Intodns MCP Server

What RoscoNL/intodns-mcp-server MCP server does

RoscoNL/intodns-mcp-server MCP server exposes IntoDNS.ai diagnostics as MCP tools for AI clients. Its checks cover DNS records, DNSSEC, propagation, SPF, DKIM, DMARC, BIMI, MTA-STS, SMTP STARTTLS, FCrDNS, TLSA/DANE, mail-server blacklists, sender requirements, and HTTP/3. It also provides WHOIS/RDAP lookups, security-header and CSP analysis, raw email analysis, DMARC report parsing, and inbound email testing.

The main entry point is scan_domain, which returns a grade, numeric score, detected issues, recommendations, detailed result sections, and citation URLs. Use get_everything_report for a broader live report or start_deep_scan for an Internet.nl-style audit that runs asynchronously. All of these diagnostics are read-only except for additive operations such as creating an email-test session or report snapshot; they do not change DNS or mail configuration.

How it works

The server sends requests to the public IntoDNS.ai API and returns structured results through MCP. Most tools require only a domain, while specialized operations accept inputs such as a DNS record type, DKIM selector, IP address, scan ID, snapshot ID, raw email, or DMARC XML. No authentication or API key is required for the public diagnostic functions.

Long-running scans use a start-and-poll pattern: call start_deep_scan, then check get_deep_scan_status until completion. Report snapshots create write-once evidence with a timestamp, SHA-256 hash, snapshot ID, and stable JSON and Markdown URLs. Email tests create a temporary address valid for 60 minutes; after sending a message, retrieve or process the result with get_email_test or poll_email_test.

Setup and configuration

RoscoNL/intodns-mcp-server MCP server requires Node.js 18+ and internet access to reach IntoDNS.ai. The local stdio configuration runs the package with npx -y intodns-mcp. It can also be used through the hosted Streamable HTTP endpoint at https://intodns.ai/api/mcp, or started locally in HTTP mode with npx intodns-mcp --http 3002.

The default upstream is https://intodns.ai. INTODNS_SITE_URL can point to a local or staging instance. Optional controls include INTODNS_REQUEST_TIMEOUT_MS, INTODNS_HTTP_HOST, INTODNS_ALLOWED_HOSTS, and INTODNS_ALLOWED_ORIGINS. The standalone HTTP server binds to 127.0.0.1 by default. When placed behind a proxy, configure the host and origin allowlists for the public endpoint; native MCP requests without an Origin header remain supported.

Tools and capabilities

Useful tool groups include:

• Scan and compliance: scan_domain, nis2_quickscan, get_everything_report, report snapshots, and Internet.nl deep scans.
• DNS: arbitrary record lookup, DNSSEC validation, resolver comparison, WHOIS/RDAP, and TLSA/DANE checks.
• Email security: SPF graph analysis and flattening, DKIM discovery, DMARC parsing, BIMI, MTA-STS, SMTP TLS, FCrDNS, blacklist checks, and sender requirements.
• Message analysis: temporary email tests, raw MIME inspection, DMARC aggregate parsing, issue explanations, and DNS fix generation.
• Web posture: HTTP/3 checks, security-header analysis, CSP crawling, and configuration generation.

Limitations and notes

RoscoNL/intodns-mcp-server MCP server reports current observations rather than guaranteeing full compliance. The NIS2 score covers only DNS and email controls, not applications, supply chain, organisational processes, or training. DKIM discovery without a known selector is heuristic and a miss is inconclusive. BIMI checks do not certify SVG profile compliance, certificate trust, trademark ownership, or mailbox-provider logo display.

TLSA/DANE checks inspect DNS records but do not cryptographically compare them with a live certificate. Sender-requirement checks cannot verify message behavior such as complaint rate or one-click unsubscribe without provider telemetry. Blacklist checks are reputation signals, not delisting services. Flattened SPF records require maintenance when providers change their IP ranges. SMTP and deep scans can take substantially longer than the fast scan.