Guide to the CredMail CLI

Quick start

The fastest way to check a domain, no installation required (needs Node.js 18+):

npx credmail check example.com

You'll get a terminal-friendly report with an overall health score, a PASS/WARN/FAIL status for every check, and exact DNS record values you can act on. See Example output below.

Install

The CLI is published to npm as credmail. Requires Node.js 18+. Run it directly without installing:

npx credmail check example.com

Or install globally:

npm install -g credmail
credmail check example.com

Usage

Usage: credmail check <domain>

Run a full domain health check.

Options:
  --help, -h       Show help
  --version, -v    Show version

Examples:
  credmail check credmail.com
  npx credmail check example.com

The CLI accepts a bare domain (example.com). URLs, www. prefixes, and paths are stripped automatically (https://www.example.com/blog is treated as example.com). No API key or account is required.

What's checked

Each check produces a PASS, WARN, or FAIL status:

• SPF — record present, all mechanism, policy strictness
• DKIM — signing key at a common selector._domainkey record
• DMARC — policy record, enforcement policy, aggregate report address
• MX records — mail exchange records and priorities
• BIMI — record and HTTPS logo
• MTA-STS — DNS record and policy file
• TLS-RPT — reporting record and report URI
• Blacklists — 107 DNS-based blacklists with delisting URLs
• Reputation — estimated score across Gmail, Outlook, and Yahoo
• WHOIS — registrar, dates, nameservers
• DNS propagation — cross-resolver consistency

Example output

$ npx credmail check credmail.com

  Domain Health Report  —  credmail.com
  ────────────────────────────────────────────────────────────
  Running checks... done (18.1s)

  Overall Score  44/100  Poor
  █████████░░░░░░░░░░░░

  ⚠  SPF  WARN
     Record Present: Yes
     All Mechanism: ~all
     Includes: _spf.porkbun.com
     → Your SPF uses a softfail (~all). Consider using -all instead for stronger protection against spoofing.

  ✓  DKIM  PASS
     Found: Yes
     Selector: resend

  ⚠  DMARC  WARN
     Present: Yes
     Policy: none
     → Your DMARC policy is set to 'none', which only monitors. Upgrade to 'quarantine' or 'reject' once you've verified your reports.

  ✓  MX Records  PASS
     Count: 2
     MX Records:
       10  fwd1.porkbun.com
       20  fwd2.porkbun.com

  ✗  BIMI  FAIL
     Present: No
     → No BIMI record found. Add BIMI to display your brand logo in supported email clients.

  ✗  MTA-STS  FAIL
     Dns Present: No
     → No MTA-STS DNS record found. Add MTA-STS to enforce TLS encryption for inbound email.

  ✗  TLS-RPT  FAIL
     Present: No
     → No TLS-RPT record found. Add TLS-RPT to receive daily reports about TLS connectivity issues on your domain.

  ✓  Blacklists  PASS  (0/107 listed)
     ✓ Clean on all 107 blacklists

  ✓  WHOIS  PASS
     Registrar: Porkbun LLC
     Expires: 2027-09-06T18:30:18Z
     Created: 2024-09-06T18:30:18Z

  ────────────────────────────────────────────────────────────
  Checked at 2026-08-11T09:06:44.990Z

What the CLI doesn't do

The CLI covers the free, public domain health check only. For everything else, use the full web app:

• Email verification — single and bulk address verification with deliverability scoring and list hygiene
• AI agents — Fix, Verification, Pre-Ship, and Warmup agents that analyze your reports and write step-by-step remediation plans
• Saved history & reports — account-based report history, saved reports, and trend tracking
• Tools suite — record generators, SPF flattening, DMARC simulator, and header analyzer

Open the full web app

Exit codes

• 0 — check completed (regardless of score)
• 1 — invalid domain, unknown command, or unexpected error

The CLI shares its check logic with the website, so results are identical to credmail.com/check.