About SecLens.ONE Email Security
SecLens.ONE Email Security assesses a domain's public email-security configuration, including SPF, DMARC, DKIM, and related protocols. It is available as a Go CLI and an anonymous remote MCP server, and does not send email.
Key features
- 01Assess email security protocols
- 02Detect null-MX domains
- 03Bulk assessment with bounded concurrency
- 04Text, JSON, and JSONL output
- 05BIMI informational checks
Use cases
- 01Review a domain's email-security posture
- 02Assess lists of domains in bulk
- 03Export assessment results as JSONL
MCP support
The anonymous Streamable HTTP server at https://seclens.one/mcp exposes get_result, assess_domain, and get_summary tools to MCP clients.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://seclens.one/mcpclaude mcp add --transport http one-seclens-seclens https://seclens.one/mcp{"mcpServers":{"one-seclens-seclens":{"type":"http","url":"https://seclens.one/mcp"}}}Open in Cursor{"servers":{"one-seclens-seclens":{"type":"http","url":"https://seclens.one/mcp"}}}Open in VS Code{"mcpServers":{"one-seclens-seclens":{"type":"http","url":"https://seclens.one/mcp"}}}{"mcpServers":{"one-seclens-seclens":{"serverUrl":"https://seclens.one/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
Details
From the project READMESecLens.ONE email security assessor
Standalone Go CLI for the public email-security checks on SecLens.ONE.
Scored protocols are SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DANE, and DNSSEC. BIMI is informational and does not change the score. The assessor uses passive DNS and one HTTPS GET to the MTA-STS policy endpoint. It does not send mail.
Protocol logic lives in internal/assessor/rfc*/ packages. Thin bridge files wire DNS lookups and scoring.
Source is https://github.com/42Sec-Pte-Ltd/seclens.
Checks
- SPF (RFC 7208). Presence, qualifiers, lookup limits, and common misconfiguration hints.
- DMARC (RFC 7489). Policy, reporting tags, and enforcement.
- DKIM (RFC 6376). Common selector discovery.
- MTA-STS (RFC 8461). DNS advertisement, one HTTPS GET of the policy, and MX matching.
- TLS-RPT (RFC 8460).
_smtp._tlsadvertisement and reporting URIs. - DANE (RFC 7672). TLSA records for discovered MX hosts.
- DNSSEC (RFC 4034 and RFC 4035). DS presence and the DoH AD-bit signal.
- BIMI. Informational only. It does not change the score.
- Null MX (RFC 7505). Detects domains that do not receive mail.
Bulk assessment uses bounded concurrency. Output is text, JSON, or JSONL. JSON DoH resolvers default to Cloudflare. Google and Quad9 are supported.
MCP Server
Anonymous Streamable HTTP at https://seclens.one/mcp.
Tools are get_result, assess_domain, and get_summary.
Cursor 1-Click Install opens Add SecLens.ONE.
mcp.json:
{
"mcpServers": {
"seclens": {
"type": "http",
"url": "https://seclens.one/mcp"
}
}
}
Dependencies
Core DNS and HTTP use the Go standard library. One module dependency handles internationalized domain names.
golang.org/x/net/idnahandles punycode and IDNA for MTA-STS MX host matching.
Run go list -m all after go mod download to inspect the module graph.
Build
go build -o seclens ./cmd/seclens
Assess
./seclens assess cloudflare.com
./seclens assess --format jsonl example.com google.com
cat domains.txt | ./seclens assess --stdin --concurrency 12 --format jsonl > results.jsonl
./seclens assess --file domains.txt --resolver google,cloudflare
Resolver flag values are cloudflare, google, and quad9. Separate a pool with commas.
Tests
go test ./...
Research
The CLI measures the same controls as the SecLens Top-1M studies:
License
Licensed under the Apache License, Version 2.0.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.