email-audit

Name: email-audit
Author: AgriciDaniel

57installs26forks

How to install email-audit?

agricidaniel/claude-email/email-audit

$npx -y skills add AgriciDaniel/claude-email --skill email-audit

Installs into the current project.

Summary

Audits email domain deliverability setup (SPF, DKIM, DMARC, MX records, blacklists, TLS) and generates health score (0-100) with prioritized fix list. Checks bulk sender compliance against Google/Yahoo/Microsoft 2024-2026 requirements. Provides DNS records to add/update. Use when

Files · 1

View on GitHub

SKILL.md

1	# Email Audit Sub-Skill
2
3	## Purpose
4
5	Performs comprehensive email deliverability auditing for a domain. Checks DNS authentication records (SPF, DKIM, DMARC), infrastructure (MX, PTR, TLS), reputation (blacklists), and bulk sender compliance. Generates a health score (0-100) with prioritized fixes.
6
7	## Input
8
9	- Domain name: e.g., `rankenstein.cloud`, `example.com`
10	- Optional: Email volume (triggers bulk sender compliance checks if 5,000+ emails/day)
11
12	## Audit Categories
13
14	### 1. SPF Record (Weight: 10%)
15
16	What to check:
17	- SPF record exists at `TXT <domain>`
18	- Valid syntax: starts with `v=spf1`
19	- DNS lookup count (max 10, warn at 8+)
20	- Enforcement level: `-all` (pass), `~all` (softfail), `?all` (neutral), `+all` (fail)
21	- No multiple SPF records (causes validation failure)
22	- Includes are efficient and necessary
23
24	Commands:
25	```bash
26	dig txt <domain> +short \| grep "v=spf1"
27	# or
28	python scripts/check_deliverability.py <domain> --spf
29	```
30
31	Scoring:
32	- Valid + hard fail (`-all`): 100 points
33	- Valid + soft fail (`~all`): 70 points
34	- Valid + neutral/pass all: 40 points
35	- Invalid syntax or 10+ lookups: 20 points
36	- Missing: 0 points
37
38	### 2. DKIM Record (Weight: 15%)
39
40	What to check:
41	- At least one valid DKIM record exists
42	- Key length: 2048-bit (required minimum per NIST), 1024-bit (legacy, upgrade recommended)
43	- Common selectors: `google`, `default`, `selector1`, `selector2`, `k1`, `mandrill`, `dkim`
44
45	Commands:
46	```bash
47	dig txt google._domainkey.<domain> +short
48	dig txt default._domainkey.<domain> +short
49	dig txt selector1._domainkey.<domain> +short
50	# Check common selectors
51	```
52
53	Note: DKIM selectors are not discoverable without prior knowledge. Check common ones and ask user if their email provider uses a specific selector.
54
55	Scoring:
56	- 2048-bit key found: 100 points
57	- 1024-bit key found: 70 points
58	- Invalid/weak key: 30 points
59	- Missing: 0 points
60
61	### 3. DMARC Policy (Weight: 15%)
62
63	What to check:
64	- DMARC record exists at `TXT _dmarc.<domain>`
65	- Policy level: `p=reject` (excellent), `p=quarantine` (good), `p=none` (monitoring)
66	- Aggregate reporting (`rua=`) tag present
67	- Forensic reporting (`ruf=`) tag present (optional)
68	- Alignment mode: `aspf=` (SPF) and `adkim=` (DKIM) - relaxed vs strict
69	- Percentage (`pct=`) should be 100 for full enforcement
70
71	Commands:
72	```bash
73	dig txt _dmarc.<domain> +short
74	```
75
76	Scoring:
77	- `p=reject` + `rua` + `pct=100`: 100 points
78	- `p=quarantine` + `rua`: 80 points
79	- `p=none` + `rua`: 40 points
80	- `p=none` without reporting: 20 points
81	- Missing: 0 points
82
83	### 4. MX Records (Weight: 10%)
84
85	What to check:
86	- Valid MX records exist
87	- MX hosts resolve to IP addresses
88	- Priority ordering is logical
89	- Mail provider identification (Google Workspace, Microsoft 365, custom)
90
91	Commands:
92	```bash
93	dig mx <domain> +short
94	dig a <mx-hostname> +short
95	```
96
97	Scoring:
98	- Valid + all hosts resolve + known provider: 100 points
99	- Valid + all hosts resolve: 80 points
100	- Valid but some hosts don't resolve: 40 points
101	- Missing or invalid: 0 points
102
103	### 5. Reverse DNS / PTR (Weight: 5%)
104
105	What to check:
106	- PTR records exist for MX server IPs
107	- PTR records match forward DNS (hostname matches)
108
109	Commands:
110	```bash
111	dig -x <mx-ip> +short
112	```
113
114	Scoring:
115	- All MX IPs have matching PTR: 100 points
116	- Partial PTR coverage: 50 points
117	- Missing PTR: 0 points
118
119	### 6. TLS/STARTTLS (Weight: 10%)
120
121	What to check:
122	- STARTTLS support on MX servers (port 25)
123	- TLS version (1.2+ recommended)
124
125	Commands:
126	```bash
127	openssl s_client -starttls smtp -connect <mx-hostname>:25 -brief
128	```
129
130	Note: This may require network access. If not available, note as "Unable to verify".
131
132	Scoring:
133	- TLS 1.2+ with STARTTLS: 100 points
134	- TLS 1.0/1.1 with STARTTLS: 60 points
135	- No STARTTLS: 0 points
136
137	### 7. Blacklist Check (Weight: 20%)
138
139	What to check:
140	- Domain and MX IP addresses against major blacklists:
141	- Spamhaus (SBL, XBL, PBL)
142	- Barracuda
143	- SORBS
144	- SpamCop
145	- URIBL
146	- Invaluement
147
148	Commands:
149	```bash
150	# Use checkdmarc library if available
151	python -c "import checkdmarc; print(checkdmarc.check_domains(['<domain>']))"
152
153	# Or manual checks
154	dig <ip>.zen.spamhaus.org +short
155	dig <ip>.b.barracudacentral.org +short
156	```
157
158	Scoring:
159	- Clean on all lists: 100 points
160	- Listed on 1 minor list: 50 points
161	- Listed on 1 major list (Spamhaus, Barracuda): 30 points
162	- Listed on 2+ major lists: 0 points
163
164	Critical: Any listing on major blacklists severely impacts deliverability.
165
166	### 8. Bulk Sender Compliance (Weight: 10%)

People who liked this also viewed

6 picks

Type

email-audit

57installs26forks

View on GitHub

How to install email-audit?

agricidaniel/claude-email/email-audit

$npx -y skills add AgriciDaniel/claude-email --skill email-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Email Audit Sub-Skill
2
3	## Purpose
4
5	Performs comprehensive email deliverability auditing for a domain. Checks DNS authentication records (SPF, DKIM, DMARC), infrastructure (MX, PTR, TLS), reputation (blacklists), and bulk sender compliance. Generates a health score (0-100) with prioritized fixes.
6
7	## Input
8
9	- Domain name: e.g., `rankenstein.cloud`, `example.com`
10	- Optional: Email volume (triggers bulk sender compliance checks if 5,000+ emails/day)
11
12	## Audit Categories
13
14	### 1. SPF Record (Weight: 10%)
15
16	What to check:
17	- SPF record exists at `TXT <domain>`
18	- Valid syntax: starts with `v=spf1`
19	- DNS lookup count (max 10, warn at 8+)
20	- Enforcement level: `-all` (pass), `~all` (softfail), `?all` (neutral), `+all` (fail)
21	- No multiple SPF records (causes validation failure)
22	- Includes are efficient and necessary
23
24	Commands:
25	```bash
26	dig txt <domain> +short \| grep "v=spf1"
27	# or
28	python scripts/check_deliverability.py <domain> --spf
29	```
30
31	Scoring:
32	- Valid + hard fail (`-all`): 100 points
33	- Valid + soft fail (`~all`): 70 points
34	- Valid + neutral/pass all: 40 points
35	- Invalid syntax or 10+ lookups: 20 points
36	- Missing: 0 points
37
38	### 2. DKIM Record (Weight: 15%)
39
40	What to check:
41	- At least one valid DKIM record exists
42	- Key length: 2048-bit (required minimum per NIST), 1024-bit (legacy, upgrade recommended)
43	- Common selectors: `google`, `default`, `selector1`, `selector2`, `k1`, `mandrill`, `dkim`
44
45	Commands:
46	```bash
47	dig txt google._domainkey.<domain> +short
48	dig txt default._domainkey.<domain> +short
49	dig txt selector1._domainkey.<domain> +short
50	# Check common selectors
51	```
52
53	Note: DKIM selectors are not discoverable without prior knowledge. Check common ones and ask user if their email provider uses a specific selector.
54
55	Scoring:
56	- 2048-bit key found: 100 points
57	- 1024-bit key found: 70 points
58	- Invalid/weak key: 30 points
59	- Missing: 0 points
60
61	### 3. DMARC Policy (Weight: 15%)
62
63	What to check:
64	- DMARC record exists at `TXT _dmarc.<domain>`
65	- Policy level: `p=reject` (excellent), `p=quarantine` (good), `p=none` (monitoring)
66	- Aggregate reporting (`rua=`) tag present
67	- Forensic reporting (`ruf=`) tag present (optional)
68	- Alignment mode: `aspf=` (SPF) and `adkim=` (DKIM) - relaxed vs strict
69	- Percentage (`pct=`) should be 100 for full enforcement
70
71	Commands:
72	```bash
73	dig txt _dmarc.<domain> +short
74	```
75
76	Scoring:
77	- `p=reject` + `rua` + `pct=100`: 100 points
78	- `p=quarantine` + `rua`: 80 points
79	- `p=none` + `rua`: 40 points
80	- `p=none` without reporting: 20 points
81	- Missing: 0 points
82
83	### 4. MX Records (Weight: 10%)
84
85	What to check:
86	- Valid MX records exist
87	- MX hosts resolve to IP addresses
88	- Priority ordering is logical
89	- Mail provider identification (Google Workspace, Microsoft 365, custom)
90
91	Commands:
92	```bash
93	dig mx <domain> +short
94	dig a <mx-hostname> +short
95	```
96
97	Scoring:
98	- Valid + all hosts resolve + known provider: 100 points
99	- Valid + all hosts resolve: 80 points
100	- Valid but some hosts don't resolve: 40 points
101	- Missing or invalid: 0 points
102
103	### 5. Reverse DNS / PTR (Weight: 5%)
104
105	What to check:
106	- PTR records exist for MX server IPs
107	- PTR records match forward DNS (hostname matches)
108
109	Commands:
110	```bash
111	dig -x <mx-ip> +short
112	```
113
114	Scoring:
115	- All MX IPs have matching PTR: 100 points
116	- Partial PTR coverage: 50 points
117	- Missing PTR: 0 points
118
119	### 6. TLS/STARTTLS (Weight: 10%)
120
121	What to check:
122	- STARTTLS support on MX servers (port 25)
123	- TLS version (1.2+ recommended)
124
125	Commands:
126	```bash
127	openssl s_client -starttls smtp -connect <mx-hostname>:25 -brief
128	```
129
130	Note: This may require network access. If not available, note as "Unable to verify".
131
132	Scoring:
133	- TLS 1.2+ with STARTTLS: 100 points
134	- TLS 1.0/1.1 with STARTTLS: 60 points
135	- No STARTTLS: 0 points
136
137	### 7. Blacklist Check (Weight: 20%)
138
139	What to check:
140	- Domain and MX IP addresses against major blacklists:
141	- Spamhaus (SBL, XBL, PBL)
142	- Barracuda
143	- SORBS
144	- SpamCop
145	- URIBL
146	- Invaluement
147
148	Commands:
149	```bash
150	# Use checkdmarc library if available
151	python -c "import checkdmarc; print(checkdmarc.check_domains(['<domain>']))"
152
153	# Or manual checks
154	dig <ip>.zen.spamhaus.org +short
155	dig <ip>.b.barracudacentral.org +short
156	```
157
158	Scoring:
159	- Clean on all lists: 100 points
160	- Listed on 1 minor list: 50 points
161	- Listed on 1 major list (Spamhaus, Barracuda): 30 points
162	- Listed on 2+ major lists: 0 points
163
164	Critical: Any listing on major blacklists severely impacts deliverability.
165
166	### 8. Bulk Sender Compliance (Weight: 10%)

People who liked this also viewed

6 picks

Type