dmarc-doctor

Diagnose SPF, DKIM, and DMARC for any domain — in one command. Zero runtime deps.

When your cold email lands in spam, the first thing to check is your domain authentication. dmarc-doctor resolves the right DNS records, parses them, flags common misconfigurations, and tells you how to fix each one.

npx dmarc-doctor example.com

Quickstart

npx dmarc-doctor gmail.com

Sample output:

dmarc-doctor — gmail.com

! SPF — present, with issues
  v=spf1 redirect=_spf.google.com
  ! SPF record should end with ~all (soft fail) or -all (hard fail)

✗ DKIM — not found

! DMARC — present, with issues
  v=DMARC1; p=none; sp=quarantine; rua=mailto:[email protected]
  policy: none
  ! DMARC policy is set to "none". Consider using "quarantine" or "reject" for better protection.

✓ MX — looks good
  5 gmail-smtp-in.l.google.com
  10 alt1.gmail-smtp-in.l.google.com
  ...

How to fix:
  • No DKIM record found across common selectors. Configure DKIM with your email provider.
  • Configure DKIM to improve deliverability and protect against spoofing.

What it checks

| Record | What dmarc-doctor looks for | |--------|---| | SPF | A v=spf1 TXT record at the apex domain. Flags missing ~all/-all, and >10 include: lookups (the SPF DNS-lookup limit). | | DKIM | TXT records at <selector>._domainkey.<domain> for the most common selectors: default, google, k1, selector1, selector2, dkim, s1, s2. Override with --selectors. | | DMARC | A v=DMARC1 TXT record at _dmarc.<domain>. Extracts the p= policy and flags p=none and missing rua=/ruf= reporting addresses. | | MX | At least one MX record, sorted by priority. |

Usage

dmarc-doctor <domain> [options]

Options:
  --json              Print machine-readable JSON output
  --no-color          Disable ANSI colors
  --selectors <a,b>   Comma-separated DKIM selectors to probe
  -h, --help          Show help
  -v, --version       Show version

The CLI exits non-zero (1) when any record is missing or has issues, so it works in CI checks and shell pipelines.

# In a deploy script:
dmarc-doctor mail.example.com --json > /tmp/dmarc.json || alert-team

Programmatic API

dmarc-doctor also ships as a tiny library:

import { checkDomain } from 'dmarc-doctor'

const result = await checkDomain('example.com')
if (!result.dmarc.exists) {
  // ...
}

You can inject your own DNS resolver (great for tests):

import { checkDomain, type DnsResolver } from 'dmarc-doctor'

const fake: DnsResolver = {
  async resolveTxt(host) { /* ... */ },
  async resolveMx(host)  { /* ... */ },
}
const result = await checkDomain('example.com', { resolver: fake })

Install

# One-shot
npx dmarc-doctor example.com

# Or globally
npm install -g dmarc-doctor
dmarc-doctor example.com

# Or as a library
npm install dmarc-doctor

Requires Node.js 18+.

The full platform

dmarc-doctor is the standalone CLI version of the deliverability checker that ships inside coldflow — the open-source cold-email platform from pypesdev. If you like this tool, check out coldflow for the full sending stack: warming, sequences, and inbox health monitoring.

Contributing

git clone [email protected]:pypesdev/dmarc-doctor.git
cd dmarc-doctor
npm install
npm test

PRs welcome — especially additional DKIM selectors, smarter SPF recursion checks, or BIMI/MTA-STS support.

License

MIT © pypesdev