CredMail CLI

Run full domain health checks from your terminal — no account, no login, no browser needed.

npx credmail check <domain> runs the same SPF, DKIM, DMARC, MX, blacklist, reputation, BIMI, MTA-STS, TLS-RPT, WHOIS, and DNS-propagation checks as the free web tool at credmail.com/check, and prints a terminal-friendly report with an overall health score.

Install

The CLI is published to npm as credmail.

Run it directly without installing (requires Node.js 18+):

npx credmail check example.com

Or install globally:

npm install -g credmail
credmail check example.com

Usage

Usage: credmail check <domain>

Run a full domain health check.

Options:
  --help, -h       Show help
  --version, -v    Show version

Examples:
  credmail check credmail.com
  npx credmail check example.com

The CLI accepts a bare domain (example.com). URLs, www. prefixes, and paths are stripped automatically (https://www.example.com/blog is treated as example.com). No API key or account is required.

What's checked

Each check produces a PASS, WARN, or FAIL status:

| Check | What it verifies | | --- | --- | | SPF | Sender Policy Framework record exists, has an all mechanism, and policy strictness (-all / ~all) | | DKIM | A signing key is published at a common selector._domainkey record | | DMARC | DMARC policy record, enforcement policy (none / quarantine / reject), and aggregate report address (rua) | | MX records | Mail exchange records exist and their priorities | | BIMI | Brand Indicators for Message Identification record and HTTPS logo | | MTA-STS | MTA Strict Transport Security DNS record and policy file | | TLS-RPT | TLS reporting record and report URI | | Blacklists | 107 DNS-based blacklists (Spamhaus, SORBS, UCEPROTECT, SURBL, and more), with delisting URLs for any listing | | Reputation | Estimated sending reputation across Gmail, Outlook, and Yahoo | | WHOIS | Registrar, creation/expiration dates, and nameservers | | DNS propagation | Cross-resolver consistency for your records |

Example output

$ npx credmail check credmail.com

  Domain Health Report  —  credmail.com
  ────────────────────────────────────────────────────────────
  Running checks... done (15.5s)

  Overall Score  53/100  Poor
  ███████████░░░░░░░░░░

  ⚠  SPF  WARN
     Record Present: Yes
     All Mechanism: ~all
     Includes: _spf.porkbun.com
     → Your SPF uses a softfail (~all). Consider using -all instead for stronger protection against spoofing.

  ✓  DKIM  PASS
     Found: Yes
     Selector: resend

  ⚠  DMARC  WARN
     Present: Yes
     Policy: none
     → Your DMARC policy is set to 'none', which only monitors. Upgrade to 'quarantine' or 'reject' once you've verified your reports.

  ✓  MX Records  PASS
     Count: 2

     MX Records:
       10  fwd1.porkbun.com
       20  fwd2.porkbun.com

  ✗  BIMI  FAIL
     Present: No
     → No BIMI record found. Add BIMI to display your brand logo in supported email clients.

  ✗  MTA-STS  FAIL
     Dns Present: No
     → No MTA-STS DNS record found. Add MTA-STS to enforce TLS encryption for inbound email.

  ✗  TLS-RPT  FAIL
     Present: No
     → No TLS-RPT record found. Add TLS-RPT to receive daily reports about TLS connectivity issues on your domain.

  ✓  Blacklists  PASS  (0/107 listed)
     ✓ Clean on all 107 blacklists

  ✓  Reputation  77/100
     ✓ Gmail: Likely to reach inbox with proper authentication
     ✓ Outlook / Microsoft 365: Good deliverability expected
     ✓ Yahoo / AOL: Should pass Yahoo's authentication checks

  ────────────────────────────────────────────────────────────
  Checked at 2026-08-12T12:27:43.251Z

The score is stable under normal network conditions: a single failed measurement (DNS timeout, WHOIS unreachable) is reported as UNKNOWN and counts as a neutral value with a fixed denominator, so it doesn't shift the score unpredictably. If the entire DNS layer is unreachable, the CLI prints UNKNOWN instead of a misleading score. A broader DNS resolver outage that affects multiple checks at once may still shift the number somewhat — those checks correctly report as unknown rather than guessing.

Exit codes

| Code | Meaning | | --- | --- | | 0 | Check completed (regardless of score) | | 1 | Invalid domain, unknown command, or unexpected error |

What the CLI doesn't do

The CLI covers the free, public domain health check only. For the rest, use the full web app at credmail.com:

• Email verification — single and bulk address verification with deliverability scoring and list hygiene
• AI agents — Fix, Verification, Pre-Ship, and Warmup agents that analyze your reports and write step-by-step remediation plans
• Saved history & reports — account-based report history, saved reports, and trend tracking, plus public report sharing
• Record generators, SPF flattening, DMARC simulator, and header analyzer — the full tool suite in Tools

Development

npm install
npm run build     # builds dist/ via build.mjs + tsc
npm link          # optional: use the local build as `credmail`

The CLI shares its check logic with the web app (lib/domain-checker.ts, lib/whois.ts, lib/dns-propagation.ts), so results are identical to the website.

License

MIT