/deliverability-check

name: deliverability-check
description: Audit a sending domain's deliverability — SPF, DKIM, DMARC, MX, BIMI, blocklists — with a prioritized fix order
version: "1.1.1"
author: Cogny AI
platforms: []
user-invocable: true
argument-hint: "<domain>"
allowed-tools:
  # Optional, enhanced when connected (read tools only)
  - mcp__cogny__refresh_mcp_discovery
  - mcp__cogny__list_integrations
  - mcp__cogny__mcp__Klaviyo__list_campaigns
  - mcp__cogny__mcp__Klaviyo__get_campaign_values_report
  - mcp__cogny__mcp__Mailchimp__tool_list_reports
  - mcp__cogny__mcp__Mailchimp__tool_get_report
  - mcp__cogny__mcp__Rule__tool_list_campaigns
  - mcp__cogny__mcp__Rule__tool_get_campaign_statistics
  - mcp__cogny__mcp__Rule__tool_list_suppressions
  - mcp__cogny__mcp__Get_a_Newsletter__tool_list_sent
  - mcp__cogny__mcp__Get_a_Newsletter__tool_get_report
  - mcp__cogny__mcp__Get_a_Newsletter__tool_get_report_bounces
  - mcp__cogny__mcp__Brevo__list_email_campaigns
  - mcp__cogny__mcp__Brevo__get_email_campaign
  - mcp__cogny__mcp__Brevo__get_smtp_report
  - mcp__cogny__mcp__MailerLite__list_campaigns
  - mcp__cogny__mcp__MailerLite__get_campaign
  - mcp__cogny__mcp__Salesforce_Marketing_Cloud__list_email_sends
  - mcp__cogny__mcp__Salesforce_Marketing_Cloud__get_triggered_send_summary
  - mcp__cogny__mcp__Symplify__get_campaign_overview
  - mcp__cogny__mcp__Braze__braze_list_campaigns
  - mcp__cogny__mcp__Braze__braze_get_campaign_analytics
  - mcp__cogny__mcp__Braze__braze_list_email_unsubscribes
  - Bash
  - WebFetch
  - WebSearch
  - Read
  - Write

Deliverability Check

Audit a sending domain's email authentication and deliverability posture. Explains every finding in plain English and outputs a prioritized fix order — critical for anyone whose open rate dropped and doesn't know why.

Usage

`/deliverability-check brand.com` — audit the domain `/deliverability-check brand.com news.brand.com` — include a sending subdomain

Works with

Steps 1–9 need only DNS and the web: zero accounts. If an ESP is connected through Cogny (`mcp__cogny__list_integrations`), Step 8b adds the bounce, complaint and unsubscribe rates that DNS can't show.

| ESP (Prefix) | Recent sends | Bounce / complaint / unsub numbers | Notes | |--------------|--------------|------------------------------------|-------| | Klaviyo (`Klaviyo`) | `list_campaigns` | `get_campaign_values_report` (`statistics: ["bounce_rate","spam_complaint_rate","unsubscribe_rate","delivery_rate"]`, `timeframe: {"key": "last_30_days"}`) | | | Mailchimp (`Mailchimp`) | `tool_list_reports` | `tool_get_report` (bounces, abuse reports, unsubscribes) | | | Rule (`Rule`) | `tool_list_campaigns` | `tool_get_campaign_statistics`; `tool_list_suppressions` for suppression growth | | | Get a Newsletter (`Get_a_Newsletter`) | `tool_list_sent` | `tool_get_report`, `tool_get_report_bounces` (per sent mail) | Bounce detail per address shows which receiving domains reject | | Brevo (`Brevo`) | `list_email_campaigns` (`status: "sent"`) | `get_email_campaign` (`statistics`: hard/soft bounces, complaints, unsubscriptions); `get_smtp_report` (`days: 30`) for transactional mail | Report marketing and transactional streams separately | | MailerLite (`MailerLite`) | `list_campaigns` (`filter_status: "sent"`) | `get_campaign` (`stats`: hard/soft bounces, spam complaints, unsubscribes) | | | Salesforce Marketing Cloud (`Salesforce_Marketing_Cloud`) | `list_email_sends` (`start_date`, `end_date`) | same call: bounce and unsubscribe rates per send; `get_triggered_send_summary` for journey email (lifetime) | | | Symplify (`Symplify`) | `get_campaign_overview` (`period: "LAST_30_DAYS"`) | same call: bounces, unsubscribes per delivery | | | Braze (`Braze`) | `braze_list_campaigns` | `braze_get_campaign_analytics` (email channel: bounces, reported spam, unsubscribes), `braze_list_email_unsubscribes` | 100 days max per call | | Drip (`Drip`) | — | not exposed | Ask for a screenshot of Drip's deliverability stats |

Steps

1. Parse the input

Extract the root domain and any subdomains the user wants checked. If only a root domain is given, also probe common sending subdomains: `mail.`, `news.`, `marketing.`, `email.`, `em.`, `send.`, `bounce.`, `mg.`, `sg.`, `e.`.

for sub in mail news marketing email em send bounce mg sg e; do
  r=$(dig +short TXT $sub.<domain>; dig +short MX $sub.<domain>)
  [ -n "$r" ] && echo "== $sub.<domain>" && echo "$r"
done

Any subdomain that returns an SPF record or MX (e.g. `send.<domain>` with `include:amazonses.com`, typical for Resend) is a **sending subdomain**: run Steps 3–5 (SPF, DKIM selectors, DMARC) on it too and report it in its own block. Also add any domain named in an SPF `include:` or a bounce `MX` that belongs to the user.

2. MX records

dig +short MX <domain>

• Record them. If missing → domain can't receive mail (may still send, but a misconfig signal).
• Identify the provider from the MX (Google Workspace, Microsoft 365, Proofpoint, Mimecast, custom).

3. SPF (Sender Policy Framework)

dig +short TXT <domain> | grep -i spf

Check:

• **Presence** — missing SPF is a major problem
• **Multiple SPF records** — only one is allowed; multiple causes permfail
• **Qualifier** — `~all` (softfail, common), `-all` (hardfail, strongest), `?all` (neutral, weak), `+all` (broken, allows anyone)
• **Include count** — SPF has a 10-DNS-lookup limit. Count `include:` and `redirect=` directives. Flag if ≥8 (risk of permerror)
• **Lists Cogny-relevant senders?** — if the user runs a connected ESP, check the SPF includes the right sender (e.g., `include:_spf.klaviyo.com`, `include:servers.mcsv.net` for Mailchimp, `include:spf.brevo.com` or legacy `include:spf.sendinblue.com` for Brevo, `include:_spf.mlsend.com` for MailerLite, `include:cust-spf.exacttarget.com` for Salesforce Marketing Cloud). Many ESPs send from their own bounce domain, so a missing include is only a problem if DMARC alignment then rel