Dns Doctor

What dns-doctor does

dns-doctor provides MCP tools for DNS and email-authentication work. A fresh domain scan covers SPF, DKIM, DMARC, MX, DNS hardening, domain and TLS expiry, and blacklist status. Reports include observed values, check statuses, explanations, and generated fixes where the engine can safely provide one.

The server also handles narrower investigations: checking a specific DKIM selector, validating a pasted DMARC record, counting SPF lookups, auditing transitive SPF includes, reading reverse DNS, inspecting BIMI, and looking up registration details through RDAP. Lookalike-domain checks report DNS facts without labeling domains malicious.

For delivery troubleshooting, start an email test and send one message to its single-use address. The resulting analysis can include SPF, DKIM, DMARC alignment, reverse DNS, STARTTLS, blocklists, message characteristics, itemized scoring, and provider-specific delivery estimates for Gmail, Yahoo, Microsoft, and Apple.

How it works

The hosted endpoint is a Streamable HTTP MCP service at https://dnsdoctor.dev/mcp. A local stdio package, @dnsdoctor/mcp, acts as a thin client for the public DNS Doctor API. Both transports expose the same tool set, while the local process does not contain the diagnosis engine.

Fix-producing tools use a deterministic validation engine. DMARC generation and upgrades are subject to policy and evidence gates: a scan can support quarantine at most, while rejection requires an aggregate-report monitoring window. SPF tools diagnose lookup and delegation problems but do not generate an SPF replacement. Returned records must be shown exactly as supplied, and a person remains responsible for publishing them.

Propagation checks use six vantage points and distinguish unavailable observations from negative results. Ordinary record checks compare the domain’s authoritative nameservers with two public caching resolvers, so they are not a worldwide propagation measurement.

Setup and configuration

For Claude Code, add the marketplace and install the dns-doctor plugin:

/plugin marketplace add dnsdoctor/claude-plugin
/plugin install dns-doctor

The plugin connects to the hosted MCP endpoint. Other MCP clients can use this configuration:

{
  "mcpServers": {
    "dns-doctor": {
      "url": "https://dnsdoctor.dev/mcp"
    }
  }
}

The local stdio option uses npx -y @dnsdoctor/mcp@latest with the server command and package arguments configured by the client. Hosted anonymous access covers one-off diagnosis and validation. Monitoring data requires a DNS Doctor API token created under the account’s API-token settings. Pass it as a Bearer header and set DNSDOCTOR_API_TOKEN in the environment; do not commit the token.

Tools and capabilities

• Scan a domain or retrieve its stored report.
• Generate, validate, and assess DMARC records and enforcement upgrades.
• Count SPF lookups and audit nested include or redirect dependencies.
• Check DKIM selectors, BIMI records and certificates, MX, TXT, A, AAAA, CNAME, and reverse DNS.
• Compare DNS results across resolvers and global vantage points.
• Parse DMARC aggregate reports supplied as XML, gzip, or ZIP data.
• Test one real email and retrieve or list previous tests.
• Build a hardening pack for domains confirmed to send no mail.
• Add monitored domains, verify ownership, read alerts, readiness, monitored domains, and watched lookalikes with an account token.

Limitations and notes

DNS Doctor does not publish DNS changes. Ownership verification, DMARC, BIMI, and parked-domain records are returned for human review and publication. The parked-domain pack must only be requested after the owner confirms that the domain sends no email; the server re-checks DNS and can refuse to produce it.

Monitoring tools require an account token and operate on domains associated with that account. Lookalike and registration results are observational: unknown or unresolved names are not treated as available, and DNS resolution alone is not evidence of malicious activity. BIMI mailbox results indicate eligibility, not a guarantee that a logo will appear; Outlook does not support BIMI, and Gmail and Apple Mail require an appropriate certificate.

Cached reports may predate a recent DNS change. Use a fresh scan or a record and propagation check when current state matters. Email-test provider percentages are estimates, not delivery promises, and test messages are handled according to the service’s retention rules.