dns-doctor is an MCP server with 15 tools an agent can call, among them audit_spf_includes, build_dmarc_upgrade, build_parked_domain_records. It answers at https://dnsdoctor.dev/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 5 September 2026; the last check, on 18 October 2026, succeeded.
Scan, fix, verify and monitor DNS: SPF, DMARC, DKIM, propagation, health, expiry. Validated fixes.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
audit_spf_includes | Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved tree, per-node lookup attribution, the total authorized IPv4 address count, and typed fin Inputs: domain |
build_dmarc_upgrade | Return a validated DMARC enforcement-upgrade record for a domain. The alignment gate (whether p=reject is safe) is derived server-side from a scan — a caller can never assert alignment. `record` is null when there is no honest upgrade to of Inputs: domain |
build_parked_domain_records | Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC record. For parked, redirect and brand-defensive domains only — NEVER for a doma Inputs: domain, confirm_no_mail, rua_email |
check_dkim_selector | Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may miss. Returns the verdict, its explanation, and the published key record when o Inputs: domain, selector |
check_record | Check whether a DNS change has landed: reads the record from the domain's OWN nameservers (cache-free) and from two public caching resolvers, and reports whether they agree. `kind` is one of spf|dmarc|txt|mx|cname|a|aaaa — pass the kind, no Inputs: domain, kind, host |
check_reverse_dns | Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the same IP. `verdict` is confirmed (the pair agrees — what receivers want to see), Inputs: ip |
count_spf_lookups | Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a `+all` that authorizes the whole internet to send as this domain), `multiple_al Inputs: domain, record |
generate_dmarc_record | Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; optional `rua_email` (aggregate-report destination), `subdomain_policy`, and `strict_a Inputs: policy, rua_email, subdomain_policy, strict_alignment |
get_alerts | Read the monitoring alert log for the domains the caller's account monitors, newest first. Requires an API token. Each row carries id, domain, type, check, summary, a deterministic detail map, created_at, email_sent_at, acknowledged_at and Inputs: since, domain, type, limit, before |
get_readiness | Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API token. Returns whether the domain is ready to step its policy up, the blockers that Inputs: domain |
get_report | Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns the same seven-check report as scan_domain (SPF, DKIM, DMARC, MX, DNS hardening, domain/TLS expir Inputs: domain |
parse_dmarc_report | Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the file's bytes base64-encoded in `content_base64` (XML, .gz or .zip; up to 2 MiB Inputs: content_base64, filename |
scan_domain | Force a fresh scan of a domain and return its full report: seven deterministic checks — SPF, DKIM, DMARC, MX, DNS hardening, domain/TLS expiry and blacklist listing — each with a status (pass/warn/fail/info/temperror), the observed record, Inputs: domain |
start_monitoring_signup | Return a sign-up link to give to the HUMAN who owns a domain, so they can start monitoring it themselves. Nothing is created and no email is sent by this call: the returned signup_url opens a page that explains monitoring and asks them to s Inputs: domain |
validate_dmarc_record | Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews a stronger policy and is capped at p=quarantine: a pasted record carries no ali Inputs: record |
Every block below points at https://dnsdoctor.dev/mcp. Pick your client and copy.
claude mcp add --transport http dns-doctor https://dnsdoctor.dev/mcp
{
"mcpServers": {
"dns-doctor": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://dnsdoctor.dev/mcp"]
}
}
}{
"mcpServers": {
"dns-doctor": {
"url": "https://dnsdoctor.dev/mcp"
}
}
}{
"servers": {
"dns-doctor": {
"type": "http",
"url": "https://dnsdoctor.dev/mcp"
}
}
}{
"context_servers": {
"dns-doctor": {
"url": "https://dnsdoctor.dev/mcp"
}
}
}{
"mcpServers": {
"dns-doctor": {
"serverUrl": "https://dnsdoctor.dev/mcp"
}
}
}{
"mcpServers": {
"dns-doctor": {
"url": "https://dnsdoctor.dev/mcp"
}
}
}name: dns-doctor
version: 0.0.1
schema: v1
mcpServers:
- name: dns-doctor
type: streamable-http
url: https://dnsdoctor.dev/mcp{
"mcpServers": {
"dns-doctor": {
"httpUrl": "https://dnsdoctor.dev/mcp"
}
}
}{
"mcpServers": {
"dns-doctor": {
"type": "http",
"url": "https://dnsdoctor.dev/mcp"
}
}
}{
"mcpServers": {
"dns-doctor": {
"url": "https://dnsdoctor.dev/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fdnsdoctor.dev%2Fmcp&type=streamable_http&id=dns-doctor&name=dns-doctor
It answered our last check on 18 October 2026 in 299 ms. Over 10 checks since 5 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by dnsdoctor.dev and served from dnsdoctor.dev, the vendor's own domain: https://dnsdoctor.dev/mcp.
15, as returned by the server's own tools/list on 31 August 2026: audit_spf_includes, build_dmarc_upgrade, build_parked_domain_records, check_dkim_selector, check_record, check_reverse_dns, count_spf_lookups, generate_dmarc_record, and 7 more.
It answered our last check on 18 October 2026 in 299 ms. Over 10 checks since 5 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://dnsdoctor.dev/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: dev.dnsdoctor. Endpoint host: dnsdoctor.dev. ARD identifier: urn:air:dev.dnsdoctor:mcp:dns-doctor.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.