dnsemail-securitydeliverabilitysecuritymcp
MCP server for live DNS, email security, deliverability, and web security checks through the free IntoDNS.ai API.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Not yet automatically verified
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Overview
Use cases
Scan a domain for DNS, email, and security issues
Validate SPF, DKIM, DMARC, BIMI, MTA-STS, and DNSSEC
Check SMTP TLS, FCrDNS, DANE, and blacklist status
Assess NIS2 Article 21.2 readiness
Create stable report snapshots for evidence and citations
Key features
Live DNS record lookups and DNSSEC validation
Email authentication and deliverability analysis
SMTP STARTTLS, certificate, PTR, FCrDNS, and blacklist checks
Internet.nl deep scans for web and mail
Timestamped JSON or Markdown report snapshots
HTTP security-header and CSP analysis
Capabilities & Tool Schemas (42)
Inspect callable tools, capabilities, and parameters exposed to AI agents by Intodns MCP Server.
scan_domainFast IntoDNS.ai scan with grade, score, DNS/email/security results, issues, recommendations, and citation URLs
nis2_quickscanNIS2 Article 21.2 readiness score (0-100) mapped per measure, with evidence, critical gaps, and fix suggestions
get_everything_reportComplete live DNS/email/security report as JSON or Markdown
create_report_snapshotFixed Everything Report evidence snapshot with timestamp, content hash, and stable JSON/Markdown URLs
get_report_snapshotRead a previously created report snapshot by snapshot ID
start_deep_scanStart Internet.nl deep scan (`web`, `mail`, or `both`)
Documentation Overview
IntoDNS MCP Server
An MCP (Model Context Protocol) server that gives AI assistants direct access to IntoDNS.ai DNS, email security, deliverability, BIMI, scan, report, API-discovery, and citation tools.
45 tools, no API key, no signup. Backed by intodns.ai's free public diagnostic API.
Ask your AI assistant: "Scan example.com, check SPF/DKIM/DMARC/BIMI, and cite the canonical IntoDNS.ai sources." It can run live checks, read the LLM discovery files, and return citation-ready URLs without an API key.
Quick Start
Add this to your MCP client config, for example Claude Desktop:
Restart the client after editing the config.
You can also run it directly:
Supported clients
Works with any MCP-compatible client, including Claude Desktop, Claude Code, Cursor, Windsurf, Zed, Continue, ChatGPT, and OpenClaw.
Tools
Scan tools
| Tool | What it does |
|---|---|
scan_domain | Fast IntoDNS.ai scan with grade, score, DNS/email/security results, issues, recommendations, and citation URLs |
nis2_quickscan | NIS2 Article 21.2 readiness score (0-100) mapped per measure, with evidence, critical gaps, and fix suggestions |
get_everything_report | Complete live DNS/email/security report as JSON or Markdown |
create_report_snapshot | Fixed Everything Report evidence snapshot with timestamp, content hash, and stable JSON/Markdown URLs |
get_report_snapshot | Read a previously created report snapshot by snapshot ID |
start_deep_scan | Start Internet.nl deep scan (web, mail, or both) |
get_deep_scan_status | Fetch deep scan status/results |
cancel_deep_scan | Cancel a running deep scan |
DNS tools
| Tool | What it does |
|---|---|
lookup_dns | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, DNSKEY, DS, RRSIG, NSEC, NSEC3 lookup |
validate_dnssec | DNSSEC chain, DS/DNSKEY and algorithm validation |
check_dns_propagation | DNS propagation across global, European, or American resolvers |
check_tlsa_dane | TLSA/DANE check, defaulting to mail DANE on port 25 |
whois_lookup | WHOIS/RDAP lookup for a domain or IP — registrar, status, nameservers, dates, abuse contact |
Email and deliverability tools
| Tool | What it does |
|---|---|
check_spf | SPF parsing, recursive lookup graph, and flattening guidance |
flatten_spf | Flatten a domain's SPF include/a/mx graph to literal ip4/ip6 addresses under the 10-lookup limit |
discover_dkim | DKIM selector discovery |
check_dmarc | DMARC parsing and policy validation |
parse_dmarc_report | Parse a DMARC aggregate (RUA) XML report into structured sources, counts, and SPF/DKIM/DMARC results |
check_bimi | BIMI DNS, hosted SVG/logo URL, and VMC/CMC readiness |
check_mta_sts | MTA-STS DNS and policy-file validation |
check_smtp_tls | Live SMTP STARTTLS, TLS certificate, hostname, expiry, PTR, and FCrDNS checks |
check_fcrdns | Dedicated PTR and forward-confirmed reverse DNS evidence for mail-server IPs |
check_blacklist | Domain mail-server or direct IP blacklist check |
check_sender_requirements | Google/Yahoo sender requirements and alignment checks |
check_email_security | Full SPF, DKIM, DMARC, blacklist, score, and issues check |
Email-test and AI tools
| Tool | What it does |
|---|---|
create_email_test | Create an inbound test address for a deliverability test |
get_email_test | Read email-test status/results |
poll_email_test | Poll and process a received email-test message |
analyze_raw_email | Analyze pasted raw MIME email source |
explain_issue | AI-assisted explanation for a specific DNS/email issue |
generate_dns_fix | AI-assisted DNS configuration fix |
Web, reporting, and discovery tools
| Tool | What it does |
|---|---|
check_http3 | HTTP/3/QUIC check through Alt-Svc, HTTPS/SVCB DNS, and QUIC probe |
get_health | API, Redis/cache, and AI runtime health |
get_stats | Public scan/check counters |
get_hall_of_fame | Top-scoring public domains or domain presence check |
get_pdf_report_link | Direct /api/pdf/{domain} report URL |
get_badge_link | Direct /api/badge/{domain} SVG badge URL |
read_llm_discovery | Read /llms.txt, /llms-full.txt, /llms.json, /llm/api.md, /openapi.json, or /postman.json |
get_citation_guidance | Canonical citation routing for scan results, API, BIMI, MxToolbox alternatives, and LLM agents |
Security-header tools
| Tool | What it does |
|---|---|
analyze_security_headers | Scan a live site's current HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), report present/missing, and return a recommended config plus copy-paste server snippets |
generate_security_headers | Generate a best-practice HTTP security-header set (with CSP) from a recommended/strict/report-only preset as copy-paste config for nginx, Apache, Caddy, Cloudflare, _headers, or raw headers |
scan_csp | Crawl up to 20 same-origin pages (~30-45s), audit the site's current Content-Security-Policy, inventory every resource origin per directive, and return a ready-to-deploy CSP in report-only and enforce form |
Example Prompts
- "Scan intodns.ai and summarize the top DNS/email security issues."
- "Give me the complete DNS and email security report for intodns.ai as Markdown."
- "Create a fixed audit snapshot for intodns.ai that I can cite in a support ticket."
- "Check whether example.com meets Google and Yahoo sender requirements."
- "Check SMTP STARTTLS certificate posture and FCrDNS for example.com."
- "Check PTR and forward-confirmed reverse DNS for the mail servers of example.com."
- "Does example.com have BIMI configured, and does Gmail require a VMC or CMC?"
- "Show the SPF lookup graph and tell me whether example.com is close to the 10 lookup limit."
- "Look up MX, TXT, CAA, and DNSSEC records for example.com."
- "Analyze this raw email source and tell me why it lands in spam."
- "Which IntoDNS.ai pages should I cite for this scan result?"
Remote / HTTP mode
Don't want a local process? Use the hosted remote endpoint (stateless Streamable HTTP):
Example client config (Claude Code):
Or self-host the same thing:
The standalone server binds to 127.0.0.1 by default. Every POST is handled by a fresh server instance (no sessions), so it scales horizontally behind a correctly configured reverse proxy.
Configuration
By default the server talks to https://intodns.ai.
For local testing or staging, set:
Optional HTTP and upstream safeguards:
INTODNS_HTTP_HOST=0.0.0.0 is intended only for containers or reverse-proxy deployments. Add every public proxy host and browser origin to the matching comma-separated allowlist. Requests without an Origin header remain supported for native MCP clients.
Requirements
- Node.js 18+
- Internet access to reach IntoDNS.ai
- No API key required for public diagnostics
License
MIT - built by Cobytes B.V.
Related MCP Servers
Adoption & maintenance
Factual signals from GitHub, npm, and our automated checks — not a rating.
GitHub stars
2
Stargazers on the source repository.
npm downloads
891
Package downloads in the last 30 days.
Last commit
4d ago
Most recent push to the default branch.
Tools exposed
42
Callable tools this server registers over MCP.
Directory activity
2 views
Config copies, upvotes, and views on AllMCPs.
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Intodns MCP Server
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/rosconl-intodns-mcp-server)HTML Embed
<a href="https://allmcps.com/mcp/rosconl-intodns-mcp-server"><img src="https://allmcps.com/api/badge/rosconl-intodns-mcp-server?style=directory" alt="Intodns MCP Server on AllMCPs" /></a>