Email Auth Checker

Look up MX, SPF, DMARC, and common DKIM selectors for a domain using Cloudflare DNS over HTTPS, with pass/warn/fail guidance.

Features

• Accepts a bare domain or http(s) URL (hostname extracted)
• Parses SPF and DMARC policies with actionable warnings
• Probes common DKIM selectors (google, selector1, selector2, default, k1)
• Stateless; no bindings required

API Reference

GET /check

Example Request

curl "https://your-worker.workers.dev/check?domain=cloudflare.com"

Success Response

domain string

Normalized domain that was checked

mx array

MX records with priority and exchange

spf / dmarc / dkim object

Per-record analysis with status, details, and optional raw records

summary object

Overall status (pass | warn | fail) and issues list

{
  "domain": "cloudflare.com",
  "mx": [{ "priority": 10, "exchange": "isaac.mx.cloudflare.net" }],
  "spf": {
    "status": "pass",
    "record": "v=spf1 include:_spf.mx.cloudflare.net -all",
    "detail": "SPF record present"
  },
  "dmarc": {
    "status": "pass",
    "policy": "reject",
    "detail": "DMARC policy is reject"
  },
  "dkim": {
    "status": "warn",
    "selectorsChecked": ["google", "selector1", "selector2", "default", "k1"],
    "found": [],
    "detail": "No DKIM keys found for common selectors..."
  },
  "summary": {
    "status": "warn",
    "issues": ["No DKIM keys found for common selectors..."]
  }
}

Error Codes

• 400 - Missing or invalid domain (INVALID_DOMAIN)
• 502 - DoH lookup failed (DNS_ERROR)

Use Cases

• Verify email authentication before sending from a new domain
• Spot missing SPF/DMARC during onboarding
• Explain email auth posture to non-DNS experts
• Complement raw DNS dumps with actionable analysis

Limitations

• DKIM selectors are not enumerated exhaustively; only common ones are probed
• Does not validate live mail delivery or DKIM signatures on messages
• Relies on public DoH answers; DNS TTL/caching may lag recent changes

Deployment

curl "https://your-worker.workers.dev/check?domain=example.com"

Local Development

cd apps/experiments/email-auth-checker
npm install
npm run dev

curl "http://localhost:8787/check?domain=cloudflare.com"

Cloudflare Features Used

• Workers - Edge compute runtime
• DNS over HTTPS - Cloudflare DoH JSON API

Next Steps