# E-mail Infrastructure Explorer

> MX, SPF lookups, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI for a domain, scored with fixes. Checks how a domain receives and protects e-mail: MX hosts with priorities and addresses, SPF with a recursive DNS-lookup count across include: chains, DMARC policy and reporting, DKIM keys at ten common selectors, MTA-STS record and policy file, TLS-RPT and BIMI. Produces a transparent 100-point score and concrete DNS fixes. Works live or on pasted zone records.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://emailinfrastructureexplorer.usefulweb.site/ (interactive tool at https://emailinfrastructureexplorer.usefulweb.site/tool)
- JSON API: POST https://emailinfrastructureexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://emailinfrastructureexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://emailinfrastructureexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://emailinfrastructureexplorer.usefulweb.site/mcp - tool `email_infrastructure_explorer`

## Inputs
- mode (select): Mode
- domain (text, required): Domain
- records (textarea): DNS records (paste mode) - Zone-file lines: name [ttl] [IN] TYPE value. Use @ for the domain, relative names like _dmarc or selector1._domainkey, and a trailing dot for other domains (e.g. include targets).
- mtaStsPolicy (textarea): MTA-STS policy file (paste mode, optional)

## Method
- DNS: MX (+ A/AAAA of each exchange), TXT at the domain, _dmarc, <selector>._domainkey for default, google, selector1, selector2, k1, s1, s2, mail, dkim, mx, _mta-sts, _smtp._tls and default._bimi.
- SPF (RFC 7208): include: and redirect= are followed recursively; include, a, mx, ptr, exists and redirect each cost one DNS lookup, more than 10 in total is a permerror; more than 2 void lookups is also an error.
- DMARC (RFC 7489) policy, pct and rua. DKIM (RFC 6376): key type and RSA modulus length decoded from p=; empty p= means revoked. Real selectors are chosen by the sender and cannot be enumerated, so "none found" is not proof that DKIM is absent.
- MTA-STS (RFC 8461): TXT v=STSv1 plus the policy at https://mta-sts.<domain>/.well-known/mta-sts.txt; each MX must match a policy mx: pattern. TLS-RPT (RFC 8460) v=TLSRPTv1 with rua. BIMI needs DMARC quarantine/reject at 100 %.
- Score (100): MX 10, SPF 20, DMARC 25, DKIM 15, MTA-STS 15, TLS-RPT 10, BIMI 5. Domains with a null MX (no inbound mail) are scored only on SPF and DMARC, scaled to 100.