# io.inboxguard/email-deliverability (remote · mcp.inboxguard.io)

Scan and fix a domain's email deliverability (SPF, DKIM, DMARC, MTA-STS, BIMI, DNS blocklists).

- Trust score: 78/100 (medium)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.inboxguard.io`: 78/100 (this document), [markdown](https://verifymcp.io/servers/io-inboxguard-email-deliverability/mcp.md), [page](https://verifymcp.io/servers/io-inboxguard-email-deliverability/mcp)

## Channel facts

- Endpoint: `https://mcp.inboxguard.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 3016 tokens (~94/item across 32 items; 28 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 73/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### Claude

```bash
claude mcp add --transport http io-inboxguard-email-deliverability https://mcp.inboxguard.io/mcp
```

### Codex

```toml
[mcp_servers.io-inboxguard-email-deliverability]
url = "https://mcp.inboxguard.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-inboxguard-email-deliverability": {
      "type": "remote",
      "url": "https://mcp.inboxguard.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-inboxguard-email-deliverability --url https://mcp.inboxguard.io/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-inboxguard-email-deliverability:
    url: "https://mcp.inboxguard.io/mcp"
```

### Other

```json
{
  "mcpServers": {
    "io-inboxguard-email-deliverability": {
      "type": "http",
      "url": "https://mcp.inboxguard.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 76, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 73, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 73, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 72)

First indexed and scored.

## MCP tools (28)

### `scan_domain` (~118 tokens)

Scan domain deliverability

Run a full email-deliverability scan (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, MX TLS, BIMI, DNS blocklists) for a domain and return a 0-100 score with per-check findings. Runs at your plan tier (full blocklist set on paid plans) and saves the scan to the domain history in your account.

Input parameters:

- `dkimSelectors` (array): Optional DKIM selectors to probe.
- `domain` (string, required): Domain to scan, e.g. example.com.

### `get_deliverability_score` (~45 tokens)

Get deliverability score

Return the overall deliverability score and letter grade for a domain (runs a fresh scan).

Input parameters:

- `domain` (string, required): Domain to score, e.g. example.com.

### `check_blocklists` (~64 tokens)

Check DNS blocklists

Check a domain (apex + MX-host IPs) against supported DNS blocklists and return listings, targets checked, and issues (authoritative-side queries; no public-resolver false positives).

Input parameters:

- `domain` (string, required): Domain to check, e.g. example.com.

### `get_dmarc_summary` (~109 tokens)

Get DMARC summary

Summarize ingested DMARC aggregate (RUA) reports for a domain tracked in your InboxGuard account: report volume, pass rate, top sending sources, and the rua inbox to publish. The domain must already be added to the account, and the plan must include DMARC ingest.

Input parameters:

- `days` (integer): Lookback window in days (default 30, max 90).
- `domain` (string, required): Domain name tracked in the account, e.g. example.com.

### `list_domains` (~28 tokens)

List tracked domains

List the account's tracked domains with latest scan score, last scan time, and open alert count.

### `get_domain` (~91 tokens)

Get domain detail

Full detail for one tracked domain: the domain record, the latest scan with all per-check findings (spf, dmarc, dkim, ptr, mta_sts, tls_rpt, mx_tls, blocklist), recent score history, open/recent alerts, and Google Postmaster stats when connected.

Input parameters:

- `domain` (string, required): Domain name as tracked in the account, e.g. example.com.

### `list_alerts` (~91 tokens)

List alerts

List the account's deliverability alerts (score drops, check failures, blocklist listings). Defaults to open alerts only.

Input parameters:

- `limit` (integer): Max alerts to return (default 50).
- `resolved` (string): 'false' = open alerts only (default), 'true' = resolved only, 'all' = both.
- `severity` (string): Filter by severity (default 'all').

### `list_scans` (~80 tokens)

List scan history

List recent scans (id, domain, run time, score) across all tracked domains, or for one domain when a name is given.

Input parameters:

- `domain` (string): Optional: restrict to one tracked domain by name, e.g. example.com. Omit for all domains.
- `limit` (integer): Max scans to return (default 20).

### `resolve_alert` (~79 tokens)

Resolve alert

Mark an alert resolved (or reopen it with resolved=false). Requires an API key with write/full scope. Resolving an already-resolved alert is a no-op.

Input parameters:

- `alertId` (string, required): Alert UUID, from list_alerts or get_domain.
- `resolved` (boolean): true (default) marks the alert resolved; false reopens it.

### `get_dns_fix_plan` (~135 tokens)

Preview the DNS fix plan

Compute the exact DNS-record changes needed to fix a tracked domain's deliverability, based on its latest scan and the org's connected registrar (Cloudflare/Route 53/GoDaddy/Namecheap). Read-only — nothing changes. Returns the `ops` to pass verbatim to apply_dns_fix, plus `manualReview` items that need a human decision (SPF sender list, DKIM keys, BIMI logo). Requires the domain to be tracked, a scan to exist, and a registrar connection covering the zone.

Input parameters:

- `domain` (string, required): Domain name tracked in the account, e.g. example.com.

### `apply_dns_fix` (~187 tokens)

Apply the DNS fix plan

Apply a DNS fix plan to a tracked domain by publishing records at the connected registrar. DESTRUCTIVE: it creates/updates/deletes DNS records. Two-step by design — first call get_dns_fix_plan, then pass its `connectionId` and `ops` here verbatim. The server re-derives the diff from the latest scan and rejects any op that no longer matches, so an agent can never apply arbitrary records. Requires an owner/admin API key with write or full scope. Re-scan afterward to confirm the fix.

Input parameters:

- `connectionId` (string, required): The connectionId from get_dns_fix_plan.
- `domain` (string, required): Domain name tracked in the account, e.g. example.com.
- `ops` (array, required): The `ops` array from get_dns_fix_plan, passed verbatim. The server validates each op against a freshly recomputed diff before executing.

### `analyze_headers` (~187 tokens)

Analyze raw email headers

Re-verify SPF, DKIM, DMARC, and ARC from a raw RFC 5322 email (full message or just the headers block). Returns InboxGuard's independent verdict (`ours`), the sender's own Authentication-Results (`theirs`), whether they `agree`, and parsed envelope/headers — useful for spotting forged or mismatched auth results. No account needed.

Input parameters:

- `helo` (string): Optional: the SMTP HELO/EHLO domain.
- `mailFrom` (string): Optional: the envelope MAIL FROM (return-path) address.
- `message` (string, required): The raw email — full RFC 5322 message, or at least the headers block (Received, Authentication-Results, DKIM-Signature, From, …).
- `senderIp` (string): Optional: connecting IP to evaluate SPF against (overrides the IP parsed from Received headers).

### `scan_domains_batch` (~107 tokens)

Batch-scan domains (async)

Queue an asynchronous batch scan of up to 50 domains and get a jobId immediately (avoids the 30s per-call limit). Poll get_scan_job with the jobId until status is succeeded/partial/failed to read per-domain scores. Requires an API key with write or full scope. These scans are NOT added to monitoring or saved to history.

Input parameters:

- `domains` (array, required): 1-50 domains to scan, e.g. ["example.com","acme.com"].

### `get_scan_job` (~69 tokens)

Get batch-scan job

Poll an async batch scan started with scan_domains_batch: returns status (queued/running/succeeded/partial/failed), completed count, and per-domain results (domain, ok, score, grade) as they finish.

Input parameters:

- `jobId` (string, required): The jobId returned by scan_domains_batch.

### `remove_domain` (~84 tokens)

Remove a monitored domain

Stop monitoring a domain and delete it (and its scan history) from the account. DESTRUCTIVE and not reversible. Requires an owner/admin API key with write or full scope. (To ADD a domain, run scan_domain with this API key — authenticated scans auto-track the domain.)

Input parameters:

- `domain` (string, required): Domain name tracked in the account, e.g. example.com.

### `list_registrar_connections` (~73 tokens)

List registrar connections

List the registrar accounts (Cloudflare, Route 53, GoDaddy, Namecheap) connected to the org — provider, verification, last-used time — plus the supported providers. Use this to check whether the detect-and-fix loop (get_dns_fix_plan / apply_dns_fix) is available before attempting it.

### `create_notification_channel` (~152 tokens)

Create a notification channel

Create a channel that InboxGuard alerts are delivered to: webhook (HMAC-signed), Slack, Microsoft Teams, PagerDuty, SMS, or email. Returns the channel id, and for kind=webhook the `signing_secret` used to verify deliveries. Requires an owner/admin API key with write or full scope.

Input parameters:

- `displayName` (string): Optional label for the channel.
- `kind` (string, required): Channel type.
- `severityFilter` (array): Which alert severities to deliver (default ["critical","warn"]).
- `target` (string, required): Destination matching `kind`: the webhook/Slack/Teams URL, PagerDuty integration key, phone number (E.164), or email address.

### `create_share_link` (~97 tokens)

Create a public share link

Create a read-only public share link for a tracked domain's latest report (anyone with the URL can view it; no account). Returns a `token` and the public `url` (https://inboxguard.io/r/<token>). Requires an owner/admin API key with write or full scope, on a plan that includes public reports.

Input parameters:

- `domain` (string, required): Domain name tracked in the account, e.g. example.com.

### `connect_snds` (~129 tokens)

Connect Microsoft SNDS

Store this org's Microsoft SNDS (Smart Network Data Services) automated-data-access key so InboxGuard syncs per-IP Outlook/Hotmail reputation daily. Get the key from the SNDS Automated Data Access page (https://sendersupport.olc.protection.outlook.com/snds/). Requires an owner/admin API key with write or full scope. Data appears within ~24h of the first sync.

Input parameters:

- `key` (string, required): The SNDS access key from the SNDS Automated Data Access page.
- `label` (string): Optional label, e.g. "prod sending IPs".

### `get_snds_status` (~62 tokens)

Get Microsoft SNDS status

Report whether Microsoft SNDS is connected for the org, the last sync time + status, how many sending IPs are tracked, and how many are currently blocked by Outlook/Hotmail. Use before get_snds_ip_stats to confirm the integration is live.

### `get_snds_ip_stats` (~72 tokens)

Get Microsoft SNDS per-IP stats

Return the latest per-IP reputation from Microsoft SNDS for the org's sending IPs: filter result (GREEN/YELLOW/RED), complaint-rate band, spam-trap hits, message volume, and current block status. Requires SNDS to be connected (see connect_snds / get_snds_status).

### `connect_inbox_placement` (~104 tokens)

Connect an inbox-placement provider

Store the org's seed-list inbox-placement provider + API key (provider: 'mailreach' or 'glockapps'; GlockApps also needs projectId). Enables start_inbox_placement_test. Requires an owner/admin API key with write or full scope.

Input parameters:

- `apiKey` (string, required): The vendor API key.
- `projectId` (string): GlockApps project id (required for provider=glockapps).
- `provider` (string, required): Inbox-placement vendor.

### `get_inbox_placement_status` (~44 tokens)

Get inbox-placement status

Report whether a seed-list inbox-placement provider is connected for the org, which provider, and how many tests have run. Lists the supported providers when not connected.

### `start_inbox_placement_test` (~102 tokens)

Start an inbox-placement test

Start a seed-list inbox-placement test. Returns a testId, the seed addresses to mail your campaign to, and (if the provider requires it) a header to insert. After sending to the seeds, poll get_inbox_placement_test for the Inbox/Spam/Missing verdict. Requires inbox-placement to be connected and an owner/admin API key with write or full scope.

Input parameters:

- `subject` (string): Optional subject line to associate with the test.

### `get_inbox_placement_test` (~89 tokens)

Get an inbox-placement test

Poll a seed-list inbox-placement test by testId. Returns status (running/completed/failed) and, once measured, the Inbox/Spam/Missing counts and inbox-placement score (0–100). Call after sending your campaign to the seed addresses from start_inbox_placement_test.

Input parameters:

- `testId` (string, required): The testId returned by start_inbox_placement_test.

### `list_inbox_placement_tests` (~38 tokens)

List inbox-placement tests

List recent seed-list inbox-placement tests for the org (most recent first) with their status and Inbox/Spam/Missing scores.

### `get_deliverability_report` (~114 tokens)

Get a deliverability report

Return a structured deliverability report for a tracked domain: the latest score + letter grade, each check's status (pass/warn/fail), the top issues to fix, blocklist count, and DMARC policy. Includes `pdfUrl` — the same auth-gated endpoint that returns a branded one-page PDF (send your bearer token). Use this to summarize a domain's posture or hand a client a report.

Input parameters:

- `domain` (string, required): Domain name tracked in the account, e.g. example.com.

### `get_portfolio` (~85 tokens)

Get the domain portfolio rollup

Org-wide deliverability rollup across every monitored domain: average score + overall grade, the grade distribution (how many domains are A/B/C/D/F/unscored), total open alerts, the domains needing attention (lowest score / open alerts first), and a per-client-group breakdown. Use this for an at-a-glance portfolio health summary across an agency or multi-domain account.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-inboxguard-email-deliverability/mcp#diagnostics

## Score history

- 2026-08-03: 78
- 2026-08-02: 77
- 2026-08-01: 77
- 2026-07-31: 76
- 2026-07-30: 73
- 2026-07-29: 74
- 2026-07-28: 73
- 2026-07-27: 73
- 2026-07-26: 72

## Links

- Remote endpoint: https://mcp.inboxguard.io/mcp
- Changelog RSS feed: https://verifymcp.io/servers/io-inboxguard-email-deliverability/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-inboxguard-email-deliverability/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/io-inboxguard-email-deliverability/mcp