---
name: email-deliverability
description: Diagnoses and fixes email deliverability issues by checking SPF, DKIM, DMARC, BIMI records, blacklist status, and SMTP/IMAP server connectivity. Generates DNS records for email authentication. Activates when the task involves email going to spam, domain reputation, DNS authentication setup, mail server configuration, sender verification, or email infrastructure troubleshooting.
license: MIT
compatibility: "Requires network access to the MailX MCP server (mailx) at https://themailx.com/mcp"
metadata:
  author: mailx
  version: 1.2
  source: dynamic
  source_url: "https://themailx.com/skills/email-deliverability/SKILL.md"
---

# Email Deliverability

Use the MailX MCP tools (`mailx` server) to diagnose, audit, and fix email authentication and delivery issues.

## Tools

All tools are on the `mailx` MCP server. Use fully qualified names (`mailx:tool_name`):

| Tool | Purpose |
|------|---------|
| `mailx:audit_domain` | Use this when the user asks why their emails go to spam or wants a full deliverability check of a domain. Runs SPF, DKIM (finds the selector on its own), DMARC, blacklist and MX checks in one call and returns pass, warning or fail for each, an overall result, and the fixes to apply in priority order with help links. Takes about 10 seconds. mailX never changes DNS. |
| `mailx:bimi_check` | Use this when the user asks about BIMI or showing a brand logo next to their emails in inboxes. Returns the live BIMI record, the logo URL it declares, and a fix suggestion. |
| `mailx:blacklist_check` | Use this when the user suspects their domain is blacklisted or blocked. Checks the domain against major DNS blocklists and returns the result for each list. |
| `mailx:cname_lookup` | Use this when the user wants to know whether a hostname is an alias of another one, for example to verify DKIM or tracking CNAMEs. Returns the live CNAME target. |
| `mailx:dkim_check` | Use this when the user wants to verify DKIM for a domain. Pass the DKIM selector if known (for example google for Google Workspace, selector1 or selector2 for Microsoft 365). If the selector is unknown, omit it: mailX then tries common selectors and returns the ones it finds. Returns the published key and its status. A miss on common selectors does not prove DKIM is absent. |
| `mailx:dmarc_check` | Use this when the user asks about DMARC, spoofing protection, or what happens to emails that fail authentication. Returns the live DMARC record, its policy and a fix suggestion. |
| `mailx:dmarc_generate` | Use this when the user needs a DMARC record. Returns the record name, value and type ready to publish. mailX does not publish it. |
| `mailx:dns_lookup` | Use this when the user wants every DNS record for a domain in one view (A, AAAA, CNAME, MX, NS, TXT, SOA). Returns the live records grouped by type. |
| `mailx:imap_check` | Use this only when the user explicitly asks to test an IMAP login for a mailbox they control and provides its credentials. Connects to the IMAP server and reports whether connection, encryption and authentication succeed. Credentials are not stored. |
| `mailx:imap_finder` | Use this when the user needs the incoming mail (IMAP) server settings for an email provider, such as Gmail, Outlook, Yahoo, iCloud or Zoho. Returns the host, ports with encryption and the provider's setup guide. Never asks for the user's credentials. |
| `mailx:mx_lookup` | Use this when the user wants to know which mail servers receive email for a domain. Returns the domain's live MX records with their priorities. |
| `mailx:ptr_lookup` | Use this when the user wants the reverse DNS (PTR) of an IP address, for example to check a sending server's reverse DNS. Returns the hostname the IP resolves to. |
| `mailx:smtp_check` | Use this only when the user explicitly asks to test an SMTP login for a mail account they control and provides its credentials. Connects to the SMTP server and reports whether connection, encryption and authentication succeed. If from_email and to_email are both given, it also sends one test email. Credentials are not stored. |
| `mailx:smtp_finder` | Use this when the user needs the outgoing mail (SMTP) server settings for an email provider or sending service, such as Gmail, Outlook, Microsoft 365, Zoho, Amazon SES or SendGrid. Returns the host, ports with encryption, what to use to log in, and the provider's setup guide. Never asks for the user's credentials. |
| `mailx:spf_check` | Use this when the user asks whether a domain's SPF record is valid, which servers may send email for a domain, or why SPF fails. Returns the live SPF record, a pass/fail status and a fix suggestion. |
| `mailx:spf_generate` | Use this when the user needs a new SPF record for their email provider. Returns a TXT record ready to publish, or explains what to set up instead when the provider does not need a root SPF include. mailX does not publish it. |
| `mailx:txt_lookup` | Use this when the user wants to see a domain's TXT records, for example to find verification tokens or check what SPF or other policies are published. Returns all live TXT records. |

## Workflow: Full Deliverability Audit

When diagnosing why emails go to spam or auditing a domain's setup:

```
Audit Progress:
- [ ] Run DNS checks (SPF, DMARC, DKIM)
- [ ] Check blacklist status
- [ ] Analyze combined results
- [ ] Generate missing records
- [ ] Report findings with fixes
```

1. **DNS checks**: Run `mailx:spf_check`, `mailx:dmarc_check`, and `mailx:dkim_check` for the domain. For DKIM, omit the selector unless the user gave one: `dkim_check` tries common selectors. If none match, say the selector was not found (not that DKIM is missing) and ask for the `s=` value from the DKIM-Signature header of an email they sent.
2. **Blacklist**: Run `mailx:blacklist_check`.
3. **Analyze**: See [references/diagnosis.md](https://themailx.com/skills/email-deliverability/references/diagnosis.md) for interpreting combined results.
4. **Fix**: Generate missing records with `mailx:spf_generate` or `mailx:dmarc_generate`.
5. **Report**: Lead with a pass/fail summary. For each failure, give the exact DNS record to add in copy-pasteable format.

## Workflow: DNS Record Setup

When setting up email authentication from scratch:

1. Ask which email provider they use.
2. Generate SPF with `mailx:spf_generate` using their provider.
3. Generate DMARC with `mailx:dmarc_generate` — default to `none` policy, recommend upgrading to `quarantine`/`reject` after monitoring.
4. DKIM must be enabled in the provider's admin dashboard — it cannot be generated externally.
5. Give all DNS records in copy-pasteable format (name, type, value).

## Workflow: Mail Server Troubleshooting

When a user has issues sending or receiving email:

1. Look up correct settings with `mailx:smtp_finder` or `mailx:imap_finder`.
2. Test with `mailx:smtp_check` or `mailx:imap_check` using their credentials.
3. Interpret errors:
   - **Auth failed** → wrong credentials or needs app-specific password
   - **Connection failed** → wrong host/port or firewall blocking
   - **SSL failed** → wrong encryption setting for the port

## Key Rules

- **SPF**: Exactly one record per domain. Multiple = both invalid. Merge all `include:` into one.
- **DKIM**: Selector-specific. One domain can have many DKIM records. Common selectors: `google`, `selector1`/`selector2`, `k1`, `default`.
- **DMARC**: Start `p=none` → monitor → `p=quarantine` → `p=reject`. Always include `rua=`.
- **Blacklists**: Each blacklist has its own delisting process. Direct the user to the specific blacklist's website.
- **Ports**: SMTP 587 (TLS), 465 (SSL), 25 (relay). IMAP 993 (SSL), 143 (STARTTLS).