Fix SPF, DKIM and DMARC with an AI coding agent

Published 1 September 2026 · Updated 1 September 2026 · by Ben Clemens

DNS fixes for email authentication are small, exact and easy to get subtly wrong: a second SPF record, a DMARC jump straight to reject, a deleted include that a payroll system depended on. That makes them a good job for a coding agent, provided the agent is working from measured facts and a plan with guardrails, not from memory. This guide is the workflow we use ourselves.

1. Get the plan from a measurement, not from the agent

Run the domain through the checker. Every report ends with a "Fix this with your AI agent" panel. The prompt inside is generated from the records exactly as published: SPF, DMARC and every DKIM selector found, the mail provider from the MX records, and the DNS host from the nameservers. It lists the tasks in order of impact with the exact record name, type and value to publish, provider steps, and the commands to verify. Copy it, open it in Claude or ChatGPT with one click, or point an agent at /check/yourdomain.com/fix.md.

2. Give the agent access, narrowly

The agent needs to read and write records in one DNS zone, and sometimes to open the mail provider's admin console for DKIM. Use a scoped token: a Cloudflare API token limited to DNS edit on that zone, an IAM role limited to one Route 53 hosted zone, or a Vercel token for that domain. Never hand over a registrar login.

3. Make it show the diff first

The generated prompt already says "show the planned DNS changes as a diff before applying." Hold the agent to it. You are looking for four things: exactly one SPF record after the change; no include or ip4 removed that you cannot name the sender for; DMARC moving one step at a time (none → quarantine at pct=25 → pct=100 → reject); and DKIM records that match what the provider's console shows, not what the agent guessed.

4. Let it verify, then verify yourself

The plan ends with dig commands and a re-check link. Run the re-check. The grade should move to the target and the "Fix these" list should shrink. If a task is DKIM, send yourself one message and read the Authentication-Results header for dkim=pass with your domain.

5. Close the loop

Records drift. Put the domain under monitoring and the daily re-check becomes the regression test for your agent's change: the next alert email carries the top fix inline and a link to a fresh plan for the new state, and on the Agency plan your agent can call the MCP server directly to fix it again.

What the agent must never do

• Publish a second v=spf1 record. Receivers treat two as none.
• "Clean up" includes it does not recognise.
• Set p=reject in one step on a domain that has never been at quarantine.
• Flatten SPF to IP addresses without something re-flattening it when the vendor's ranges change.

Try it on your own domain: