BlackVeil DNS & Email Security Scanner is a remote MCP server that gives an AI agent 79 tools, among them analyze_drift, assess_spoofability, batch_scan. It answers at https://dns-mcp.blackveilsecurity.com/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 4 September 2026; the last check, on 18 October 2026, succeeded.
DNS and email security scanner with 78 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
analyze_drift | Measure whether a domain's DNS security posture improved or regressed by comparing the current state against a prior scan snapshot. Returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements a Inputs: domain, baseline, force_refresh, format |
assess_spoofability | Compute a composite email spoofability risk score (0–100, higher = more spoofable) by combining SPF trust surface, DMARC enforcement, and DKIM coverage. Returns a risk level (minimal→critical), per-control sub-scores, and plain-language sum Inputs: domain, force_refresh, format |
batch_scan | Bulk-scan up to 10 domains in parallel. Runs a full security audit on each domain in the list and returns score, NIST-aligned letter grade (6-band A+/A/B/C/D/F), and finding counts per domain. Use when you want to audit multiple domains at Inputs: domains, force_refresh, format |
batch_scan_findings | Fetch owner-scoped findings for a completed asynchronous batch scan. Inputs: job_id, format |
batch_scan_start | Start a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, normalized inputs, and scoring versions returns the same job. Inputs: domains, force_refresh, format, idempotency_key |
batch_scan_status | Read the owner-scoped status of an asynchronous batch scan. Inputs: job_id, format |
brand_audit_batch_start | Enqueue an async brand audit across up to 50 target domains with optional standard/deep discovery depth, brand aliases, and caller-supplied candidate domains. Returns { auditId, queuedAt, targetCount, etaSeconds } immediately; poll with bra Inputs: domains, format, min_confidence, depth, planner_mode, brand_aliases |
brand_audit_get_report | Fetch the result JSON for a completed brand audit. With `target` set, returns the per-target CheckResult; without, returns the audit-level aggregate. Returns notReady when polling an in-flight audit. When a rendered PDF sidecar exists, meta Inputs: auditId, target |
brand_audit_single | Run a full brand audit on a single target with optional standard/deep discovery depth, brand aliases, and caller-supplied candidate domains. Discovers brand-related domains, looks up registrar + registrant for each candidate, and classifies Inputs: domain, force_refresh, format, min_confidence, depth, planner_mode |
brand_audit_status | Poll the status of an enqueued brand audit. Returns audit-level status (queued | running | completed | failed), progress 'N/M', and per-target statuses. Owner-scoped — auditIds owned by other principals surface as notFound. Inputs: auditId |
check_agent_discovery | Assess the security posture of IETF BANDAID agent-discovery records (draft-mozleywilliams-dnsop-dnsaid). Detects SVCB agent records under _agents/_index._{protocol}._agents, reports whether the discovery zone is DNSSEC-anchored (unsigned = Inputs: domain, protocol, name, verify_cap, force_refresh, format |
check_authoritative_dns_infra | Check authoritative DNS infrastructure posture for a hostname. Uses BV_INFRA_PROBE when available for raw DNS, routing, RPKI, and vantage-point evidence. Inputs: domain, force_refresh, format |
check_bimi | Check the BIMI brand-logo record at default._bimi.<domain>. Validates the logo URL (l=) and the presence of mark-certificate authority evidence (a=) — the a= tag is a bare URL, so the certificate type (VMC or CMC) is not determined — and ve Inputs: domain, force_refresh, format |
check_caa | Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit. Inputs: domain, force_refresh, format |
check_dane | Check DANE/TLSA certificate pinning for SMTP at port 25. Resolves the domain's MX hosts and looks up TLSA records at _25._tcp.<mx-host>, verifying whether SMTP mail-server certificates are bound in DNS (DNSSEC-backed protection against CA m Inputs: domain, force_refresh, format |
check_dane_https | Verify DANE certificate pinning for HTTPS connections. Looks up TLSA records at _443._tcp.{domain} (port 443) and validates their syntax, usage/selector/matching-type fields and DNSSEC backing. The record is reported as present but UNVERIFI Inputs: domain, force_refresh, format |
check_dbl | Check domain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL). Returns listing status with decoded return codes. Inputs: domain, force_refresh, format |
check_dkim | Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound Inputs: domain, selector, force_refresh, format |
check_dmarc | Look up and validate the DMARC record for a domain. Shows the enforcement level (none/quarantine/reject), alignment mode (strict/relaxed), and aggregate/forensic reporting destinations. Use to determine a domain's DMARC enforcement level, w Inputs: domain, force_refresh, format |
check_dnskey_strength | Audit the cryptographic strength of DNSKEY signing algorithms used for DNSSEC. Reports which algorithm is used for DNSSEC signing keys (RSA/SHA-1, RSA/SHA-256, ECDSA P-256, Ed25519, etc.), flags deprecated algorithms (RSA/SHA-1, DSA), indep Inputs: domain, force_refresh, format |
check_dnssec | Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_do Inputs: domain, force_refresh, format |
check_dnssec_chain | Walk the full DNSSEC chain of trust from the DNS root down to the target domain, tracing DS/DNSKEY records and algorithm usage at each zone level. Use when asked to trace the chain of trust from the DNS root, or to see the full DNSSEC deleg Inputs: domain, force_refresh, format |
check_fast_flux | Detect fast-flux DNS behavior: performs multiple rounds of A/AAAA queries and checks whether IP addresses are rotating rapidly on each DNS query (a sign of botnet or malicious infrastructure). Compares IP answer sets and TTLs across rounds Inputs: domain, rounds, force_refresh, format |
check_http_security | Audit a domain's browser-facing HTTP security headers over HTTPS. Inspects Content-Security-Policy (flagging unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the cross-o Inputs: domain, force_refresh, format |
check_lookalikes | Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual-confusion domains registered by attackers. Distinct from check_shadow_domains (T Inputs: domain, force_refresh, format |
check_mta_sts | Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether i Inputs: domain, force_refresh, format |
check_mx | Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbo Inputs: domain, force_refresh, format |
check_mx_reputation | Check whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies reverse DNS for MX hosts. Use when you want to know if your mail server IP is blacklisted, or if your Inputs: domain, force_refresh, format |
check_ns | Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required Inputs: domain, force_refresh, format |
check_nsec_walkability | Assess zone walkability risk by analyzing NSEC3PARAM configuration. Detects plain NSEC zones, weak NSEC3 parameters, and opt-out flags. Inputs: domain, force_refresh, format |
check_ptr | Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit. Inputs: domain, force_refresh, format |
check_rbl | Check MX server IP reputation against 6 DNS-based Real-time Blocklists (SpamCop, UCEProtect, Mailspike, Barracuda, PSBL). Resolves MX hosts to IPs first. Inputs: domain, force_refresh, format |
check_realtime_threat_feed | Check a domain against BlackVeil real-time threat intelligence (curated intel-gateway feed). Distinct from DNSBL checks. Operator-deploy only; degrades to info when unprovisioned. Inputs: domain, force_refresh, format |
check_resolver_consistency | Check DNS consistency across 4 public resolvers. Inputs: domain, record_type, format |
check_root_server_set | Check the DNS root server set against official root hints, root glue, delegation, serial, and DNSKEY cross-root evidence. Inputs: format |
check_shadow_domains | Find alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to spoof email. Use when asked about TLD variants with email auth gaps — distinct from check_lookalikes Inputs: domain, force_refresh, format |
check_spf | Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use wh Inputs: domain, force_refresh, format |
check_srv | Map a domain's DNS-visible service footprint by probing 19 common SRV record prefixes (email, calendar, messaging, directory, web) in parallel. Returns discovered services and flags insecure service advertisements — e.g. plaintext IMAP/POP3 Inputs: domain, force_refresh, format |
check_ssl | Check the HTTPS/TLS posture of a domain: HTTPS reachability, HSTS policy, and HTTP-to-HTTPS redirect. Also returns certificate metadata (issuer, expiry date, days remaining, SAN count) read from public Certificate Transparency logs — this d Inputs: domain, force_refresh, format |
check_subdomailing | Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you want to know if an SPF include chain can be hijacked through a dangling domain, Inputs: domain, force_refresh, format |
check_subdomain_takeover, check_svcb_https, check_tlsrpt, check_txt_hygiene, check_zone_hygiene, compare_baseline, compare_domains, cymru_asn, delete_brand_audit_watch, discover_brand_domains, discover_brand_domains_findings, discover_brand_domains_start, discover_brand_domains_status, discover_subdomains, explain_finding, generate, get_benchmark, get_domain_rank, get_provider_insights, list_brand_audit_watches, map_compliance, map_supply_chain, osint_investigate_domain_start, osint_investigate_email_start, osint_investigate_infrastructure_start, osint_investigate_supply_chain_start, osint_investigate_username_start, osint_investigation_report, osint_investigation_status, prioritize_portfolio_leads, rdap_lookup, register_brand_audit_watch, resolve_spf_chain, scan_buckets_findings, scan_buckets_start, scan_buckets_status, scan_domain, simulate_attack_paths, validate_fix
Every block below points at https://dns-mcp.blackveilsecurity.com/mcp. Pick your client and copy.
claude mcp add --transport http blackveil-dns-email-security-sca https://dns-mcp.blackveilsecurity.com/mcp
{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://dns-mcp.blackveilsecurity.com/mcp"]
}
}
}{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}{
"servers": {
"blackveil-dns-email-security-sca": {
"type": "http",
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}{
"context_servers": {
"blackveil-dns-email-security-sca": {
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"serverUrl": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}name: BlackVeil DNS & Email Security Scanner
version: 0.0.1
schema: v1
mcpServers:
- name: BlackVeil DNS & Email Security Scanner
type: streamable-http
url: https://dns-mcp.blackveilsecurity.com/mcp{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"httpUrl": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"type": "http",
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}{
"mcpServers": {
"blackveil-dns-email-security-sca": {
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fdns-mcp.blackveilsecurity.com%2Fmcp&type=streamable_http&id=blackveil-dns-email-security-sca&name=BlackVeil%20DNS%20%26%20Email%20Security%20Scanner
It answered our last check on 18 October 2026 in 480 ms. Over 10 checks since 4 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by blackveilsecurity.com and served from dns-mcp.blackveilsecurity.com, the vendor's own domain: https://dns-mcp.blackveilsecurity.com/mcp.
79, as returned by the server's own tools/list on 10 September 2026: analyze_drift, assess_spoofability, batch_scan, batch_scan_findings, batch_scan_start, batch_scan_status, brand_audit_batch_start, brand_audit_get_report, and 71 more.
It answered our last check on 18 October 2026 in 480 ms. Over 10 checks since 4 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://dns-mcp.blackveilsecurity.com/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: com.blackveilsecurity. Endpoint host: dns-mcp.blackveilsecurity.com. ARD identifier: urn:air:com.blackveilsecurity:mcp:dns.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.