Diagnose SPF, DKIM, and DMARC for any domain — in one command. Zero runtime deps.
When your cold email lands in spam, the first thing to check is your domain authentication. dmarc-doctor resolves the right DNS records, parses them, flags common misconfigurations, and tells you how to fix each one.
npx dmarc-doctor example.comnpx dmarc-doctor gmail.comSample output:
dmarc-doctor — gmail.com
! SPF — present, with issues
v=spf1 redirect=_spf.google.com
! SPF record should end with ~all (soft fail) or -all (hard fail)
✗ DKIM — not found
! DMARC — present, with issues
v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com
policy: none
! DMARC policy is set to "none". Consider using "quarantine" or "reject" for better protection.
✓ MX — looks good
5 gmail-smtp-in.l.google.com
10 alt1.gmail-smtp-in.l.google.com
...
How to fix:
• No DKIM record found across common selectors. Configure DKIM with your email provider.
• Configure DKIM to improve deliverability and protect against spoofing.
| Record | What dmarc-doctor looks for |
|---|---|
| SPF | A v=spf1 TXT record at the apex domain. Flags missing ~all/-all, and >10 include: lookups (the SPF DNS-lookup limit). |
| DKIM | TXT records at <selector>._domainkey.<domain> for the most common selectors: default, google, k1, selector1, selector2, dkim, s1, s2. Override with --selectors. |
| DMARC | A v=DMARC1 TXT record at _dmarc.<domain>. Extracts the p= policy and flags p=none and missing rua=/ruf= reporting addresses. |
| MX | At least one MX record, sorted by priority. |
dmarc-doctor <domain> [options]
Options:
--json Print machine-readable JSON output
--no-color Disable ANSI colors
--selectors <a,b> Comma-separated DKIM selectors to probe
-h, --help Show help
-v, --version Show version
The CLI exits non-zero (1) when any record is missing or has issues, so it works in CI checks and shell pipelines.
# In a deploy script:
dmarc-doctor mail.example.com --json > /tmp/dmarc.json || alert-teamdmarc-doctor also ships as a tiny library:
import { checkDomain } from 'dmarc-doctor'
const result = await checkDomain('example.com')
if (!result.dmarc.exists) {
// ...
}You can inject your own DNS resolver (great for tests):
import { checkDomain, type DnsResolver } from 'dmarc-doctor'
const fake: DnsResolver = {
async resolveTxt(host) { /* ... */ },
async resolveMx(host) { /* ... */ },
}
const result = await checkDomain('example.com', { resolver: fake })# One-shot
npx dmarc-doctor example.com
# Or globally
npm install -g dmarc-doctor
dmarc-doctor example.com
# Or as a library
npm install dmarc-doctorRequires Node.js 18+.
dmarc-doctor is the standalone CLI version of the deliverability checker that ships inside coldflow — the open-source cold-email platform from pypesdev. If you like this tool, check out coldflow for the full sending stack: warming, sequences, and inbox health monitoring.
git clone git@github.com:pypesdev/dmarc-doctor.git
cd dmarc-doctor
npm install
npm testPRs welcome — especially additional DKIM selectors, smarter SPF recursion checks, or BIMI/MTA-STS support.
MIT © pypesdev
