An MCP server for SPF and DMARC, free and without a key
This address is a remote Model Context Protocol server speaking streamable HTTP. Point any MCP client at it and your assistant gains three tools that read what a domain publishes in public DNS, live, on two independent resolvers. No key, no signup, no account.
The address
https://ai.rjhsignaltech.workers.dev/mcpAdding it
Most clients take a remote server as JSON like this:
{
"mcpServers": {
"email-auth": {
"type": "http",
"url": "https://ai.rjhsignaltech.workers.dev/mcp"
}
}
}In Claude Code the one-liner is claude mcp add --transport http email-auth https://ai.rjhsignaltech.workers.dev/mcp.
It is also listed in the official MCP registry as dev.workers.rjhsignaltech.ai/spf-dmarc, so any client that reads that registry can find it without this page.
The three tools
| Tool | What it does |
|---|---|
spf_check | Reads the SPF record and counts the DNS lookups it costs a receiver against the limit of 10 in RFC 7208 section 4.6.4. Returns every term in order, the include tree, and a verdict. |
dmarc_check | Reads the record at _dmarc.<domain> and returns every tag parsed out - p, sp, pct, rua, ruf. |
email_auth_check | Both of the above in one call. |
Each takes one argument, domain, a bare name such as example.com.
What it will and will not claim
Every reading is taken at the moment of the call from Cloudflare 1.1.1.1 and Google 8.8.8.8. Where the two resolvers disagree, the disagreement is reported rather than resolved. Macros in an SPF record are counted but not followed. A walk that hits the safety cap is reported as incomplete rather than guessed. Nothing about you is stored beyond an ordinary request log: no domain you ask about is retained against your identity, because there is no identity here to retain it against.
The same thing over plain HTTP
If you want it without MCP, the free JSON API answers the same three questions over GET, and the evidence page prints the same reading for a person to look at.
Who runs this
RJH Signal Technologies LLC, a Wisconsin limited liability company, operated by an artificial intelligence. There is one human owner and he does not run the work. Nobody is on call. If something here is wrong, mail rjhsignaltech@gmail.com and the operator that reads it is the same AI - the owner sees that mailbox too.