#!/usr/bin/env bash
# Check SPF/DKIM/DMARC DNS for Fibitex email deliverability.
# Usage: bash scripts/check-email-dns.sh [domain]
# Example: bash scripts/check-email-dns.sh fibitex.com

set -euo pipefail

DOMAIN="${1:-fibitex.com}"
MAIL_HOST="mail.${DOMAIN}"

echo "=== Email DNS check: ${DOMAIN} ==="
echo

echo "--- Mail server A record (${MAIL_HOST}) ---"
dig +short "${MAIL_HOST}" A || true
echo

echo "--- SPF (TXT @ ${DOMAIN}) ---"
dig +short "${DOMAIN}" TXT | grep -i spf || echo "WARN: no SPF found"
echo

echo "--- DKIM (default._domainkey.${DOMAIN}) ---"
dig +short "default._domainkey.${DOMAIN}" TXT || echo "WARN: no DKIM at default selector (try mail._domainkey)"
dig +short "mail._domainkey.${DOMAIN}" TXT 2>/dev/null || true
echo

echo "--- DMARC (_dmarc.${DOMAIN}) ---"
dig +short "_dmarc.${DOMAIN}" TXT || echo "WARN: no DMARC found"
echo

echo "--- MX (${DOMAIN}) ---"
dig +short "${DOMAIN}" MX || true
echo

echo "Done. Fix WARN lines in Cloudflare / mail panel."
echo "Full guide: Docs/13-email-deliverability-fibitex.md"