email-auth-checker

CLI tool to check SPF, DMARC and MX records for any domain — instantly see your email security score and what to fix.

npx @xdkoc/email-auth-checker google.com

Email Auth Report: google.com
──────────────────────────────────────────────────
✓  SPF     v=spf1 include:_spf.google.com ~all (soft)
✓  DMARC   v=DMARC1; p=reject; rua=mailto:... (p=reject)
✓  MX      5 record(s) — aspmx.l.google.com, ...
──────────────────────────────────────────────────
Score:  9/10   Grade: B

Recommendations:
  → Upgrade SPF from ~all (softfail) to -all (fail) for stricter enforcement

Why

Email authentication is critical for deliverability and security — but checking SPF, DMARC and MX manually means visiting multiple tools or digging through DNS records yourself. This CLI does it all in one command.

Install

# Run without installing
npx @xdkoc/email-auth-checker example.com

# Or install globally
npm install -g @xdkoc/email-auth-checker
email-auth-checker example.com

What it checks

SPF (Sender Policy Framework)

Verifies which mail servers are allowed to send email on behalf of your domain.

• Detects missing SPF records
• Flags +all (allows anyone to send — dangerous)
• Distinguishes ~all (softfail) from -all (strict fail)
• Warns about multiple SPF records (only one is allowed)

DMARC (Domain-based Message Authentication)

Tells receiving mail servers what to do with emails that fail SPF/DKIM.

• Detects missing DMARC records
• Reports policy: none (monitoring only) / quarantine / reject
• Flags partial enforcement (pct < 100)
• Recommends upgrading from p=none to p=reject

MX (Mail Exchange)

Checks that your domain can actually receive email.

• Detects missing MX records
• Lists all records sorted by priority
• Warns when only one MX record exists (no fallback)

Scoring

| Points | What it covers | |---|---| | 0–3 | SPF: present + policy strictness | | 0–4 | DMARC: present + policy level | | 0–3 | MX: present + redundancy |

| Score | Grade | |---|---| | 9–10 | A | | 7–8 | B | | 5–6 | C | | 3–4 | D | | 0–2 | F |

Zero dependencies

Uses Node.js built-in dns/promises — no third-party packages at runtime.

License

MIT