Give your AI agent email-authentication tools
plaindmarc-mcp is a read-only Model Context Protocol server: seven tools for checking and generating DMARC, SPF, DKIM, BIMI and MTA-STS, plus reading DMARC aggregate reports. No API key, no account, read-only. It never writes DNS, never signs in, and collects nothing about you.
Install
Claude Code:
claude mcp add plaindmarc -- npx -y plaindmarc-mcpClaude Desktop, or any MCP client — add to your MCP config:
{
"mcpServers": {
"plaindmarc": {
"command": "npx",
"args": ["-y", "plaindmarc-mcp"]
}
}
}Then ask, for example, “Is example.com protected against email spoofing, and is anyone watching its DMARC reports?”
Seven read-only tools
DMARC verdict + letter grade (A–F), the policy, and whether reports are actually being received (rua) — a domain can be protected yet unmonitored.
SPF record, the 10-DNS-lookup count, and a permissive ending (+all/?all) vs a protective one (~all/-all).
A DKIM selector's key (follows CNAME chains): found, missing, revoked, or weak. Needs the selector.
BIMI eligibility — logo, VMC, and DMARC at enforcement. Eligibility, not a guarantee a mailbox shows the logo.
MTA-STS + TLS-RPT DNS setup. States plainly that the HTTPS policy file itself isn't fetched remotely.
Builds a valid DMARC record and warns against jumping straight to p=reject/quarantine. Never writes DNS.
Explains a raw DMARC aggregate (rua) XML report in plain English — verdict, pass rate, per-source breakdown, fixes.
Honest by design: a DNS failure or missing record returns an explicit unknown state with the reason — never a guessed verdict, and a FAIL is never softened. The same checks run in your browser as the free DMARC checker and the other free tools.
Want the reports, not just the checks?
The MCP tools read your DNS on demand. PlainDMARC also monitors it continuously — a weekly plain-English verdict per domain, with daily alerts. The Free plan needs no card.
Start free monitoring