How do you audit SPF and DMARC with an AI agent, using AdminKit's MCP server?

Ask your agent, don’t read DNS by hand

Install AdminKit’s open-source adminkit-mcp connector (MIT, PyPI) and wire it into any MCP-capable AI agent — see connect an AI agent to AdminKit’s MCP server if you haven’t yet. Once it’s running:

uvx adminkit-mcp

Ask the agent, in plain language:

“Use check_mail_auth to check SPF and DMARC for my domain, and tell me what to fix if anything looks wrong.”

The agent calls check_mail_auth(domain="...") and gets back a structured result it can read, summarize, or act on — no manual dig TXT lookups or squinting at raw SPF mechanisms required.

What the tool checks, specifically

check_mail_auth reads the domain’s published SPF record (the v=spf1 ... TXT record) and its DMARC policy (the _dmarc TXT record), and flags four specific conditions: SPF missing or unparsable, DMARC missing or unparsable, SPF ending in the permissive +all mechanism (which RFC 7208 defines as matching literally any sending host), and DMARC still set to p=none. RFC 9989 §3.2.8 defines p=none as the Domain Owner offering no expression of preference — the current DMARC specification’s own way of saying it carries no enforcement effect on its own, so a domain can have a syntactically valid DMARC record and still be fully spoofable in practice.

Example response (fixture)

This is a labelled fixture, not a claim about any specific domain’s current records: the exact response shape check_mail_auth returns, matching the connector’s own open-source test suite. Reproduce it yourself by asking your agent to run the tool against a domain you manage. A domain with a permissive SPF record comes back like this:

{
  "tool": "check_mail_auth",
  "status": "warn",
  "result": {
    "domain": "example-nonprofit.test",
    "spf_status": "ok",
    "dmarc_status": "ok",
    "findings": []
  },
  "evidence": {
    "spf": { "status": "ok", "allMechanism": "+all" },
    "dmarc": { "status": "ok", "tags": { "p": "none" } }
  },
  "fix_hint": "Replace +all in the SPF record with -all or ~all; +all allows anyone to send as this domain.",
  "report_url": "https://adminkit.net/tools/spf-check/?utm_source=mcp"
}

A domain that’s missing SPF or DMARC entirely gets spf_status/dmarc_status of "not-found" and a fix_hint naming which record to publish first; a well-configured domain gets status: "ok" and fix_hint: null. How do you read a DMARC check result covers reading the DMARC-specific tags (p, pct, rua) in depth once you have a real result in front of you.

Why do this from an agent instead of the SPF tool page

An agent that can call check_mail_auth directly can fold the check into a bigger workflow — auditing every domain your org sends mail from before a migration, re-checking after a DNS change, or explaining the fix in the same conversation where you’re already debugging why a message landed in spam. The AI agents & MCP cluster covers the broader pattern of giving an agent real, structured tools instead of asking it to scrape a web page and guess at the meaning of what it finds. If you’re moving mail providers, migrating email providers without breaking SPF/DKIM/DMARC is the fuller checklist beyond what this one check covers.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.