Log inSubmit server
Dns logo

Dns

Audits DNS, email authentication, TLS, domain impersonation, and related security controls through MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Dns

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "dns": {
      "command": "npx",
      "args": [
        "-y",
        "-p",
        "blackveil-dns",
        "blackveil-dns-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

The dns MCP server audits public DNS, email authentication, web security, and domain impersonation risks through read-only checks. It provides focused tools for SPF, DMARC, DKIM, DNSSEC, MX, TLS, MTA-STS, DANE, HTTP headers, lookalike domains, and DNS hygiene, plus aggregate and comparison scans. Hosted access uses Streamable HTTP without an API key, while native stdio and legacy HTTP+SSE transports are also available. Reach for it when an agent needs to assess one domain, compare several domains, or investigate email and DNS security exposure.

Use cases

  • Audit a domain's email authentication posture
  • Compare security controls across several domains
  • Check DNS and HTTPS configuration before remediation
  • Find lookalike or alternate-TLD phishing risks
  • Review MX reputation and SMTP protection

Key features

  • SPF, DMARC, DKIM, DNSSEC, MX, and TLS checks
  • HTTP security header and certificate inspection
  • Lookalike, shadow-domain, and subdomain-mailing detection
  • Single-domain, batch, comparison, and baseline scans
  • Read-only checks over public DNS and network data
  • Streamable HTTP, stdio, and legacy HTTP+SSE transports

Tools81

What Dns lets your agent do. Expand a tool for its parameters.

Verified live~17.4k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

22/22 checks healthy over the last 89d

What it can do

From the 81 tools this server returned when we ran it; 81 declare their own safety hints.

Runs commands · 1Can delete or modify data · 1Handles credentials · 2Makes network requests · 81Read-only tools · 79
Tool definitions changed on 2026-10-30. Review them if you approved this server earlier.
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age224 days
Maintainers1

Observed 2026-10-30 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 1d ago via OSV.dev · blackveil-dns (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars9Stargazers on the source repository.
npm downloads471Package downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Tools exposed81Callable tools this server registers over MCP.

How Dns works

What dns does

dns is a read-only DNS and email security scanner exposed through the Model Context Protocol. It examines public records and service responses without modifying the target domain or requiring authorization from its owner. The checks cover email authentication, DNS infrastructure, HTTPS configuration, domain impersonation risks, and DNS hygiene.

Focused tools include check_spf, check_dmarc, check_dkim, check_mx, check_dnssec, check_ssl, check_mta_sts, check_caa, check_bimi, check_tlsrpt, check_ptr, and check_http_security. Threat and exposure checks include lookalike domains, alternate TLDs with weak email authentication, subdomain mailing risks, MX reputation, exposed services, and sensitive or stale DNS entries.

For a broader result, scan_domain runs the scan-included checks for one domain and returns a security score, NIST-aligned letter grade, maturity stage, and prioritized findings. batch_scan handles up to 10 domains in parallel. compare_domains compares 2–5 domains, while compare_baseline checks one domain against a fixed policy baseline.

How it works

Most checks use public Cloudflare DNS-over-HTTPS lookups. Some infrastructure checks query authoritative and root nameservers directly over TCP port 53. The authoritative infrastructure check can also test whether nameservers refuse a zone transfer for authenticated callers; it does not retrieve zone data.

The service supports Streamable HTTP through /mcp, native stdio through the blackveil-dns-mcp CLI, and legacy HTTP+SSE. Streamable HTTP clients retain the Mcp-Session-Id returned during initialization and send the negotiated MCP protocol version with later requests. Batch scans can run synchronously or through an asynchronous start, status, and findings workflow.

Setup and configuration

The hosted endpoint is:

text
https://dns-mcp.blackveilsecurity.com/mcp

It uses Streamable HTTP and requires no API key. A health check is available at:

text
https://dns-mcp.blackveilsecurity.com/health

Claude Code can register the endpoint with:

Terminal
claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp

For local stdio use, install the blackveil-dns npm package and run its blackveil-dns-mcp CLI. Smithery installation is also supported with smithery mcp add MadaBurns/bv-mcp. Claude Desktop has a downloadable extension, and the server is listed for Cursor and VS Code MCP use.

Tools and capabilities

  • Inspect SPF authorization, including permitted senders and third-party trust surface.
  • Validate DMARC policy, alignment, and reporting destinations.
  • Check DKIM selectors and reported key algorithms and strength.
  • Review MX hosting, reverse DNS, blocklist reputation, and SMTP TLS controls.
  • Evaluate DNSSEC, CAA, nameserver delegation, SVCB/HTTPS, and zone hygiene.
  • Assess HTTPS reachability, HSTS, redirects, certificates, and browser security headers.
  • Find lookalike domains, alternate TLDs, subdomain mailing risks, and service advertisements.
  • Run single-domain, batch, comparative, baseline, and asynchronous audits.

Limitations and notes

The SSL check reads certificate metadata from public Certificate Transparency logs, so the newest logged certificate may differ from the certificate currently served. It does not assess origin TLS protocols or cipher suites.

SMTP and HTTPS DANE checks report TLSA data as present but unverified. They validate record structure and DNSSEC backing but do not compare the pin with the live certificate. The HTTPS comparison pipeline is withdrawn, and the SMTP check has no port-25 certificate probe.

A lack of matches from the SRV check does not prove that a domain has no services because it probes a defined set of common prefixes. Lookalike detection, shadow-domain detection, and legitimate brand-domain discovery address different domain sets and should not be treated as interchangeable.

The project is source-available under BUSL-1.1. Hosted and self-hosted deployments can expose different operator-only capabilities; the core public scanning functions are read-only.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Dns

dns is an MCP server that connects AI clients to public DNS, email, and web-security checks. Its main tools inspect SPF, DMARC, DKIM, DNSSEC, MX, TLS, MTA-STS, HTTP headers, domain impersonation risks, and DNS hygiene, with broader scans available for individual or multiple domains.

Use the hosted MCP endpoint without installing a local service, or install the `blackveil-dns` npm package for native stdio. Claude Code can register the hosted endpoint with `claude mcp add --transport http`, and Smithery supports `smithery mcp add MadaBurns/bv-mcp`.

Yes, dns is identified for use with Cursor. Configure Cursor as an MCP client using either the hosted Streamable HTTP endpoint or a compatible local stdio setup.

No, the hosted endpoint requires no API key. Connect to `https://dns-mcp.blackveilsecurity.com/mcp` over Streamable HTTP; local stdio deployments use the `blackveil-dns-mcp` CLI.

Yes, `batch_scan` scans up to 10 domains in parallel and returns a score, letter grade, and finding counts for each. Asynchronous batch tools provide a job ID, status polling, and findings retrieval when a durable workflow is needed.

Related MCP servers

All in Communication All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewDns AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/dns?style=directory)](https://allmcps.com/mcp/dns)
HTML Embed
<a href="https://allmcps.com/mcp/dns"><img src="https://allmcps.com/api/badge/dns?style=directory" alt="Dns on AllMCPs" /></a>