@sendinel/mcp-server 1.0.166 → 1.0.167

package/build/lib/domain-health.d.ts

@@ -0,0 +1,18 @@
+interface StoredHealth {
+    spf_valid?: boolean | null;
+    dkim_valid?: boolean | null;
+    dmarc_valid?: boolean | null;
+    check_date?: string | null;
+}
+/** DNS observations come only from domain_health, never inferred from registration status. */
+export declare function storedDomainDns(health?: StoredHealth | null): {
+    spf: boolean | null;
+    dkim: boolean | null;
+    dmarc: boolean | null;
+    all_verified: boolean | null;
+    verification_source: 'stored_domain_health';
+    checked_at: string | null;
+};
+export declare function readLatestStoredDomainHealth(domainId: string): any;
+export declare function storedDnsReasons(dns: ReturnType<typeof storedDomainDns>): string[];
+export {};

package/build/lib/domain-health.js

@@ -0,0 +1,34 @@
+import { db } from '../db.js';
+import { getProjectId } from '../project.js';
+/** DNS observations come only from domain_health, never inferred from registration status. */
+export function storedDomainDns(health) {
+    const spf = health?.spf_valid ?? null;
+    const dkim = health?.dkim_valid ?? null;
+    const dmarc = health?.dmarc_valid ?? null;
+    return {
+        spf, dkim, dmarc,
+        all_verified: [spf, dkim, dmarc].every(value => typeof value === 'boolean') ? Boolean(spf && dkim && dmarc) : null,
+        verification_source: 'stored_domain_health',
+        checked_at: health?.check_date ?? null,
+    };
+}
+export function readLatestStoredDomainHealth(domainId) {
+    return db().schema('email').from('domain_health')
+        .select('spf_valid, dkim_valid, dmarc_valid, check_date, sites!inner(domain_id)')
+        .eq('sites.project_id', getProjectId()).eq('sites.domain_id', domainId)
+        .order('check_date', { ascending: false }).order('created_at', { ascending: false }).order('id', { ascending: false })
+        .limit(1).maybeSingle();
+}
+export function storedDnsReasons(dns) {
+    const reasons = [];
+    if (dns.spf === false)
+        reasons.push('SPF record missing');
+    if (dns.dkim === false)
+        reasons.push('DKIM not configured');
+    if (dns.dmarc === false)
+        reasons.push('DMARC record missing');
+    if ([dns.spf, dns.dkim, dns.dmarc].some(value => value === null)) {
+        reasons.push('DNS authentication has not been checked in stored domain health');
+    }
+    return reasons;
+}

package/build/tools/analytics.js

@@ -6,9 +6,9 @@ import { z } from 'zod';
 import { db, adminDb, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { resolveProjectClient } from '../byod-client.js';
-import { decrypt } from '../crypto.js';
 import { logAudit } from '../audit.js';
 import { dbToolError, toolError } from '../lib/db-error.js';
+import { storedDomainDns, storedDnsReasons } from '../lib/domain-health.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 const percent = (rate) => `${(rate * 100).toFixed(1)}%`;
@@ -579,21 +579,22 @@ export function registerAnalyticsTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'SPF/DKIM/DMARC status and warmup progress for a site',
+        description: 'Stored domain_health SPF/DKIM/DMARC history and warmup progress for a site. Each row adds a DNS summary with verification_source and checked_at; null means unchecked, never verified.',
         inputSchema: {
             site_id: z.string().uuid().describe('Site UUID'),
             days: z.number().int().min(1).max(90).optional().describe('Recent days to return, default 7'),
         },
     }, async ({ site_id, days = 7 }) => {
-        const { data, error } = await db()
+        const { data, error } = await db().schema('email')
             .from('domain_health')
-            .select('*')
+            .select('*, sites!inner(project_id)')
             .eq('site_id', site_id)
-            .order('check_date', { ascending: false })
+            .eq('sites.project_id', getProjectId())
+            .order('check_date', { ascending: false }).order('created_at', { ascending: false }).order('id', { ascending: false })
             .limit(days);
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
-        return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+            return toolError(dbToolError(error, 'Unable to load domain health'));
+        return j((data ?? []).map(({ sites: _sites, ...row }) => ({ ...row, dns: storedDomainDns(row) })));
     });
     server.registerTool('get_engagement_insights', {
         title: 'Get Engagement Insights',
@@ -700,9 +701,9 @@ export function registerAnalyticsTools(server) {
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: true,
-            openWorldHint: true,
+            openWorldHint: false,
         },
-        description: 'Run a deliverability check for a site: DNS records (SPF/DKIM/DMARC), warmup status, bounce/complaint rates, and risk assessment',
+        description: 'Read stored domain_health DNS observations (SPF/DKIM/DMARC), warmup status, bounce/complaint rates and risk assessment. Uses the same DNS source as refresh_domain_dns, get_domain_health and list_domains; null means unchecked. No live provider or DNS calls.',
         inputSchema: {
             site_id: z.string().uuid(),
         },
@@ -717,95 +718,25 @@ export function registerAnalyticsTools(server) {
         if (siteErr || !site)
             return txt(`Error: Site not found — ${(siteErr ? dbToolError(siteErr).error : undefined) ?? 'not found'}`);
         const domain = site.sending_domain;
-        const dnsResults = { spf: null, dkim: null, dmarc: null };
-        let verificationSource = 'dns_lookup';
-        let resendDomainStatus = null;
-        // Try Resend domain verification API first — avoids false negatives from
-        // raw DNS lookups (Resend uses varying DKIM selectors per domain vintage).
-        try {
-            // Resolve Resend API key: site key → project key → env
-            let apiKey = null;
-            const { data: siteRow } = await adminDb()
-                .from('sites')
-                .select('provider_api_key_enc')
-                .eq('id', site_id)
-                .eq('project_id', projectId)
-                .maybeSingle();
-            if (siteRow?.provider_api_key_enc) {
-                apiKey = decrypt(siteRow.provider_api_key_enc);
-            }
-            else {
-                const { data: projRow } = await adminDb()
-                    .from('projects')
-                    .select('provider_api_key_enc')
-                    .eq('id', projectId)
-                    .maybeSingle();
-                if (projRow?.provider_api_key_enc) {
-                    apiKey = decrypt(projRow.provider_api_key_enc);
-                }
-                else if (process.env.RESEND_API_KEY) {
-                    apiKey = process.env.RESEND_API_KEY;
-                }
-            }
-            if (apiKey) {
-                const { Resend } = await import('resend');
-                const resend = new Resend(apiKey);
-                const { data: domainList } = await resend.domains.list();
-                const domains = domainList?.data ?? [];
-                const match = domains.find((d) => d.name === domain);
-                if (match) {
-                    resendDomainStatus = match.status;
-                    if (match.status === 'verified') {
-                        verificationSource = 'resend_api';
-                        dnsResults.spf = { found: true, verified_by: 'resend_api', note: 'Resend handles SPF authentication at infrastructure level' };
-                        dnsResults.dkim = { found: true, verified_by: 'resend_api', note: 'DKIM signing managed by Resend (selector may vary)' };
-                        dnsResults.dmarc = { found: true, verified_by: 'resend_api', note: 'Domain verified by Resend — DMARC alignment confirmed' };
-                    }
-                }
-            }
-        }
-        catch {
-            // Resend API unavailable or key missing — fall back to DNS lookup
-        }
-        // Fall back to raw DNS checks if Resend API didn't confirm verification
-        if (verificationSource === 'dns_lookup') {
-            try {
-                const dns = await import('dns/promises');
-                try {
-                    const txtRecords = await dns.resolveTxt(domain);
-                    const spfRecord = txtRecords.flat().find((r) => r.startsWith('v=spf1'));
-                    dnsResults.spf = { found: !!spfRecord, record: spfRecord ?? null, includes_resend: spfRecord?.includes('include:amazonses.com') || spfRecord?.includes('include:_spf.resend.com') || false };
-                }
-                catch {
-                    dnsResults.spf = { found: false, error: 'No SPF record found' };
-                }
-                try {
-                    const dmarcRecords = await dns.resolveTxt(`_dmarc.${domain}`);
-                    const dmarcRecord = dmarcRecords.flat().find((r) => r.startsWith('v=DMARC1'));
-                    const policy = dmarcRecord?.match(/p=(\w+)/)?.[1] ?? 'unknown';
-                    dnsResults.dmarc = { found: !!dmarcRecord, record: dmarcRecord ?? null, policy, strict: policy === 'quarantine' || policy === 'reject' };
-                }
-                catch {
-                    dnsResults.dmarc = { found: false, error: 'No DMARC record found' };
-                }
-                try {
-                    const cnames = await dns.resolveCname(`resend._domainkey.${domain}`);
-                    dnsResults.dkim = { found: cnames.length > 0, cname: cnames[0] ?? null };
-                }
-                catch {
-                    dnsResults.dkim = { found: false, error: 'No DKIM CNAME found for resend._domainkey' };
-                }
-            }
-            catch { /* dns module unavailable */ }
-        }
-        const { data: healthRows } = await db()
+        const { data: healthRows, error: healthError } = await db().schema('email')
             .from('domain_health')
-            .select('*')
+            .select('*, sites!inner(project_id)')
             .eq('site_id', site_id)
+            .eq('sites.project_id', projectId)
             .order('check_date', { ascending: false })
+            .order('created_at', { ascending: false }).order('id', { ascending: false })
             .limit(14);
+        if (healthError)
+            return toolError(dbToolError(healthError, 'Unable to load domain health'));
         const health = healthRows ?? [];
         const latest = health[0];
+        const storedDns = storedDomainDns(latest);
+        const verificationSource = storedDns.verification_source;
+        const dnsResults = {
+            spf: { found: storedDns.spf, verified_by: storedDns.spf === true ? verificationSource : null, record: null, includes_resend: null, error: null, note: 'Stored SPF observation; raw DNS was not queried.' },
+            dkim: { found: storedDns.dkim, verified_by: storedDns.dkim === true ? verificationSource : null, cname: null, error: null, note: 'Stored DKIM observation; raw DNS was not queried.' },
+            dmarc: { found: storedDns.dmarc, verified_by: storedDns.dmarc === true ? verificationSource : null, record: null, policy: null, strict: null, error: null, note: 'Stored DMARC observation; raw DNS was not queried.' },
+        };
         const warmupDay = latest?.warmup_day ?? null;
         const warmupLimit = latest?.warmup_daily_limit ?? null;
         const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString();
@@ -821,18 +752,7 @@ export function registerAnalyticsTools(server) {
         const complained = logs.filter(isComplainedRow).length;
         const bounceRate = percentRate(bounced, totalSent, 8) ?? 0;
         const complaintRate = percentRate(complained, totalSent, 8) ?? 0;
-        const risks = [];
-        if (verificationSource === 'dns_lookup') {
-            if (!dnsResults.spf?.found)
-                risks.push('SPF record missing');
-            if (!dnsResults.dkim?.found)
-                risks.push('DKIM not configured');
-            if (!dnsResults.dmarc?.found)
-                risks.push('DMARC record missing');
-        }
-        if (resendDomainStatus && resendDomainStatus !== 'verified') {
-            risks.push(`Resend domain status is '${resendDomainStatus}' — domain verification incomplete`);
-        }
+        const risks = storedDnsReasons(storedDns);
         if (bounceRate > 5)
             risks.push(`HIGH bounce rate: ${bounceRate.toFixed(1)}%`);
         else if (bounceRate > 2)
@@ -846,7 +766,8 @@ export function registerAnalyticsTools(server) {
         return j({
             site: { slug: site.slug, domain, from_email: site.from_email },
             verification_source: verificationSource,
-            resend_domain_status: resendDomainStatus,
+            resend_domain_status: null, // Retained for compatibility; no live Resend query is made.
+            checked_at: storedDns.checked_at,
             dns: dnsResults,
             warmup: { day: warmupDay, daily_limit: warmupLimit, completed: warmupDay ? warmupDay >= 43 : null },
             recent_7d: { total_sent: totalSent, bounced, complained, bounce_rate: `${bounceRate.toFixed(2)}%`, complaint_rate: `${complaintRate.toFixed(3)}%` },

package/build/tools/campaigns.js

@@ -190,27 +190,30 @@ async function campaignTimezoneWarnings(campaign) {
     const sendWindow = campaign.send_window ?? (campaign.send_window_inherit !== false ? site?.send_window : null);
     return sendWindow && !validTimezone(site?.timezone) ? [SEND_WINDOW_TIMEZONE_WARNING] : [];
 }
-async function campaignTriggerOutput(campaign) {
-    let seenEvents;
-    const config = normalizeTriggerConfig(campaign.trigger_config);
-    if (normalizeTriggerValue(campaign.trigger_event_name) || config.events.length) {
-        try {
-            // /v1/events -> intakeContactEvent stores event_type=custom and title=event.
-            // Read all pages: a capped sample cannot establish that an event was never seen.
-            const rows = await readAllRows(db().from('contact_events').select('id, title')
-                .eq('project_id', getProjectId()).eq('event_type', 'custom'));
-            seenEvents = new Set(rows.map(row => normalizeTriggerValue(row.title)).filter((value) => value !== null));
-        }
-        catch {
-            seenEvents = null;
-        }
+async function readCampaignTriggerHistory(campaigns) {
+    if (!campaigns.some(campaign => normalizeTriggerValue(campaign.trigger_event_name)
+        || normalizeTriggerConfig(campaign.trigger_config).events.length))
+        return undefined;
+    try {
+        // /v1/events stores event_type=custom and title=event. Read every page once per response.
+        const rows = await readAllRows(db().from('contact_events').select('id, title')
+            .eq('project_id', getProjectId()).eq('event_type', 'custom'));
+        return new Set(rows.map(row => normalizeTriggerValue(row.title)).filter((value) => value !== null));
     }
+    catch {
+        return null;
+    }
+}
+function buildCampaignTriggerOutput(campaign, seenEvents) {
     return {
         trigger_kind: campaignTriggerKind(campaign),
         fires_on: buildCampaignFiresOn(campaign),
         trigger_diagnostics: buildCampaignTriggerDiagnostics(campaign, seenEvents),
     };
 }
+async function campaignTriggerOutput(campaign) {
+    return buildCampaignTriggerOutput(campaign, await readCampaignTriggerHistory([campaign]));
+}
 function applyCampaignSendAtField(updates, sendAt, campaignType) {
     if (sendAt === undefined)
         return null;
@@ -780,14 +783,14 @@ export function registerCampaignTools(server) {
         // counts that cannot exceed total_sent. null = the people-count lookup failed (unknown, not 0).
         const rows = data ?? [];
         const engagement = await countUniqueEngagementByCampaign(db(), getProjectId(), rows.map((row) => row.id));
+        const seenEvents = await readCampaignTriggerHistory(rows);
         const withPeople = await Promise.all(rows.map(async (row) => {
             const periods = await readCampaignPeriods(db(), getProjectId(), row);
             return {
                 ...row,
                 reentry_mode: row.period_key ? "per_event_period" : "once_ever",
                 requires_approval_description: ACTIVATION_APPROVAL_DESCRIPTION,
-                fires_on: buildCampaignFiresOn(row),
-                trigger_diagnostics: buildCampaignTriggerDiagnostics(row),
+                ...buildCampaignTriggerOutput(row, seenEvents),
                 ...campaignPeriodFields(periods, period),
                 total_sent: periods?.totals?.sent ?? (engagement.ok ? engagement.sent.get(row.id) ?? 0 : null),
                 unique_opened: periods?.totals?.opened ?? (engagement.ok ? engagement.opened.get(row.id) ?? 0 : null),
@@ -1734,14 +1737,27 @@ export function registerCampaignTools(server) {
         }
         const copied = new Set(['project_id', 'site_id', 'name', 'type', 'description', 'sends_per_hour', 'requires_approval']);
         const identity = new Set(['id', 'status', 'created_at', 'updated_at', 'campaign_steps']);
+        const configurationFields = [
+            'trigger_type', 'trigger_event_name', 'trigger_tag', 'trigger_config', 'send_class',
+            'period_key', 'reentry_mode', 'campaign_step_branches', 'segment_id',
+            'unsub_footer_template', 'campaign_goals', 'topic', 'send_at', 'send_time', 'timezone',
+            'goal_type', 'goal_value', 'goal_action', 'goal_target_campaign_id',
+        ];
+        // Keep the exhaustive machine-readable inventory, with important settings first.
         const fields_not_copied = [...new Set([
+                ...configurationFields.filter(key => key in original || [
+                    'trigger_type', 'trigger_event_name', 'trigger_tag', 'trigger_config', 'segment_id',
+                    'send_class', 'unsub_footer_template', 'period_key', 'reentry_mode', 'campaign_goals', 'campaign_step_branches',
+                ].includes(key)),
                 ...Object.keys(original).filter(key => !copied.has(key) && !identity.has(key)),
-                'trigger_type', 'trigger_event_name', 'trigger_tag', 'trigger_config', 'segment_id',
-                'send_class', 'unsub_footer_template', 'period_key', 'reentry_mode', 'campaign_goals', 'campaign_step_branches',
             ])];
+        const counters = fields_not_copied.filter(key => /^(?:total_|unique_)|_rate$/.test(key));
+        const warnings = fields_not_copied.filter(key => configurationFields.includes(key)).map(field => `${field} was not copied${field === 'trigger_config' ? ' (including where filters)' : ''}; review and configure the draft before activation.`);
+        if (counters.length)
+            warnings.push(`Counters and reporting statistics are reset for the draft: ${counters.join(', ')}.`);
         await logAudit({ action: 'campaign.cloned', resourceType: 'campaign', resourceId: newCampaign.id, details: { cloned_from: campaign_id, fields_not_copied } });
         return j({ ...newCampaign, steps_copied: steps.length, cloned_from: campaign_id, fields_not_copied,
-            warnings: fields_not_copied.map(field => `${field} was not copied; review and configure the draft before activation.`) });
+            warnings });
     });
     server.registerTool('list_sequence_templates', {
         title: 'List Sequence Templates',
@@ -2446,7 +2462,7 @@ Do not include body_html in your response; Sendinel renders body_html from block
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Preview email through the real send renderer: final campaign/site footer, unsubscribe text and send_class scope, sender and physical address. Uses sample contact data; unresolved_tags lists remaining tags. Provide campaign_id, step_id, draft_id, or raw body_html/subject.',
+        description: 'Preview email through the real send renderer: final campaign/site footer, unsubscribe text and send_class scope, sender and physical address. Uses sample contact data; unresolved_tags lists every remaining {{ opener, including malformed and unclosed tags; supported tags keep key names and malformed tags use literal text. Provide campaign_id, step_id, draft_id, or raw body_html/subject.',
         inputSchema: {
             site_id: z.string().uuid().optional().describe('Site UUID for sender tags and footers'),
             campaign_id: z.string().uuid().optional().describe('Campaign UUID; previews its first step in send order. Use step_id to choose a specific step.'),
@@ -2996,7 +3012,7 @@ Do not include body_html in your response; Sendinel renders body_html from block
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Validate an email template for variable errors and brand voice compliance. Checks for unknown {{variables}}, merge tags with no fallback, placeholder text left from an import ("Not specified in source material"), links to your sending domain, stock phrases, excessive CTAs, and a missing sign-off (only when your brand kit or site sets one). Pass trigger_event_name or event_keys to also check that each merge tag has data behind it.',
+        description: 'Validate an email template for variable errors and brand voice compliance. Checks for unknown {{variables}} in both subject and body as errors, merge tags with no fallback, placeholder text left from an import ("Not specified in source material"), links to your sending domain, stock phrases, excessive CTAs, and a missing sign-off (only when your brand kit or site sets one). Pass trigger_event_name or event_keys to also check that each merge tag has data behind it.',
         inputSchema: {
             html: z.string().describe('HTML email content to validate'),
             site_id: z.string().uuid().optional().describe('Site UUID — uses the site brand voice config for sign-off check'),

package/build/tools/contacts.js

@@ -1711,7 +1711,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'List contacts filtered by engagement score range and/or lifecycle stage. Useful for building re-engagement campaigns or identifying high-value contacts.',
+        description: 'List contacts using a saved segment_id or inline filters for engagement score, lifecycle stage, site and company. Saved segment_id and inline filters are mutually exclusive. Useful for building re-engagement campaigns or identifying high-value contacts.',
         inputSchema: {
             segment_id: z.string().uuid().optional().describe('Saved segment; mutually exclusive with inline audience filters'),
             lifecycle_stage: z.enum(['new', 'active', 'cooling', 'cold', 'churned', 'lead', 'trial', 'customer', 'win-back']).optional(),

package/build/tools/delivery-ops.js

@@ -7,6 +7,7 @@ import { assertChannelCanExecute, checkApproval, currentChannelContext, requestA
 import { callSendinelV1 } from '../lib/v1-client.js';
 import { getProjectId } from '../project.js';
 import { dbToolError, toolError } from '../lib/db-error.js';
+import { readLatestStoredDomainHealth, storedDomainDns, storedDnsReasons } from '../lib/domain-health.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 function asRecord(value) {
     return value && typeof value === 'object' ? value : {};
@@ -146,7 +147,7 @@ export function registerDeliveryOpsTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Returns stored SPF/DKIM/DMARC from the latest health check; does NOT query DNS live. Use recheck_domain_dns for a live re-check.',
+        description: 'Returns stored SPF/DKIM/DMARC from the latest health check, with verification_source=stored_domain_health and checked_at; does NOT query DNS live. Use recheck_domain_dns for a live re-check.',
         inputSchema: { domain_id: z.string().uuid() },
     }, async ({ domain_id }) => {
         const { data, error } = await db().from('domains')
@@ -158,22 +159,10 @@ export function registerDeliveryOpsTools(server) {
             return toolError(dbToolError(error, 'Unable to load domain'));
         if (!data)
             return toolError({ error: 'Domain not found', code: 'NOT_FOUND' });
-        const { data: health, error: healthError } = await db().from('domain_health')
-            .select('spf_valid, dkim_valid, dmarc_valid, sites!inner(domain_id)')
-            .eq('sites.project_id', getProjectId())
-            .eq('sites.domain_id', domain_id)
-            .order('check_date', { ascending: false })
-            .limit(1)
-            .maybeSingle();
+        const { data: health, error: healthError } = await readLatestStoredDomainHealth(domain_id);
         if (healthError)
             return toolError(dbToolError(healthError, 'Unable to load domain health'));
-        const spf = health?.spf_valid ?? null;
-        const dkim = health?.dkim_valid ?? null;
-        const dmarc = health?.dmarc_valid ?? null;
-        const allVerified = [spf, dkim, dmarc].every((value) => typeof value === 'boolean')
-            ? Boolean(spf && dkim && dmarc)
-            : null;
-        return j({ spf, dkim, dmarc, all_verified: allVerified });
+        return j(storedDomainDns(health));
     });
     server.registerTool('recheck_domain_dns', {
         title: 'Recheck Domain DNS Live',
@@ -802,7 +791,7 @@ export function registerDeliveryOpsTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'List sending domains with Sendinel readiness (ready true/false/null, reasons, provider_detail). Raw provider values, including EE tracking_status_raw, are labelled detail only and do not drive readiness.',
+        description: 'List sending domains with stored domain_health DNS observations and Sendinel readiness (ready true/false/null, reasons, provider_detail). Registration status, provider and verified_at remain saved metadata; unknown DNS never implies ready. Raw provider values, including EE tracking_status_raw, are labelled detail only.',
         inputSchema: { site_id: z.string().uuid().optional() },
     }, async ({ site_id }) => {
         const projectId = getProjectId();
@@ -829,9 +818,20 @@ export function registerDeliveryOpsTools(server) {
             return j(dbToolError(error));
         if (!data)
             return j({ error: 'Domain query returned no result' });
-        return j({ domains: data.map((domain) => ({
-                ...domain, readiness: computeDomainReadiness(domain),
-            })), count: data.length });
+        const domains = [];
+        for (const domain of data) {
+            const { data: health, error: healthError } = await readLatestStoredDomainHealth(domain.id);
+            if (healthError)
+                return toolError(dbToolError(healthError, 'Unable to load domain health'));
+            const dns = storedDomainDns(health);
+            const readiness = computeDomainReadiness(domain);
+            const auth = [dns.spf, dns.dkim, dns.dmarc];
+            readiness.ready = readiness.ready === false || auth.includes(false) ? false
+                : readiness.ready === null || auth.includes(null) ? null : true;
+            readiness.reasons.push(...storedDnsReasons(dns));
+            domains.push({ ...domain, dns, readiness });
+        }
+        return j({ domains, count: domains.length });
     });
     server.registerTool('register_domain', {
         title: 'Register Domain',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.166",
+  "version": "1.0.167",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",