MCP server

Dns Doctor Official

dev.dnsdoctor/dns-doctor

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Scan, fix, verify and monitor DNS: SPF, DMARC, DKIM, propagation, health, expiry. Validated fixes.

Website Source

At a glance

Type

MCP server

Publisher

dnsdoctor.dev (verified by the MCP Registry)

Status

Working at last check

Tools

27

Token cost

About 11,891 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http dns-doctor https://dnsdoctor.dev/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.dns-doctor]
url = "https://dnsdoctor.dev/mcp"

Gemini CLI

{"mcpServers":{"dns-doctor":{"httpUrl":"https://dnsdoctor.dev/mcp"}}}

Cursor

{"mcpServers":{"dns-doctor":{"url":"https://dnsdoctor.dev/mcp"}}}

VS Code

{"servers":{"dns-doctor":{"type":"http","url":"https://dnsdoctor.dev/mcp"}}}

Antigravity

agy mcp add dns-doctor https://dnsdoctor.dev/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"dns-doctor","server_url":"https://dnsdoctor.dev/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"dns-doctor","server_url":"https://dnsdoctor.dev/mcp"}

Tools

• add_monitored_domain ~396 tokens
  Add a domain to the signed-in user's DNS Doctor monitoring and return the ownership-check TXT record they must publish, plus where their DNS is hosted, a provider-specific guide link and, when their provider supports it, a one-click apply URL. Re-adding a domain they already monitor returns that dom
• audit_spf_includes Sends messages · ~561 tokens
  Use this when the user asks who can send email as their domain through SPF includes, or wants an SPF supply-chain or third-party sender audit. Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved tree,
• build_dmarc_upgrade ~524 tokens
  Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine at most; reject needs monitoring evidence) — and after any report showing DMARC below enforcement. Return a validated D
• build_parked_domain_records ~639 tokens
  Use this when the user asks how to protect a domain that sends no email from being spoofed. Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC record. For parked, redirect and brand-defensive
• check_bimi ~662 tokens
  Use this when the user asks how to get their logo shown in Gmail, Yahoo, Apple Mail or other inboxes (BIMI), whether their BIMI setup works, or why their logo does not show. A live read of one host's BIMI setup: the DMARC gate (BIMI needs p=quarantine or p=reject; dmarc_sources names each policy rea
• check_dkim_selector ~344 tokens
  Use this when the user asks whether DKIM is set up for a sending platform, whether a specific selector exists, or why DKIM fails. Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may miss. Ret
• check_domain_verification ~477 tokens
  Use this only for DNS Doctor's own ownership TXT challenge on a domain the user already added to their DNS Doctor account (add_monitored_domain). For a TXT record another service asked for (Google Workspace, Microsoft 365, Shopify or any site verification), use check_record instead. Check whether th
• check_lookalikes ~361 tokens
  Use this when the user asks about lookalike, look-alike, typosquat or impersonation domains of their domain, or whether someone has registered a name close to theirs. DNS-only: checks the closest variants of the name and returns facts — how many resolve and how many accept mail, with up to ten resol
• check_propagation ~622 tokens
  Use this when the user asks whether a DNS change has propagated globally, or why a record shows in one place and not another. Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each read the same name
• check_record ~699 tokens
  Use this when the user asks whether a DNS change has landed, wants a DNS record looked up, or wants to verify a record they just published — or whenever answering needs the live value of a record. Reads the record from the domain's OWN nameservers (cache-free) and from two public caching resolvers.
• check_reverse_dns ~317 tokens
  Use this when the user asks about reverse DNS, PTR records, or FCrDNS for a mail server IP. Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the same IP. `verdict` is confirmed (the pair agree
• count_spf_lookups ~494 tokens
  Use this when the user asks about SPF 'too many lookups', the 10-lookup limit, an SPF PermError, or whether an SPF record is valid. Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a `+all`
• generate_dmarc_record ~553 tokens
  Use this when the user asks to create, generate or write a DMARC record for a domain that has none. Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; optional `rua_email` (aggregate-report destina
• get_alerts ~716 tokens
  Use this when a signed-in operator asks what changed on a monitored domain, or what the monitoring has flagged. Read the monitoring alert log for the domains the caller's account monitors, newest first. Requires an API token. Each row carries id, domain, type, check, summary, a deterministic detail
• get_domain_records ~356 tokens
  Read the records a domain the user monitors still needs: the ownership check while it is unverified, and once verified the DMARC reporting record plus whether we have OBSERVED that record published. Read-only: it issues nothing — if a verified domain comes back with no reporting record yet, call che
• get_email_test ~363 tokens
  Use this after start_email_test, once the user says they sent the email. Returns status pending | received | expired | error. pending means the message has not arrived (or is still being checked): ask the user to send it if they have not, then call again. received carries result — the sending IP and
• get_lookalikes ~736 tokens
  Use this when a signed-in operator asks which lookalike domains of a monitored domain the watch has found, how risky they are, or for one's takedown evidence. Requires an API token with monitoring:read. Returns the account's watched lookalikes for ONE verified domain, highest threat % first by defau
• get_readiness ~401 tokens
  Use this when a signed-in operator asks whether a monitored domain is ready for the next DMARC step. Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API token. Returns whether the domain is ready
• get_report ~293 tokens
  Use this for the same questions as scan_domain when a recent report is enough (the cheap first look); use scan_domain when the state must be re-read now. Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns the
• list_email_tests ~299 tokens
  Use this when a signed-in user asks about email tests they ran before, or how a sender's earlier tests scored. Requires an API token with monitoring:read. Returns the account's own tests, newest first (optionally only those whose From names one organization): each with test_id, status, created_at, r
• list_my_domains ~158 tokens
  Use this when a signed-in operator asks which domains their DNS Doctor account monitors, or what to do next on them. Lists every domain on the caller's account with its state — verified, pending (added, ownership not proven yet) or verification_lapsed (the ownership record was removed, so monitoring
• lookup_registration ~377 tokens
  Use this when the user asks who owns a domain, when it expires, which registrar or nameservers it has, whether it is registered, or whether a transfer or delete lock is set — the WHOIS question. Read a domain's registration from the registry over RDAP: registrar (with IANA id), registration/last-cha
• parse_dmarc_report ~314 tokens
  Use this when the user uploads or pastes a DMARC aggregate (RUA) XML report and asks what it says. Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the file's bytes base64-encoded in `content_
• scan_domain ~474 tokens
  Use this when the user asks to check, audit, diagnose or troubleshoot SPF, DKIM, DMARC, email authentication, email deliverability DNS, why their mail lands in spam, MX, DNS health, blacklist status, or domain/SSL expiry for a domain, or wants to fix what a scan finds (fix records for DMARC and DNS;
• start_email_test ~223 tokens
  Use this when the user wants to know how a real email from them actually authenticates — whether a message from Google Workspace, Microsoft 365, a newsletter tool or an app is SPF/DKIM/DMARC aligned, why it lands in spam, or to prove DKIM signing works before tightening DMARC. Returns a single-use a
• start_monitoring_signup ~279 tokens
  Use this when the user asks for ongoing DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts or ongoing DNS monitoring of a domain they own. Returns signup_url, a link to a dnsdoctor.dev page that explains monitoring and where the domain owner signs in themselv
• validate_dmarc_record ~253 tokens
  Use this when the user pastes a DMARC record and asks whether it is valid, correct or safe. Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews a stronger policy and is capped at p=quarantine

Browse

• Microsoft tools
• IPv4 tools
• Domains and DNS
• Email
• Online shops
• Hiring and jobs

Related MCP servers

• HackMyIP — no-key IP intelligence
  Free no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks
• Deliverability Doctor
  Check if a domain can be email-spoofed: SPF, DMARC, DKIM, MX graded from public DNS. Authless.
• Nslookup
  DNS lookups, health reports, SSL certs, security scans, GEO scoring, uptime checks
• BlackVeil DNS & Email Security Scanner
  DNS and email security scanner with 81 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
• Email Deliverability
  Scan and fix a domain's email deliverability (SPF, DKIM, DMARC, MTA-STS, BIMI, DNS blocklists).
• Dechonet
  30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.
• Send16
  Email for AI agents: send mail, manage contacts, automations & webhooks. Zero-DNS first send.
• FEDLIN Scanners
  Exposes FEDLIN's public security scanners as agent-callable tools over Streamable HTTP.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/dev.dnsdoctor/dns-doctor.svg)](https://aptlynx.net/servers/dev.dnsdoctor/dns-doctor)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents