, mx, ptr, exists and redirect term, as RFC 7208 does. More than 10 is a permanent error at most receivers.
• DKIM keys sit under selectors that only the sender knows, so the server probes about 30 common ones. Pass your own with dkim_selectors (find it in the s= value of a message's DKIM-Signature header). Domains that answer every name (wildcard DNS) are detected and not reported as having keys.
• Header checks read the topmost Authentication-Results header, which is what the recipient's mailbox provider concluded, and the newest Received hop that names the sending server.
• Alignment compares organizational domains with a simple rule (the last two labels, or three for names like example.co.uk). It's not a full Public Suffix List lookup, so unusual suffixes may be misjudged.

... View full README on GitHub