Sendermap MCP server

Sendermap

<!-- mcp-name: io.github.marmot7775/sendermap -->

Type a domain, see every service that sends email as it, and the public evidence for each one.

Status: early release (0.1.1). The command-line tool works; the website is not hosted yet. Needs Python 3.12 or later.

What it shows

For any domain, Sendermap builds a map of the services that send or receive its mail: mailbox providers, marketing and transactional platforms, support desks, security gateways and the services that receive its reports. Each one comes with:

CNAME, verification token or report address that gave it away.

• The evidence, record by record: the SPF include, MX host, DKIM key, bounce or tracking

• How sure we are, in words, not a percentage:
• In use: mail for the domain is delivered there.
• Configured: set up to send as the domain.
• Likely: a signing key whose name points at the service.
• Account only: a trace of an account with nothing set up to send.

It looks beyond the main domain: brands often send from subdomains such as email., mg. or bounce., which a check of the main domain never sees. It also points out what needs attention: DKIM records that point at names that no longer exist, SPF records past the 10 lookup limit, revoked keys, and senders nobody can name. Raw IP ranges nobody can name are grouped by the network that announces them, so a dozen ranges from one provider read as one line.

Each DKIM key is shown with the tags that change what it does: t=y (testing, so verifiers treat mail signed with it as unsigned), t=s (strict), h= (hash algorithms), s= (service types) and k= (key type). A tag that weakens the key, such as testing mode or SHA-1 only, is raised as a finding. Each key also gets a fingerprint, fp and 16 hex characters, so the same key published at two selectors is easy to spot, and the map points it out when it is.

Checked and not there

The map also lists what it looked for and did not find, with the DNS answers that show it. Today that covers DKIM keys. Whether "not there" can be trusted depends on how the domain's DNS answers for a name that does not exist, so at each name Sendermap first asks for a selector nobody publishes and reads the answer as one of four classes:

not exist, no selector exists under it. The map checks only the few names the domain's SPF and MX point to, rather than its full list, and says so. If _domainkey exists but every name asked is missing, the map says selectors exist but none of the names it tried is one.

• Classic: the zone says "no such name". Answers can be trusted. If _domainkey itself does

the answer says nothing about what exists. The map asks its full list and claims no absence.

• None by rcode: the zone gives an empty answer for every missing name (compact denial), so

list.

• Wildcard: every name answers. The map ignores what the wildcard repeats and asks its full

checked.

• Unknown: the test lookup failed, so nothing is read from it, and the map lists it as not

How it works

Everything comes from public sources: DNS, certificate transparency logs, the domain's own website, and public records of who owns each network. Each finding is shown with the record that supports it, so you can check it yourself.

Shortened. The full README is on GitHub.