Adding Google Workspace often leaves a second v=spf1 record next to the old one, and receivers then return permerror, so SPF fails for every message. A DKIM record written in a BIND file as google._domainkey.example.com without the trailing dot ends up at google._domainkey.example.com.example.com, and a DMARC record with p=none and [email protected] (no mailto:) gives you neither protection nor reports. Gmail and Yahoo (since February 2024) and Outlook.com (since May 2025) send bulk mail without SPF, DKIM and DMARC to spam or reject it. This skill finds these mistakes in your zone files before you publish them, and tells you how to fix each one.

Your agent runs a scanner on your DNS files: BIND zone files (db.example.com, example.com.zone), Cloudflare's BIND export, Route 53 JSON (list-resource-record-sets output, its ResourceRecordSets array, and change batches) and CSV exports with type, name and content columns. It reads them the way DNS servers and receivers do: $ORIGIN, $TTL, @ and relative names (also when the zone name comes from named.conf), records split over lines with parentheses, and TXT values split into several quoted strings, which are joined with no space. It decodes each DKIM key to measure its real size, counts SPF lookups and follows includes whose records are in the scanned files, and knows that subdomain zones inherit DMARC, that a null MX means no mail, that hosted DMARC and DKIM services delegated by CNAME or NS count as present, and that records meant to be included may end without all. It makes no DNS lookups. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Long keys and tokens are shortened in the report.

What it checks

BLOCK (fix before shipping)

• E01: a domain (zone apex) with MX records but no SPF TXT record (an SPF-type record does not count)

• E02: SPF ending in +all, all or ?all, or with no all and no redirect (neutral, like ?all)

• E03: more than one v=spf1 record at the same name (permerror)

• E04: a mail domain with no usable DMARC record at _dmarc: missing or at the wrong name, more than one, v=DMARC1 not first, or an invalid p= without rua

• E05: SPF syntax errors: typos, include: with a space, an IP in include: or a:, bad ip4/ip6 ranges, strings joined to v=spf1 without a space, terms after all

• E06: more than 10 SPF DNS lookups counted in the files (RFC 7208)

• E07: a DKIM RSA key under 1024 bits, which verifiers must reject (RFC 8301)

REVIEW (check before release)

• E11: DMARC p=none or no p=, pct below 100, t=y, sp=none or np=none

• E12: DMARC without rua, or rua without mailto:

• E13: 6 to 10 counted SPF lookups plus includes that are not in the files

• E14: SPF ptr

• E15: a mail domain with no working DKIM key under _domainkey (any selector; CNAME, NS and DNAME delegation count as present)

• E16: a DKIM RSA key of 1024 to 2047 bits

• E17: DKIM records without p=, with a cut-off or damaged key, v= not first, an unknown k=, t=y testing mode or sha1 only

• E18: MX pointing to an IP address or to a CNAME

• E19: mail record names or MX/CNAME targets in BIND files written as full names without the trailing dot

• E20: domains that send no mail but lack v=spf1 -all or DMARC (reverse and subdomain zones are skipped)

• E21: subdomains with MX but no SPF, often receive-only (publish v=spf1 -all there)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example DNS folder (two BIND zones, a Cloudflare export, a Route 53 listing and a CSV export for reserved example domains), and the real report the scanner produces on the risky one

Limits

It reads the records written in the files. Includes, CNAME targets, delegated DMARC and DKIM hosts and keys outside the scanned files are not looked up, and the lookup count covers only what it can see. Missing records are reported only for whole zones (an SOA record or a CSV export); snippets, change batches and single pages of a Route 53 listing are checked record by record. Terraform and other provider configs are not read, and DMARC alignment and live delivery are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 18 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.