AstraVerify VS ShellNewHandler

AstraVerify's answer

It came out of consulting work. The same questions kept coming up across client engagements: how is my email doing? Is my mail actually reaching inboxes? Could someone send mail pretending to be us? How does our website look to search engines, and lately, to AI bots?

We could answer those in plain English, and the answer was usually "you are fine" or "that one is good". But that is about as far as plain English gets you. It does not tell you how far from fine, which of five problems to deal with first, or whether the next hour of work is worth more than the one after it.

A score does. Breaking it into components, each with its own points, turns a vague reassurance into something specific: this is what you have, this is what is missing, this is the record to publish, and this is where the biggest gain is for the least effort. That last part matters most to the people who are never going to do all of it.

We looked for a tool that covered both sides, the email authentication and the way search and AI crawlers see the site, and could not find one. So we built it.

One honest limit, since those questions included inbox placement: AstraVerify scores the things that decide whether your mail is trusted, which is authentication (MX, SPF, DKIM, DMARC). It does not run seed-list deliverability tests and will not tell you which folder a given message landed in.

AstraVerify's answer

A React front end on Firebase Hosting behind Cloudflare, and a Python and Flask back end on Google Cloud Run, with Firestore for stored scans and history.

The DNS work uses dnspython for MX, SPF, DKIM and DMARC lookups and for parsing DMARC aggregate reports. The discoverability scan fetches robots.txt, the sitemap, the root page and a few inner pages concurrently, and repeats the root page once per crawler user agent.

One detail worth mentioning: the scoring rules are written once and compiled into a bundle that both the website and the API evaluate, so the score an assistant reports and the score on the report page cannot drift apart. There is also an MCP server at /mcp, so assistants can run the same checks inside a chat, and a REST API documented by an OpenAPI spec.

AstraVerify's answer

AstraVerify checks the two things that decide whether a domain is trusted, and checks them together: whether mail from it is authenticated, and whether search and AI engines can actually read the site.

The part no other tool does is the second half. Most checkers read robots.txt and stop there. AstraVerify requests your page as Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot and OAI-SearchBot and reports what each one actually received. That catches the common and invisible failure where a CDN or firewall returns 403 to an AI crawler while robots.txt and the origin both say the page is allowed.

Two more things are unusual. DKIM selectors cannot be listed from DNS, so for providers that randomise them (Amazon SES, Postmark) you can send AstraVerify one email and it reads the selector straight from the signature. And every finding comes with the exact record, file or tag to publish, plus a button that re-checks that one item, so you fix and verify without rescanning everything.

AstraVerify's answer

People who are responsible for a domain without being specialists in DNS or email authentication.

In practice that is founders and marketing owners at small companies, IT generalists who look after everything, and the agencies, consultants and web shops that manage domains on behalf of clients. The last group tends to check several domains in a sitting, which is why scanning needs no account.

The common thread is someone who can edit a DNS record or a page template but does not want to read RFC 7489 first. That shapes the output: plain language, the exact value to paste, and a re-check for the one thing you changed.

AstraVerify's answer

Because most people need both halves and end up buying two tools.

DMARC platforms do email authentication thoroughly but say nothing about whether your site can be crawled or quoted. SEO auditors do the opposite. AstraVerify scores both in one check, free, with no account.

It is also deliberately specific. Each finding names the record, file or tag to publish rather than telling you something is wrong, and a Verify button re-checks that single item afterwards.

Where it is not the right choice, plainly: if you need DMARC aggregate reports across dozens of client domains with role-based access and SLAs, a dedicated enterprise DMARC platform will serve you better. AstraVerify does analyse DMARC reports under its paid monitoring, but it is built for the owner of one domain or the agency looking after a handful, not for a large managed-service deployment.