Dns vs Domain Intel MCP
A side-by-side look at the Dns and Domain Intel MCP MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Dns for communication work as a local process; choose Domain Intel MCP for communication over a hosted endpoint. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Dns when
- You need dedicated capabilities in the Communication domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
check_mx, check_spf, check_dmarc.
Choose Domain Intel MCP when
- You need dedicated capabilities in the Communication domain.
- You prefer a remote HTTP/SSE transport.
- Its auth model fits you: No auth required.
- You want tools like
domain_report, domain_intel, dns_lookup.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Communication | Communication |
| Quality signal | 61/100 · Good | 69/100 · Great |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Remote HTTP/SSE |
| Auth | No auth required | No auth required |
| Pricing | Free | Not declared |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 9 | 1 |
| Directory activity | 0 views 0 installs 0 upvotes | 2 views 0 installs 0 upvotes |
| Tools | 81 | 6 |
| Full listing | View Dns | View Domain Intel MCP |
Tools & capabilities
Dns tools 81
check_mxLook up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbound mail for a domain, or to see MX record configuration. Part of the scan_domain audit.check_spfLook up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use when you need to know who is permitted to send email as a domain. Part of the scan_domain audit.check_dmarcLook up and validate the DMARC record for a domain. Shows the enforcement level (none/quarantine/reject), alignment mode (strict/relaxed), and aggregate/forensic reporting destinations. Use to determine a domain's DMARC enforcement level, whether it sends aggregate reports, or if it is protected against email impersonation — distinct from check_shadow_domains (which checks TLD variants) and assess_spoofability (composite score). Part of the scan_domain audit.check_dkimLook up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound. Part of the scan_domain audit.check_dnssecCheck DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_domain audit.check_sslCheck the HTTPS/TLS posture of a domain: HTTPS reachability, HSTS policy, and HTTP-to-HTTPS redirect. Also returns certificate metadata (issuer, expiry date, days remaining, SAN count) read from public Certificate Transparency logs — this describes the most recently LOGGED certificate, which may differ from the one currently served. Origin TLS protocol support and cipher suites are not assessed; legacy-TLS detection is withdrawn because the probe cannot observe the origin handshake. Use to verify HTTPS/HSTS configuration and certificate issuer/expiry. Part of the scan_domain audit.check_mta_stsCheck whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether inbound SMTP is protected against TLS downgrade or MITM — distinct from check_dane which uses TLSA pinning. Part of the scan_domain audit.check_nsAudit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required glue addresses. Use to detect stale registrar delegations, lame nameservers, and intermittent resolution risk. Part of the scan_domain audit.check_caaLook up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.check_bimiCheck the BIMI brand-logo record at default._bimi.<domain>. Validates the logo URL (l=) and the presence of mark-certificate authority evidence (a=) — the a= tag is a bare URL, so the certificate type (VMC or CMC) is not determined — and verifies the DMARC enforcement prerequisite (p=quarantine/reject) that mail clients require before displaying a BIMI logo. Returns findings for a missing/malformed record or unmet prerequisites. Use to assess brand-indicator readiness in inboxes. Part of the scan_domain audit.check_tlsrptCheck whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its reporting destination (rua= mailto:/https:), flagging a missing record, duplicate records, or an invalid/absent reporting URI. Complements MTA-STS by giving visibility into TLS delivery failures. Part of the scan_domain audit.check_http_securityAudit a domain's browser-facing HTTP security headers over HTTPS. Inspects Content-Security-Policy (flagging unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation headers (COOP/COEP/CORP), and detects CDN/WAF interception. Returns per-header findings for missing or weak protections against XSS, clickjacking, and cross-origin attacks. Part of the scan_domain audit.- +69 more on the listing page
Domain Intel MCP tools 6
domain_reportOne-call full dossier on a domain: registration (RDAP), DNS records, email deliverability, and website tech stack, combined into a single report. Use for fast lead qualification, company research, or recon without four separate calls.domain_intelRegistration intelligence for a domain via RDAP (the modern WHOIS). Returns registrar, creation/expiration/last-changed dates, domain age in years, EPP status codes, nameservers, DNSSEC state, and abuse contact. Use to vet a company, assess a lead, or judge how established a domain is.dns_lookupLook up DNS records for a domain via Cloudflare DNS-over-HTTPS. Returns A, AAAA, MX, NS, TXT, CNAME, and SOA records. Use to see where a domain is hosted, who runs its mail and DNS, and what verification/policy TXT records it publishes.email_deliverabilityAssess whether a domain (or the domain of an email address) can receive mail and how strong its sender authentication is. Returns MX presence, SPF and DMARC policy, whether it's a free consumer provider (gmail, etc.) or a known disposable/temp-mail provider, and an overall verdict. Use to qualify leads and flag throwaway signups.tech_stackFingerprint the technology behind a website by fetching its homepage. Detects web server, CMS/framework (WordPress, Shopify, Next.js, etc.), CDN, analytics, and returns the page title, final URL after redirects, and key response headers. Use for competitive research and lead enrichment.subdomainsDiscover a domain's public subdomains (app., api., staging., and so on) from Certificate Transparency logs, querying crt.sh and Cert Spotter in parallel and returning whichever answers first. Useful for mapping a company's public attack surface or infrastructure. If both sources are down the call returns an error rather than an empty list.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Dns
{
"mcpServers": {
"dns": {
"command": "npx",
"args": [
"-y",
"-p",
"blackveil-dns",
"blackveil-dns-mcp"
]
}
}
}
Domain Intel MCP
{
"mcpServers": {
"domain-intel-mcp": {
"url": "https://domain.datakoot.com/mcp"
}
}
}
Frequently asked questions
Dns is categorized under Communication and uses a local stdio subprocess. Domain Intel MCP belongs to Communication and uses a remote HTTP/SSE transport. Pick Dns for communication work and Domain Intel MCP for communication.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Dns is listed as free. Auth: no auth required. Domain Intel MCP has no declared pricing — check the project's own site. Auth: no auth required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add dns and domain-intel-mcp as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Dns has a quality signal of 61/100 (Good) with 0 views, 0 installs and 9 GitHub stars. Domain Intel MCP has 69/100 (Great) with 2 views, 0 installs and 1 GitHub stars.