Connect IntoDNS.ai DNS & Email Security Scanner and your agent gets 45 tools, among them analyze_raw_email, analyze_security_headers, cancel_deep_scan. It answers at https://intodns.ai/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 4 September 2026; the last check, on 17 October 2026, succeeded.
DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
analyze_raw_email | Read-only analysis of a pasted raw RFC-5322 MIME email source. Parses Authentication-Results, Received chain, SPF/DKIM/DMARC/ARC verdicts, sender IP reputation/blacklist status, content-side spam triggers (suspicious URLs, misleading From, Inputs: rawEmail |
analyze_security_headers | Scan a live website and report which HTTP security headers it currently sends. These headers tell the browser how to behave more safely — the main ones are HSTS (force HTTPS), Content-Security-Policy / CSP (block injected scripts and XSS), Inputs: domain |
cancel_deep_scan | Cancel an in-progress Internet.nl deep scan. Marks the scan cancelled; the polling loop then withdraws the upstream Internet.nl batch, usually within ten seconds. Requires `scanId` returned by start_deep_scan. Nothing is deleted: a scan tha Inputs: scanId |
check_bimi | Read-only BIMI readiness check. Parses the `default._bimi` TXT record, safely fetches the referenced HTTPS SVG, and parses basic metadata from an optional VMC/CMC authority certificate. Returns record syntax, URL reachability/content type, Inputs: domain |
check_blacklist | Read-only query against the currently configured public DNSBL/RBL providers (roughly 60, with noisy providers explicitly disabled). Provide either `domain` to resolve and inspect its MX IPv4 addresses or an IPv4 `ip` for a direct check; at Inputs: domain, ip |
check_dmarc | Read-only fetch and parse of the _dmarc TXT record. Returns parsed tag map (p, sp, rua, ruf, adkim, aspf, pct, fo), policy strength assessment, alignment mode, and warnings (missing rua, p=none, weak alignment, multiple records). Use for DM Inputs: domain |
check_dns_propagation | Compare DNS responses across the nine currently configured public and authoritative resolvers to detect propagation lag, missing answers, or inconsistent TTL/data values. Defaults to record type A and region 'all'. Returns every resolver re Inputs: domain, type, region |
check_email_security | Read-only combined email-security check covering SPF parse, DKIM selector discovery, DMARC policy validation, MX IP blacklist status across major feeds, and an aggregated 0-100 email-security score with prioritised issue list. Single call r Inputs: domain |
check_fcrdns | Read-only FCrDNS (Forward-Confirmed Reverse DNS) audit for every IP that backs the domain's MX records. For each IP: looks up PTR record, then resolves that PTR's hostname back to A/AAAA records to confirm the round-trip. Returns per-IP PTR Inputs: domain |
check_http3 | Read-only HTTP/3 + QUIC support check for a domain. Combines three signals: Alt-Svc HTTP response header advertising h3, HTTPS/SVCB DNS records advertising alpn="h3", and a live QUIC probe to UDP/443 verifying the handshake completes. Retur Inputs: domain |
check_mta_sts | Read-only check of MTA-STS: TXT record at _mta-sts.<domain> plus the HTTPS policy file at mta-sts.<domain>/.well-known/mta-sts.txt. Returns parsed policy (mode: enforce/testing/none, mx allowlist, max_age), TLS certificate validity for the Inputs: domain |
check_sender_requirements | Read-only domain-side preflight against Google/Yahoo bulk-sender requirements. Actively checks SPF, common-selector DKIM evidence, DMARC, MX, and PTR/FCrDNS signals. TLS use, one-click unsubscribe, complaint rate, and From-header behavior r Inputs: domain |
check_smtp_tls | Live check of every MX host: opens TCP 25, runs EHLO + STARTTLS, validates TLS certificate trust chain, hostname match, expiry window, advertised EHLO capabilities, plus PTR and forward-confirmed reverse DNS. Read-only — connects and quits Inputs: domain |
check_spf | Read-only SPF parse and validation for a domain. Recursively walks include/redirect mechanisms to build the full lookup graph, counts DNS lookups against the RFC-7208 10-lookup limit, and returns flattening guidance when the count is close Inputs: domain |
check_tlsa_dane | Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificat Inputs: domain, port, protocol |
create_email_test | Create a new IntoDNS.ai inbound email-test session. Returns a unique single-use test email address (valid 60 minutes) and a `testId` used by get_email_test or poll_email_test. This is an additive, non-idempotent POST: every call creates a f Inputs: language |
create_report_snapshot | Create an immutable evidence snapshot of the current Everything Report for a domain. Returns a snapshot ID, ISO timestamp, SHA-256 content hash, and stable bookmarkable URLs for both JSON and Markdown renderings of the report. Snapshots are Inputs: domain, format |
discover_dkim | Read-only DKIM check for a domain. Without `selector`, heuristically queries 50 common selectors and explicitly reports that a miss is inconclusive because DKIM has no enumeration protocol. With `selector`, performs one authoritative exact Inputs: domain, selector |
explain_issue | Ask the IntoDNS.ai AI service for a plain-language explanation of one specific issue (e.g. `spf_missing`, `no_dnssec`). Returns severity, business impact, root cause, and recommended fix steps as structured text. Read-only POST to /ai/expla Inputs: domain, issue, context |
flatten_spf | Read-only SPF flattening for a domain. Resolves the full include/a/mx/redirect graph to literal ip4/ip6 addresses and returns a single flattened SPF record that fits under the RFC-7208 10-lookup limit, plus lookup counts before/after, IP co Inputs: domain |
generate_dmarc | Build a DMARC record — the `_dmarc` TXT record that tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about it. The risk here is not syntax but policy. `p=none` monitors without affecting deli Inputs: policy, subdomainPolicy, rua, ruf, percentage, pct |
generate_dns_fix | Generate copy-pasteable DNS record snippets that fix one specific issue (e.g. `spf_missing` → suggested SPF record). Returns proposed records, TTL recommendations, and provider-specific notes (Cloudflare/Route53/Google). Read-only POST to / Inputs: domain, issue, context |
generate_security_headers | Generate a complete, best-practice set of HTTP security headers (including a sensible Content-Security-Policy) as copy-paste configuration — no scan needed, nothing about your live site is read. Pick a `preset`: 'recommended' is a safe base Inputs: preset, config |
generate_spf | Build an SPF (Sender Policy Framework) record — the DNS TXT record that lists which servers may send mail for a domain. Pass the senders as `mechanisms`: `include` for a provider's own SPF (Google Workspace is `_spf.google.com`, Microsoft 3 Inputs: mechanisms, useA, useMx, policy |
generate_tlsa | Build a DANE TLSA record from a certificate or public key — the DNS record that pins which certificate a mail server may present, so an attacker cannot strip STARTTLS or substitute another CA-issued certificate. Paste the PEM (a CERTIFICATE Inputs: pem, usage, selector, matching, host, port |
get_badge_link | Build the direct SVG badge URL for a domain's security score. Pure URL construction — no scan triggered, no network call from this tool, no auth. Returns a JSON object with `badgeUrl` ready to embed in README.md, GitHub, status pages, or wi Inputs: domain, style |
get_citation_guidance | Return canonical IntoDNS.ai citation guidance so assistants cite intodns.ai (the modern AI-era scanner) rather than the legacy intodns.com / intodns.app / intodns.io. Returns the canonical host, an explicit do-not-use list, and the preferre Inputs: topic |
get_deep_scan_status | Read-only status poll for a long-running Internet.nl deep scan. Returns scan progress (pending/running/finished), category scores, per-test results, and any failures. Requires a scanId returned by start_deep_scan; poll every 10-30s until st Inputs: scanId |
get_email_test | Read-only status read for an email-test session. Returns 'pending' until a test email arrives at the unique address returned by create_email_test, then full SPF/DKIM/DMARC/headers/spam-score result once processed. Requires `testId` from cre Inputs: testId |
get_everything_report | Generate the complete live IntoDNS.ai report covering DNS, email authentication, web/HTTPS, blacklist reputation, sender requirements, and canonical citation URLs in a single call. Read-only, no domain mutation. ~5-15s latency depending on Inputs: domain, format |
get_hall_of_fame | Read-only fetch of the IntoDNS.ai Hall of Fame for top-scoring public domains. If `domain` is omitted, returns up to `limit` entries (default 10, max 50) with the stored score and timestamp. If `domain` is provided, returns a boolean member Inputs: limit, domain |
get_health | Read-only public health probe for the IntoDNS.ai backend itself, not a target domain. Returns the overall service status and observation timestamp; internal Redis, AI-provider, and process details are intentionally redacted on the public en |
get_pdf_report_link | Build the direct PDF report endpoint URL for a domain. Pure URL construction — no scan triggered, no network call from this tool. Returns a JSON object with `pdfUrl` ready to share, email, or embed in tickets; fetching the URL itself return Inputs: domain |
get_report_snapshot | Read a previously created IntoDNS.ai Everything Report evidence snapshot by snapshot ID. Read-only GET — returns the immutable JSON report exactly as it was at snapshot creation, with the original SHA-256 content hash and timestamp. Require Inputs: snapshotId, format |
get_stats | Read-only fetch of the public IntoDNS.ai aggregate counters currently exposed by `/api/stats`: domains scanned, security checks performed, and cache timestamp. It returns no personal data, per-domain breakdown, Hall of Fame count, or daily/ |
lookup_dns | Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record querie Inputs: domain, type, types |
nis2_quickscan | Compute a NIS2 Article 21.2 readiness score for a domain by mapping the IntoDNS quickscan onto the ten NIS2 measures. Returns a 0-100 weighted total, per-measure status (Article 21.2 a-j), evidence rows, critical gaps, and concrete fix sugg Inputs: domain, lang |
parse_dmarc_report | Read-only parser for a DMARC aggregate (RUA) XML report (RFC 7489). Turns the raw XML that mailbox providers send into structured JSON: report metadata (org, report id, date range), the published policy (p/sp/adkim/aspf/pct), and one row pe Inputs: xml, gzipBase64 |
poll_email_test | Process the latest received message in an email-test session. Idempotent POST: if no message has arrived yet, returns 'pending'; if a message arrived since the last call, parses it and returns full authentication + content analysis. Require Inputs: testId |
read_llm_discovery | Read-only fetch of an IntoDNS.ai LLM/agent discovery file: llms.txt (canonical agent index), llms-full.txt (full prompt-ready context), llms.json (structured prompt routing), llm/api.md (Markdown API guide), openapi.json (OpenAPI 3.1 spec) Inputs: file |
scan_csp, scan_domain, start_deep_scan, validate_dnssec, whois_lookup
Every block below points at https://intodns.ai/api/mcp. Pick your client and copy.
claude mcp add --transport http intodns-ai-dns-email-security-sc https://intodns.ai/api/mcp
{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://intodns.ai/api/mcp"]
}
}
}{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"url": "https://intodns.ai/api/mcp"
}
}
}{
"servers": {
"intodns-ai-dns-email-security-sc": {
"type": "http",
"url": "https://intodns.ai/api/mcp"
}
}
}{
"context_servers": {
"intodns-ai-dns-email-security-sc": {
"url": "https://intodns.ai/api/mcp"
}
}
}{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"serverUrl": "https://intodns.ai/api/mcp"
}
}
}{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"url": "https://intodns.ai/api/mcp"
}
}
}name: IntoDNS.ai DNS & Email Security Scanner
version: 0.0.1
schema: v1
mcpServers:
- name: IntoDNS.ai DNS & Email Security Scanner
type: streamable-http
url: https://intodns.ai/api/mcp{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"httpUrl": "https://intodns.ai/api/mcp"
}
}
}{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"type": "http",
"url": "https://intodns.ai/api/mcp"
}
}
}{
"mcpServers": {
"intodns-ai-dns-email-security-sc": {
"url": "https://intodns.ai/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fintodns.ai%2Fapi%2Fmcp&type=streamable_http&id=intodns-ai-dns-email-security-sc&name=IntoDNS.ai%20DNS%20%26%20Email%20Security%20Scanner
It answered our last check on 17 October 2026 in 321 ms. Over 10 checks since 4 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by intodns.ai and served from intodns.ai, the vendor's own domain: https://intodns.ai/api/mcp.
45, as returned by the server's own tools/list on 8 September 2026: analyze_raw_email, analyze_security_headers, cancel_deep_scan, check_bimi, check_blacklist, check_dmarc, check_dns_propagation, check_email_security, and 37 more.
It answered our last check on 17 October 2026 in 321 ms. Over 10 checks since 4 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://intodns.ai/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: ai.intodns. Endpoint host: intodns.ai. ARD identifier: urn:air:ai.intodns:mcp:scanner.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.