bots.st/dns-doctor
dns-doctor
Scan and fix DNS email auth records
1949 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 29
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://dnsdoctor.dev/mcp - npm
npx -y @dnsdoctor/mcpReleased 5 Nov 2026, version 1.20.0
What it can do
| Tool | What it says it does |
|---|---|
add_monitored_domain | Add a domain to the signed-in user's DNS Doctor monitoring and return the ownership-check TXT record they must publish, plus where their DNS is hosted, a provider-specific guide link and, when their provider supports it, a one-click apply URL. Re-adding a domain they already monitor returns that… |
audit_spf_includes | Use this when the user asks who can send email as their domain through SPF includes, or wants an SPF supply-chain or third-party sender audit. Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved… |
build_dmarc_upgrade | Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine at most; reject needs monitoring evidence) — and after any report showing DMARC below enforcement. Return a validated… |
build_parked_domain_records | Use this when the user asks how to protect a domain that sends no email from being spoofed. Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC record. For parked, redirect and… |
check_bimi | Use this when the user asks how to get their logo shown in Gmail, Yahoo, Apple Mail or other inboxes (BIMI), whether their BIMI setup works, or why their logo does not show. A live read of one host's BIMI setup: the DMARC gate (BIMI needs p=quarantine or p=reject; dmarc_sources names each policy… |
check_dkim_selector | Use this when the user asks whether DKIM is set up for a sending platform, whether a specific selector exists, or why DKIM fails. Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may miss… |
check_domain_names | Use this when the user is choosing a domain name and wants to know which candidates are already registered. Pass up to 20 candidate names in ONE call (never one call per name). Each name is read live from its registry over RDAP: status is registered | not_registered | unknown. registered carries… |
check_domain_verification | Use this only for DNS Doctor's own ownership TXT challenge on a domain the user already added to their DNS Doctor account (add_monitored_domain). For a TXT record another service asked for (Google Workspace, Microsoft 365, Shopify or any site verification), use check_record instead. Check whether… |
check_lookalikes | Use this when the user asks about lookalike, look-alike, typosquat or impersonation domains of their domain, or whether someone has registered a name close to theirs. DNS-only: checks the closest variants of the name and returns facts — how many resolve and how many accept mail, with up to ten… |
check_propagation | Use this when the user asks whether a DNS change has propagated globally, or why a record shows in one place and not another. Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each read the same… |
check_record | Use this when the user asks whether a DNS change has landed, wants a DNS record looked up, or wants to verify a record they just published — or whenever answering needs the live value of a record. Reads the record from the domain's OWN nameservers (cache-free) and from two public caching… |
check_reverse_dns | Use this when the user asks about reverse DNS, PTR records, or FCrDNS for a mail server IP. Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the same IP. `verdict` is confirmed (the pair… |
count_spf_lookups | Use this when the user asks about SPF 'too many lookups', the 10-lookup limit, an SPF PermError, or whether an SPF record is valid. Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a… |
generate_dmarc_record | Use this when the user asks to create, generate or write a DMARC record for a domain that has none. Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; optional `rua_email` (aggregate-report… |
get_alerts | Use this when a signed-in operator asks what changed on a monitored domain, whether its website went down, or what the monitoring has flagged. Read the monitoring alert log for the domains the caller's account monitors, newest first, including website uptime incidents (site_down, site_partial… |
get_domain_records | Read the records a domain the user monitors still needs: the ownership check while it is unverified, and once verified the DMARC reporting record plus whether we have OBSERVED that record published. Read-only: it issues nothing — if a verified domain comes back with no reporting record yet, call… |
get_email_test | Use this after start_email_test, once the user says they sent the email. Returns status pending | received | expired | error. pending means the message has not arrived (or is still being checked): ask the user to send it if they have not, then call again. received carries result: the sending IP… |
get_lookalikes | Use this when a signed-in operator asks which lookalike domains of a monitored domain the watch has found, how risky they are, or for one's takedown evidence. Requires an API token with monitoring:read. Returns the account's watched lookalikes for ONE verified domain, highest threat % first by… |
get_readiness | Use this when a signed-in operator asks whether a monitored domain is ready for the next DMARC step. Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API token. Returns whether the domain is… |
get_report | Use this for the same questions as scan_domain when a recent report is enough (the cheap first look); use scan_domain when the state must be re-read now. Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns… |
list_email_tests | Use this when a signed-in user asks about email tests they ran before, or how a sender's earlier tests scored. Requires an API token with monitoring:read. Returns the account's own tests, newest first (optionally only those whose From names one organization): each with test_id, status, created_at… |
list_my_domains | Use this when a signed-in operator asks which domains their DNS Doctor account monitors, or what to do next on them. Lists every domain on the caller's account with its state — verified, pending (added, ownership not proven yet) or verification_lapsed (the ownership record was removed, so… |
lookup_registration | Use this when the user asks who owns a domain, when it expires, which registrar or nameservers it has, whether it is registered, or whether a transfer or delete lock is set — the WHOIS question. Read a domain's registration from the registry over RDAP: registrar (with IANA id)… |
parse_dmarc_report | Use this when the user uploads or pastes a DMARC aggregate (RUA) XML report and asks what it says. Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the file's bytes base64-encoded in… |
scan_domain | Use this when the user asks to check, audit, diagnose or troubleshoot SPF, DKIM, DMARC, email authentication, email deliverability DNS, why their mail lands in spam, MX, DNS health, blacklist status, or domain/SSL expiry for a domain, or wants to fix what a scan finds (fix records for DMARC and… |
start_email_test | Use this when the user wants to know how a real email from them actually authenticates — whether a message from Google Workspace, Microsoft 365, a newsletter tool or an app is SPF/DKIM/DMARC aligned, why it lands in spam, or to prove DKIM signing works before tightening DMARC. Returns a single-use… |
start_monitoring_signup | Use this when the user asks for ongoing DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts, ongoing DNS monitoring, or website uptime monitoring and down alerts for a domain they own (a verified domain's website is checked from five locations on four… |
validate_dmarc_record | Use this when the user pastes a DMARC record and asks whether it is valid, correct or safe. Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews a stronger policy and is capped at… |
watch_record_change | Use this when the user asks to be told when a DNS change they are making has finished ("let me know when it's live"). Starts a free watch on ONE record for the signed-in user: DNS Doctor rechecks it every 10 minutes for up to 48 hours with the same verdict as check_record and sends ONE email to… |
In its maker's words
Scan, fix, verify and monitor DNS: SPF, DMARC, DKIM, propagation, health, expiry. Validated fixes.
- Website
- dnsdoctor.dev/methodology
- Source
- github.com/dnsdoctor/mcp
- Publisher
- dnsdoctor.dev
- Listed from
- the official MCP Registry as
dev.dnsdoctor/dns-doctor - Version
- 1.20.0, updated 5 Nov 2026
- Kinds of work
- Security and trust, Domains and websites, Search and research
The domain it lives on
- dnsdoctor.dev
- registered 2 Jul 2026 (4 months ago), at CloudFlare, Inc., its name does not resolve now
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 1949 ms | |
| Answered | 2797 ms | |
| Answered | 1310 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.