senderkit-email-deliverability — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited senderkit-email-deliverability (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this open-source skill to get authenticated, inbox-landing transactional email. It diagnoses a sending domain's authentication, generates the exact DNS records to fix it, and verifies the result — using standard tools (dig/nslookup) that need no install, signup, or API key. The reusable source lives at https://github.com/senderkit/senderkit-skills in the skills/senderkit-email-deliverability/ directory; the skill name remains senderkit-email-deliverability.
Email authentication is required whether the app sends directly via SenderKit or routes through a provider (Resend, SendGrid, Postmark, Mailgun, SES, SMTP). This skill is provider-agnostic: it reads and fixes the DNS that controls inbox placement.
This skill does not change application code and does not edit DNS — it inspects DNS, produces records for the user to apply at their DNS host, and re-checks them. To wire sends into the codebase (From domain, headers) use senderkit-integration. To send a live test message and confirm placement use senderkit-mcp-messaging-operations.
From domain mail is (or will be) sent from, e.g. mail.example.com or example.com.references/spf-dkim-dmarc.md for syntax and limits, then query:dig +short TXT <domain> — flag a missing record, more than one v=spf1 record, syntax errors, and the 10-DNS-lookup limit.dig +short TXT <selector>._domainkey.<domain> — confirm the selector is published with a p= public key.dig +short TXT _dmarc.<domain> — confirm presence and policy strength (p=none vs quarantine/reject) and reporting (rua).dig +short MX <domain> — sanity check.MAIL FROM/Return-Path) and DKIM (d=) align with the visible From domain.p=none for monitoring, then escalating).v=spf1 record; merge includes into the existing one.dig queries from step 2 to confirm publication. Set expectations: DNS propagation is eventually-consistent (minutes to hours); offer a re-check rather than asserting instant success.senderkit-mcp-messaging-operations to send a live test and confirm inbox placement and that headers pass SPF/DKIM/DMARC.senderkit-integration).From domain matches the authenticated domain.List-Unsubscribe and List-Unsubscribe-Post headers are present on bulk-ish transactional mail.senderkit-integration.When a symptom is reported ("going to spam", "not arriving", "bouncing"), read references/troubleshooting.md and map symptom → cause → fix before changing records.
references/spf-dkim-dmarc.md - SPF/DKIM/DMARC concepts, record syntax, the 10-lookup limit, alignment, and a BIMI note.references/dns-provider-notes.md - Where and how to add TXT records on common DNS hosts.references/troubleshooting.md - Symptom → likely cause → fix for spam folder, bounces, and non-delivery.references/sources.md - Source notes used to build this skill.p=none with rua reporting, then escalating to quarantine/reject after monitoring.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.