mailward

Audits a domain's email authentication and deliverability. It queries live DNS and checks MX, SPF, DKIM, DMARC, MTA-STS and BIMI, then scores the domain from 0 to 100 with a letter grade and a list of concrete fixes. No dependencies, no AI. Because it reads real DNS records, the result is the same every time you run it.

This is the kind of check every business should run on its sending domains. Bad SPF or a p=none DMARC policy is why legitimate mail lands in spam and why spoofing succeeds.

Install

npm install -g @bobfromarcher/mailward
# or once:
npx @bobfromarcher/mailward example.com

Usage

mailward <domain> [options]

| Option | Description | | --- | --- | | --selector <name> | Extra DKIM selector to probe (repeatable) | | --timeout <ms> | DNS query timeout (default 5000) | | --json | Output JSON | | --quiet, -q | No output, exit code only | | -h, --help | Show help | | -v, --version | Show version |

The exit code is 0 for grade A or B and 1 for C or worse, so you can gate a deploy or a monitoring job on it.

What it checks

• MX: the domain can receive mail.
• SPF: a single valid v=spf1 record, the all qualifier (-all is strict, +all is dangerous), and the recursive DNS lookup count. More than 10 lookups is a PermError that silently breaks SPF, and mailward follows include and redirect to count them properly.
• DKIM: probes common selectors (Google, Microsoft 365, Mailchimp, Zoho and more). Add your own with --selector.
• DMARC: presence, policy strength (none, quarantine, reject), and whether aggregate reporting is set up.
• MTA-STS and BIMI: reported as bonuses.

As a library

const { audit } = require('@bobfromarcher/mailward');

const report = await audit('example.com');
console.log(report.grade, report.score);
for (const check of report.checks) {
  if (check.status !== 'pass') console.log(check.title, check.fix);
}

audit(domain, opts) accepts an injected resolver (with txt and mx methods), which makes it easy to test without touching the network.

Examples

mailward stripe.com
mailward example.com --selector mycustom
mailward example.com --json | jq '.grade'

Notes

mailward reports on DNS-level authentication. It does not send mail or check the reputation of a specific sending IP, which depends on your traffic. Pair it with your provider's reports and with DMARC aggregate data for a full picture.

Development

git clone https://github.com/bobfromarcher/mailward
cd mailward
node test/test.js

CI runs the suite on Node 18, 20 and 22 across Linux, macOS and Windows.

License

MIT, bobfromarcher.