Domain Health Precheck

What it does

Before a single email leaves a domain, four things decide whether it arrives: a valid SPF record, a published DKIM selector, a DMARC policy that is not left at none forever, and a clean listing across the major blocklists. This skill checks all four on one domain and returns a plain verdict with the exact DNS records to add for anything that fails.

When to use it

• check my domain
• am I going to land in spam
• is this domain blacklisted
• SPF DKIM DMARC setup
• domain health

What it needs from you

• domain: the sending domain, not the website domain if they differ
• provider: which mail provider sends for it

Live data it reads

The checks run live against DNS and public blocklists through the Mamba Labs deliverability actor, so the result is the current record rather than a cached report. - domain-deliverability-checker: SPF, DKIM, DMARC and blacklist status for a sending domain Store page: https://apify.com/mambalabs/domain-deliverability-checker Runnable example input:

How it works

1. Read the SPF record. Check that it exists, that there is exactly one, that it authorizes the actual sending provider, and that it stays under the ten lookup limit.
2. Read DKIM at the selector the provider uses. A domain with no published selector is unsigned regardless of what the provider dashboard says.
3. Read DMARC. Report the policy, and treat a policy of none that has been in place for months as a finding rather than a pass.
4. Check the blocklists and report which one, since the delisting process differs per list.
5. Check whether the sending domain is the primary brand domain. Sending cold outreach from the primary domain puts the whole company's mail at risk and is the single most consequential finding.
6. Return a verdict: safe to send, safe after the listed fixes, or do not send. Give the exact record content to add, not a description of it.

What you get back

A four row check table with the record found and the verdict, then the exact DNS records to add, then the one line overall verdict.

The quality bar

• Every failed check comes with the literal record value to publish
• Multiple SPF records are reported as a failure, not merged
• A DMARC policy of none is reported with its age rather than passed silently
• Sending from the primary brand domain is called out explicitly

Where it runs

• Claude Code
• Codex CLI
• Cursor
• MCP-compatible agents