/email-audit

name: email-audit
description: Audits email domain deliverability setup (SPF, DKIM, DMARC, MX records, blacklists, TLS) and generates health score (0-100) with prioritized fix list. Checks bulk sender compliance against Google/Yahoo/Microsoft 2024-2026 requirements. Provides DNS records to add/update. Use when user asks to audit, check, or analyze email deliverability, domain health, or inbox placement.
user-invocable: false
allowed-tools:
  - Read
  - Bash
  - Grep
  - Glob

Email Audit Sub-Skill

Purpose

Performs comprehensive email deliverability auditing for a domain. Checks DNS authentication records (SPF, DKIM, DMARC), infrastructure (MX, PTR, TLS), reputation (blacklists), and bulk sender compliance. Generates a health score (0-100) with prioritized fixes.

Input

• **Domain name**: e.g., `rankenstein.cloud`, `example.com`
• **Optional**: Email volume (triggers bulk sender compliance checks if 5,000+ emails/day)

Audit Categories

1. SPF Record (Weight: 10%)

**What to check:**

• SPF record exists at `TXT <domain>`
• Valid syntax: starts with `v=spf1`
• DNS lookup count (max 10, warn at 8+)
• Enforcement level: `-all` (pass), `~all` (softfail), `?all` (neutral), `+all` (fail)
• No multiple SPF records (causes validation failure)
• Includes are efficient and necessary

**Commands:**

dig txt <domain> +short | grep "v=spf1"
# or
python scripts/check_deliverability.py <domain> --spf

**Scoring:**

• Valid + hard fail (`-all`): 100 points
• Valid + soft fail (`~all`): 70 points
• Valid + neutral/pass all: 40 points
• Invalid syntax or 10+ lookups: 20 points
• Missing: 0 points

2. DKIM Record (Weight: 15%)

**What to check:**

• At least one valid DKIM record exists
• Key length: 2048-bit (required minimum per NIST), 1024-bit (legacy, upgrade recommended)
• Common selectors: `google`, `default`, `selector1`, `selector2`, `k1`, `mandrill`, `dkim`

**Commands:**

dig txt google._domainkey.<domain> +short
dig txt default._domainkey.<domain> +short
dig txt selector1._domainkey.<domain> +short
# Check common selectors

**Note:** DKIM selectors are not discoverable without prior knowledge. Check common ones and ask user if their email provider uses a specific selector.

**Scoring:**

• 2048-bit key found: 100 points
• 1024-bit key found: 70 points
• Invalid/weak key: 30 points
• Missing: 0 points

3. DMARC Policy (Weight: 15%)

**What to check:**

• DMARC record exists at `TXT _dmarc.<domain>`
• Policy level: `p=reject` (excellent), `p=quarantine` (good), `p=none` (monitoring)
• Aggregate reporting (`rua=`) tag present
• Forensic reporting (`ruf=`) tag present (optional)
• Alignment mode: `aspf=` (SPF) and `adkim=` (DKIM) - relaxed vs strict
• Percentage (`pct=`) should be 100 for full enforcement

**Commands:**

dig txt _dmarc.<domain> +short

**Scoring:**

• `p=reject` + `rua` + `pct=100`: 100 points
• `p=quarantine` + `rua`: 80 points
• `p=none` + `rua`: 40 points
• `p=none` without reporting: 20 points
• Missing: 0 points

4. MX Records (Weight: 10%)

**What to check:**

• Valid MX records exist
• MX hosts resolve to IP addresses
• Priority ordering is logical
• Mail provider identification (Google Workspace, Microsoft 365, custom)

**Commands:**

dig mx <domain> +short
dig a <mx-hostname> +short

**Scoring:**

• Valid + all hosts resolve + known provider: 100 points
• Valid + all hosts resolve: 80 points
• Valid but some hosts don't resolve: 40 points
• Missing or invalid: 0 points

5. Reverse DNS / PTR (Weight: 5%)

**What to check:**

• PTR records exist for MX server IPs
• PTR records match forward DNS (hostname matches)

**Commands:**

dig -x <mx-ip> +short

**Scoring:**

• All MX IPs have matching PTR: 100 points
• Partial PTR coverage: 50 points
• Missing PTR: 0 points

6. TLS/STARTTLS (Weight: 10%)

**What to check:**

• STARTTLS support on MX servers (port 25)
• TLS version (1.2+ recommended)

**Commands:**

openssl s_client -starttls smtp -connect <mx-hostname>:25 -brief

**Note:** This may require network access. If not available, note as "Unable to verify".

**Scoring:**

• TLS 1.2+ with STARTTLS: 100 points
• TLS 1.0/1.1 with STARTTLS: 60 points
• No STARTTLS: 0 points

7. Blacklist Check (Weight: 20%)

**What to check:**

• Domain and MX IP addresses against major blacklists:
• Spamhaus (SBL, XBL, PBL)
• Barracuda
• SORBS
• SpamCop
• URIBL
• Invaluement

**Commands:**

# Use checkdmarc library if available
python -c "import checkdmarc; print(checkdmarc.check_domains(['<domain>']))"

# Or manual checks
dig <ip>.zen.spamhaus.org +short
dig <ip>.b.barracudacentral.org +short

**Scoring:**

• Clean on all lists: 100 points
• Listed on 1 minor list: 50 points
• Listed on 1 major list (Spamhaus, Barracuda): 30 points
• Listed on 2+ major lists: 0 points

**Critical:** Any listing on major blacklists severely impacts deliverability.

8. Bulk Sender Compliance (Weight: 10%)

**Applies to:** Domains sending 5,000+ emails/day to Gmail, Yahoo, Microsoft recipients.

**Requirements (Google/Yahoo/Microsoft 2024-2026 rules):** 1. **Both SPF AND DKIM** must pass (not just one) 2. **DMARC** policy at minimum `p=none` with alignment 3. **One-click unsubscribe** header (RFC 8058: `List-Unsubscribe-Post: One-Click`) 4. **Spam complaint rate** under 0.3% (target under 0.1%) 5. **Valid forward and reverse DNS** (PTR records) 6. **Honor unsubscribe** within 2 business days 7. **No impersonation** of Gmail/Yahoo/Microsoft from headers 8. **TLS** connection for message transmission

**Scoring:**

• All 8 requirements met: 100 points
• 6-7 requirements met: 70 points
• 4-5 requirements met: 50 points
• Less than 4 met: 0 points

9. Additional Checks (Weight: 5%)

**Bonus points for:**

• **BIMI** record (Brand Indicators for Message Identification) at `TXT default._bimi.<domain>`
• **MTA-STS** policy at `https://mta-sts.<domain>/.well-known/mta-sts.txt`
• **TLSRPT** rec