Domain Security MCP server

Read from the package source without running it. The installed server may list more.

• analyze_email_headerswrite action

  Parse raw email headers and report the SPF/DKIM/DMARC verdicts (from Authentication-Results), key fields (From, Subject, Date, Message-ID, Return-Path) and the Received hop chain with per-hop delays and total transit time. Args: - headers (string): the raw email headers. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { auth{spf,dkim,dmarc}, fields{}, hops[{in

• bimi_check

  Check a domain's BIMI record (default._bimi.<domain> TXT), which points to the brand logo (and optional VMC) displayed next to authenticated mail. BIMI requires an enforced DMARC policy to take effect. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, findings[] }. Example: "Does cnn.com have BIMI se

• blacklist_check

  Check whether an IPv4 address (or a domain's A records) appears on email DNS blocklists (DNSBLs). Only open-access lists are queried (SpamCop, UCEPROTECT-1, DroneBL, s5h); Spamhaus and Barracuda refuse public-resolver queries and are excluded. Args: - query (string): an IPv4 address or a domain. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ips[], listedCo

• caa_check

  Check a domain's CAA (Certification Authority Authorization) records — which CAs are allowed to issue TLS certificates for it. Absence means any CA may issue. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, issue[], issuewild[], iodef[] }. Example: "Which CAs can issue certs for google.com?" -> caa_check(d

• dkim_check
• dmarc_check

  Fetch and parse a domain's DMARC record (_dmarc.<domain>). Reports the policy (p=), subdomain policy (sp=), reporting addresses (rua/ruf), pct and alignment (aspf/adkim), and warns on monitor-only or partial deployments. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, policy, tags{}, findings[] }.

• dns_lookup

  Resolve all common DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA) for a domain in one call, using public resolvers (Cloudflare/Google/Quad9). Args: - domain (string): the domain to query, e.g. "example.com". - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: a map of record type -> list of records. Each record has { type, host, value, priority? }. Examples:

• dns_propagation

  Compare a domain's DNS records across multiple public resolvers worldwide (Cloudflare, Google, Quad9, OpenDNS, AdGuard) to see whether a change has propagated. Args: - domain (string): the domain to check. - type ('A'|'AAAA'|'CNAME'|'MX'|'NS'|'TXT'): record type (default 'A'). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { type, consistent, resolvers[{name,

• dnssec_check

  Check whether a domain is protected by DNSSEC. Queries DS and DNSKEY records over DNS-over-HTTPS and reads the resolver's Authenticated Data (AD) flag to confirm the chain of trust validates. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { enabled, validated, ds_records, dnskey_records, findings[] }. Example: "Is

• email_auth_auditwrite action
• http_security_headers

  Fetch a URL and grade its HTTP security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP). Returns a 0–100 score, an A–F grade, and per-header notes. Args: - url (string): URL or host to check (scheme defaults to https://). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { url, final_url

• ip_geolocation

  Geolocate an IP address (country, region, city, coordinates, time zone) using the offline DB-IP Lite database, plus its reverse-DNS hostname. No external API. Args: - ip (string): IPv4 or IPv6 address. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ip, country_iso, country_name, region, city, latitude, longitude, time_zone, hostname }. Example: "Where is 15

• mta_sts_check

  Check a domain's MTA-STS deployment: the _mta-sts TXT record AND the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. Reports the enforcement mode (enforce/testing/none) and the listed MX hosts. MTA-STS forces TLS for inbound SMTP and blocks downgrade attacks. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown').

• mx_lookup

  Look up a domain's mail servers (MX records) with priority and the IPs they resolve to. Args: - domain (string): the domain to query. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: array of { exchange, priority, ips[] }. Example: "What are the mail servers for github.com?" -> mx_lookup(domain="github.com").

• reverse_dns

  Resolve the PTR (reverse DNS) records for an IP address — the hostname(s) the IP maps back to. Args: - ip (string): IPv4 or IPv6 address. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ip, hostnames: string[] }. Example: "What hostname does 8.8.8.8 reverse to?" -> reverse_dns(ip="8.8.8.8"). Errors: returns an error if the IP is invalid or has no PTR record.

• spf_check

  Fetch and analyse a domain's SPF record. Detects: missing/multiple records, the trailing 'all' qualifier (+all/?all/~all/-all), and counts DNS-querying terms recursively against the RFC 7208 limit of 10. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, multiple_records, all_qualifier, lookup_count,

• ssl_certificate
• tls_rpt_check

  Check a domain's TLS-RPT record (_smtp._tls.<domain> TXT). TLS-RPT lets you receive reports about TLS delivery failures to your domain. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, findings[] }. Example: "Does microsoft.com publish TLS-RPT?" -> tls_rpt_check(domain="microsoft.com").

• whois_lookup

  Look up domain registration data over the raw WHOIS protocol (port 43): registrar, creation/update/expiry dates, name servers and domain status. Resolves the correct WHOIS server via IANA and follows registrar referrals. No API key. Args: - domain (string): the domain to look up. - response_format ('markdown' | 'json'): output format (default 'markdown'). JSON includes the raw WHOIS text. Returns:

• Code scan20 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 6 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Domain Security: common questions

Is Domain Security MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the Domain Security safety report

How do I install Domain Security?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Domain Security need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Domain Security maintained?

The last commit was 6 days ago (2026-09-14). The latest release is v1.2.1.

What can I use instead of Domain Security?

Servers from other publishers that do the same job: BlackVeil DNS & Email Security Scanner MCP server, Palisade MCP server and Netintel MCP server. Compare all Domain Security alternatives.