Email deliverability & security, from the terminal

SPF, DKIM, DMARC, MTA-STS, BIMI and TLS-RPT in one pass. Active SMTP and IMAP/POP probes, open-relay and TLS posture, DNSBL reputation, and provider profiles for Google Workspace, Microsoft 365 and more. Single Go binary. JSON / YAML / Prometheus / OTLP. CI-friendly exit codes.

View on GitHub → Quick install

What it looks like

One check across the whole mail posture. Exit non-zero when a hard failure — a broken policy, an open relay, expired TLS — is found.

mailops check

$ mailops check example.com --profile google-workspace

check                       result
──────────────────────────────────────────────────────────
MX                          2 hosts                     ok
SPF                         1 record · 7 lookups        ok
DKIM  (google)              2048-bit RSA                ok
DMARC                       p=reject · pct=100          ok
MTA-STS                     enforce · MX covered        ok
TLS-RPT                     present                     ok
BIMI                        not published               warn
PTR / FCrDNS                2/2 confirmed               ok
DNSBL (MX IPs)              0/8 listed                  ok

[2026-05-24 15:51:02] 8 ok · 1 warning · 0 critical ✓

$ echo $?
0

What it checks

One check subcommand, the whole mail surface. Read-only by design — no mail is sent, no mailboxes are read, no credentials are used. Just inspection.

SPF

Presence, multiple-record detection, all policy (~all / -all) warnings, and an estimated DNS-lookup count after include / redirect expansion so you catch the 10-lookup limit before mail starts failing.

DKIM

Selector discovery across common and provider selectors, plus public-key parsing and key-size reporting. Add your own with repeated --selector.

DMARC

Presence, policy (none / quarantine / reject), pct, report destinations (rua / ruf), and external-report authorization hints when reports go to another domain.

MTA-STS & TLS-RPT

MTA-STS TXT and the HTTPS policy file, plus MX-coverage: whether your real MX hosts actually match the policy mx: patterns. TLS-RPT record presence for reporting.

BIMI

Record syntax, HTTPS SVG/SVGZ logo and authority-evidence (VMC) URIs, explicit publication decline, duplicate records, and DMARC-enforcement compatibility including pct=100.

SMTP probes

--smtp connects to MX or submission hosts: banner, EHLO, STARTTLS on 25/587, implicit TLS on 465, negotiated TLS version and cert expiry, advertised AUTH mechanisms, and an unauthenticated open-relay RCPT probe that never sends DATA.

Mailbox (MDA) probes

--mda checks IMAP 143, IMAPS 993, POP3 110, POP3S 995: TCP connect, banner/capabilities, STARTTLS/STLS, TLS version and cert expiry. Availability and TLS posture only — no login, no mailbox reads.

Reputation & RBL

DNSBL checks for MX IPv4 addresses out of the box, plus optional domain reputation through DBL / SURBL / URIBL-style zones with --reputation. Public-zone 127.0.0.1 rate-limit answers are treated as errors, not false listings.

Provider profiles

--profile pre-fills the right DKIM selectors and endpoints for google-workspace, microsoft-365, amazonses, sendgrid, mailgun, postmark, zoho and more. Explicit flags always win over the profile.

JSON · YAML · Prom · OTLP

--json / --yaml / --prom for pipelines and dashboards, plus --otel-endpoint to POST OTLP/HTTP metrics straight to your collector. --fail-on and --strict tune exactly which findings break the build.

Quick install

Linux, macOS, BSD. Single Go binary, no external services. Go 1.22+.

$ git clone https://github.com/systeampl/mailops.git
$ cd mailops
$ go build -trimpath -o mailops .
$ sudo install -m 0755 mailops /usr/local/bin/mailops

$ mailops check example.com                       # full posture check
$ mailops check example.com --profile microsoft-365 # with a provider profile
$ mailops check example.com --smtp --mda           # add active SMTP + mailbox probes
$ mailops check example.com --json                 # machine-readable output

Full README on GitHub →