Search / com.tamingdns/mcp
protogridR0· no sign-inCheck SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, DANE, DNSSEC and TXT; read headers and bounces.
v2.0.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"tamingdns": {
"type": "http",
"url": "https://tamingdns.com/mcp"
}
}
}claude mcp add --transport http tamingdns https://tamingdns.com/mcp[mcp_servers.tamingdns]
url = "https://tamingdns.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"tamingdns": {
"type": "remote",
"url": "https://tamingdns.com/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"tamingdns": {
"type": "http",
"url": "https://tamingdns.com/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=tamingdns&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdGFtaW5nZG5zLmNvbS9tY3AifQ%3D%3D"
}{
"servers": {
"tamingdns": {
"type": "http",
"url": "https://tamingdns.com/mcp"
}
}
}{
"mcpServers": {
"tamingdns": {
"httpUrl": "https://tamingdns.com/mcp"
}
}
}extensions:
"tamingdns":
enabled: true
name: "tamingdns"
type: streamable_http
uri: "https://tamingdns.com/mcp"
timeout: 300
protocol.modernprotocol.statelessprotocol.transportprotocol.list_ttlauth.prm, auth.as_metadata, auth.cimdauth.secret_in_urltools.descriptionstools.description_lengthtools.schemastools.annotationstools.directory_hintstools.token_costtools.api_dumptools.hidden_textstability.changesstability.rug_pullstability.new_linksdeps.known_vulns, deps.mcp_sdk_version, deps.resolvablecheck_dns_propagationchangeddescriptionAsk 14 public DoH resolvers in North and South America, Europe and Asia (Google, Cloudflare, Quad9, CIRA, Comcast, Mullvad, DNSPod, IIJ, DNS.SB and more) for one record type at one name, and report whether they agree. Use it after changing a record to see whether the change has spread. `resolvers[]` gives every resolver's answer (`values`, `ttl`, `status` agree / disagree / unavailable), so compare those with the value you published; `records[]` is the most common answer and `analysis.propagation_pct` the share of answering resolvers that gave it. `verdict` is consistent (all agree), absent (all agree there is no record), rotating (a resolver changed its own answer when asked again: load balancing), split_short_ttl (answers differ and every TTL is 300 s or less: CDN or GeoDNS), split (answers differ with no such explanation: finding RESOLVERS_DISAGREE, status warn) or incomplete (fewer than half answered: finding RESOLVERS_PARTIAL, status warn). Otherwise status is info: this tool reports data, not a grade. A timeout is never counted as "no record"; if no resolver answers, the result is a retriable DOH_TIMEOUT error. Not cached, so you can poll it, but it has its own rate limit, lower than the other tools: poll no more often than every 10 seconds, and on error -32029 wait retry_after seconds. Each call queries all 14 resolvers (twice when they disagree). Read-only.
Ask 14 public DoH resolvers in North and South America, Europe and Asia (Google, Cloudflare, Quad9, CIRA, Comcast, Mullvad, DNSPod, IIJ, DNS.SB and more) for one record type at one name, and report whether they agree. Use it after changing a record to see whether the change has spread. `resolvers[]` gives every resolver's answer (`values`, `ttl`, `status` agree / disagree / unavailable), so compare those with the value you published; `records[]` is the most common answer and `analysis.propagation_pct` the share of answering resolvers that gave it (null, like `analysis.record_absent`, when verdict is incomplete). `verdict` is consistent (all agree), absent (all agree there is no record), rotating (a resolver changed its own answer when asked again: load balancing), split_short_ttl (answers differ and every TTL is 300 s or less: CDN or GeoDNS), split (answers differ with no such explanation: finding RESOLVERS_DISAGREE, status warn) or incomplete (fewer than half answered: finding RESOLVERS_PARTIAL, status warn). Otherwise status is info: this tool reports data, not a grade. A timeout is never counted as "no record"; if no resolver answers, the result is a retriable DOH_TIMEOUT error. Not cached, so you can poll it, but it has its own rate limit, lower than the other tools: poll no more often than every 10 seconds, and on error -32029 wait retry_after seconds. Each call queries all 14 resolvers (twice when they disagree). Read-only.
analyze_email_headerschangedoutput schemacheck_mcp_keyschangedoutput schemacheck_websitechangedoutput schemaanalyze_dmarc_reportchangedoutput schemadecode_bouncechangedoutput schemacheck_txtchangedoutput schemacheck_dns_propagationchangedoutput schemacheck_google_workspacechangedoutput schemacheck_m365changedoutput schemaShowing the latest 10. Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +dns-namespace +website +reachable +uptime-100% +updated-1d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://tamingdns.com/mcp streamable-http | none | yes | 100% | 210 ms | 2025-11-25 | 2026-11-14 |
analyze_dmarc_reportread-only | Read one DMARC aggregate (RUA) report, the XML a receiver sends to the rua= address, pasted as text (decompress a .xml.gz first). Returns who reported and when (analysis.report), the policy the domain published (analysis.policy), message totals and the split into DMARC-capable, forwarded (SPF failed, DKIM aligned) and unauthenticated (both failed) mail, every source row with its IP, count, disposition, SPF/DKIM alignment and the sending provider when known (analysis.records, up to 500), and the recommendations the /dmarc-report page shows (analysis.recommendations). `verdict` is unauthenticated_mail, clean or empty_report. Findings: DMARC_REPORT_UNAUTH_NOT_ENFORCED (error: unauthenticated mail under p=none), DMARC_REPORT_UNAUTH_QUARANTINED, DMARC_REPORT_POLICY_UNKNOWN, DMARC_REPORT_LOW_COMPLIANCE, DMARC_REPORT_SP_WEAKER, DMARC_REPORT_RECORDS_SKIPPED (warn), DMARC_REPORT_FORWARDED, DMARC_REPORT_PCT_PARTIAL, DMARC_REPORT_EMPTY (info). A report reflects what receivers saw; check the live record with check_dmarc. Input that is not a <feedback> document, declares a DOCTYPE or is oversize returns the non-retriable INPUT_INVALID error. The echoed `input` is the byte count only; the report is parsed in server memory, not cached and not stored. Read-only. |
analyze_email_headersread-only | Analyse a pasted block of raw email headers for spoofing and phishing tells. Input is the raw headers (everything up to the first blank line — "Show original" / "View source"); the message body is not required. Returns structured findings + a phishing verdict (one of likely_phishing, verify_sender, minor_concerns, legitimate, auth_incomplete) derived from SPF/DKIM/DMARC alignment (RFC 7489 §3.1), Microsoft composite-auth compauth reason codes (000/010 enforced failure, 601 intra-org implicit failure, 001 weak posture), ARC chain integrity (RFC 8617 §5.2), homoglyph / IDN look-alike From domains (Unicode UTS #39), header smuggling via duplicate singleton headers (RFC 5322 §3.6), display-name-as-address spoofing, hidden bidi/control characters (UAX #9), Received-chain timestamps running backward (RFC 5321 §4.4), link display-text-vs-href mismatches, originating-IP FCrDNS (RFC 8601), and RFC 8058 List-Unsubscribe deliverability posture (category:compliance, never moves the verdict). Findings include DMARC_FAILED, SPF_HARD_FAIL, DKIM_SIGNATURE_FAILED, COMPAUTH_EXPLICIT_FAILURE, COMPAUTH_INTRA_ORG_IMPLICIT_FAILURE, HOMOGLYPH_DOMAIN, DUPLICATE_HEADER, DISPLAY_NAME_SPOOFED_ADDRESS, RECEIVED_TIMESTAMPS_BACKWARD, URL_DISPLAY_MISMATCH, HIDDEN_CONTROL_CHAR, BRAND_IMPERSONATION, and more (registry: resources/read mcp://tamingdns/resources/finding-codes). `status` is the finding-severity aggregate; `verdict` is the authoritative phishing judgment; `analysis` carries the verdict object + per-mechanism authentication. For privacy the echoed `input` is a digest only (from / subject / message_id) — raw headers are never returned. Read-only. |
check_bimiread-only | Check default._bimi.<domain>: parses the BIMI record, validates the SVG Tiny-PS logo, inspects the VMC chain (expiry, EKU, SCT, issuer-accepted, SAN match, logotype hash), and verifies the DMARC prerequisite (p=quarantine/reject at pct=100 with no sp=none — the RFC 7489 reading Gmail and Apple Mail evaluate today). DMARCbis (RFC 9989) aware: t= is parsed into analysis.dmarc.t, t=y emits TESTING_MODE (warn under p=quarantine — bis receivers read it as none; info under p=reject), and a present pct= emits DEPRECATED_TAG (removed by RFC 9989 Appendix A.6, advisory only). Returns grade (A-F), structured findings, and an `analysis` block (logo/vmc/dmarc/provider_matrix). Read-only. |
check_daneread-only | Check SMTP DANE / TLSA records for a domain (RFC 7672). Resolves the MX hosts (falls back to the apex when none), looks up the TLSA record at _25._tcp.<mx-host> over binary DoH, classifies each record (usage 0-3 / selector 0-1 / matching 0-2 per RFC 7671 §2.1), and confirms the answer carried the DNSSEC AD bit — DANE is meaningless without DNSSEC, so an unsigned TLSA answer is the dominant failure mode. Returns grade (A-F) with grade_reasons, a verdict (valid/valid_with_warnings/no_dnssec/not_configured/error), structured findings (DANE_NO_TLSA, DANE_TLSA_HOST_UNSIGNED, DANE_PKIX_TA_USED_WITHOUT_CHAIN, DANE_TLSA_EXACT_MATCH, DANE_PARTIAL_COVERAGE, DANE_TLSA_INVALID_USAGE/SELECTOR/MATCHING), and an `analysis` block (per-host TLSA records + DNSSEC status, the spec-compliance signals, and the MTA-STS cross-signal). DNS-only: it never opens a port-25 STARTTLS handshake, so it proves the TLSA records exist, are well-formed, and are DNSSEC-signed — never that they match the live cert (Hostinger and Cloudflare both block outbound 25). Read-only. |
check_dkimread-only | Look up a DKIM public key at <selector>._domainkey.<domain> and validate it. Detects key revocation (empty p=), RSA key length (KEY_TOO_SHORT below 1024, KEY_WEAK below 2048), SHA-1 hash deprecation, and t=y test mode. For selector1/selector2 it also checks a Microsoft 365 CNAME target carries the token Microsoft builds for the domain (M365_DKIM_CNAME_MISMATCH), even when no key resolves. Returns an `analysis` block with the per-key facts (key_type, key_bits, key_strength, revoked, test_mode, hash_algs, m365_cname). Read-only. |
check_dmarcread-only | Check the _dmarc record for a domain with DUAL discovery: the RFC 7489 §6.6.3 organisational-domain ladder (what major receivers enforce today — grade/verdict anchor to it) AND the RFC 9989 §4.10 DNS Tree Walk (8-query cap, psd=n/y stop rules, fewest-labels org selection) into analysis.discovery {legacy, tree_walk, diverges}. When the two methods select different policy records or org domains, DISCOVERY_DIVERGENCE (warn) fires with a one-notch grade downgrade. Also DMARCbis tag-aware: t=/np=/psd= parsed into analysis.tags, removed tags (pct/rf/ri) emit DEPRECATED_TAG, t=y emits TESTING_MODE with a one-notch downgrade. Returns the grade (A-F) with grade_reasons, a verdict (enforced/partial/monitoring/monitoring_blind/invalid/not_configured), structured findings (NO_DMARC_RECORD, DMARC_RECORD_IGNORED, MULTIPLE_DMARC_RECORDS, INVALID_TAG, POLICY_NONE, POLICY_NONE_NO_RUA, PCT_BELOW_100, RUA_MISSING_UNDER_ENFORCEMENT, SP_NOT_ENFORCED, EXTERNAL_RUA_UNAUTHORIZED, DMARC_INHERITED_FROM_ORG, TESTING_MODE, DEPRECATED_TAG, DISCOVERY_DIVERGENCE), and an `analysis` block with the lookup ladder, discovery, source (self/org), org_domain, normalised tags, per-recipient RUA/RUF external-authorisation detail (RFC 7489 §7.1), and rua_unauthorised. Read-only. |
check_dns_propagationread-only | Ask 14 public DoH resolvers in North and South America, Europe and Asia (Google, Cloudflare, Quad9, CIRA, Comcast, Mullvad, DNSPod, IIJ, DNS.SB and more) for one record type at one name, and report whether they agree. Use it after changing a record to see whether the change has spread. `resolvers[]` gives every resolver's answer (`values`, `ttl`, `status` agree / disagree / unavailable), so compare those with the value you published; `records[]` is the most common answer and `analysis.propagation_pct` the share of answering resolvers that gave it (null, like `analysis.record_absent`, when verdict is incomplete). `verdict` is consistent (all agree), absent (all agree there is no record), rotating (a resolver changed its own answer when asked again: load balancing), split_short_ttl (answers differ and every TTL is 300 s or less: CDN or GeoDNS), split (answers differ with no such explanation: finding RESOLVERS_DISAGREE, status warn) or incomplete (fewer than half answered: finding RESOLVERS_PARTIAL, status warn). Otherwise status is info: this tool reports data, not a grade. A timeout is never counted as "no record"; if no resolver answers, the result is a retriable DOH_TIMEOUT error. Not cached, so you can poll it, but it has its own rate limit, lower than the other tools: poll no more often than every 10 seconds, and on error -32029 wait retry_after seconds. Each call queries all 14 resolvers (twice when they disagree). Read-only. |
check_dnssecread-only | Validate a domain's DNSSEC chain of trust. Pulls DS (at the parent), DNSKEY, and RRSIG over binary DoH, walks the chain zone-by-zone (root → TLD → domain) recomputing each DS digest against the published DNSKEYs (RFC 4034 §5.1.4), and cross-checks the AD bit across Cloudflare, Google, Quad9, and OpenDNS so a single resolver's caching can't mask a break. Returns grade (A-F) with grade_reasons, a verdict (signed/signed_no_ds/partial/unsigned/broken), structured findings (DNSSEC_UNSIGNED, DNSSEC_DS_MISSING_AT_PARENT, DNSSEC_DS_ALGORITHM_DEPRECATED, DNSSEC_DNSKEY_ALGORITHM_DEPRECATED, DNSSEC_RRSIG_EXPIRED, DNSSEC_BOGUS, DNSSEC_AD_BIT_MISSING), and an `analysis` block (the full chain-walk, the per-resolver validator matrix, NSEC3 iteration/opt-out, CDS/CDNSKEY publication, signing mode, root-anchor state). Unsigned is the common case and returns status "info" (DNSSEC is optional), not a failure; signed_no_ds (DNSKEY published, no DS at the parent yet) is treated by validators as unsigned and also returns "info"; a published-but-non-validating zone returns "fail". Read-only. |
check_google_workspaceread-only | Audit a domain's DNS against what Google Workspace expects: MX to Google (smtp.google.com, or the legacy aspmx hosts Google still supports), SPF includes _spf.google.com, a DKIM key at the default google selector (google._domainkey), DMARC policy and rua=, MTA-STS, TLS-RPT and BIMI. Built from the same envelopes check_spf, check_dkim, check_dmarc, check_mx, check_mta_sts, check_tls_rpt and check_bimi return, so it never disagrees with them. `verdict` is configured / configured_with_issues / not_detected / unknown (no indicator found Google Workspace and at least one did not answer). A domain with no Google Workspace indicator (MX, SPF include, google DKIM key) returns only GWS_NOT_DETECTED (status info). A check that could not run is listed in GWS_CHECK_INCOMPLETE and its `analysis.checks[]` entry is `unknown`, never "missing". No key at the google selector is a warning, not a failure, because an admin can choose another prefix: call check_dkim with that selector. Findings include GWS_SPF_NO_GOOGLE_INCLUDE, GWS_SPF_INVALID, GWS_DKIM_DEFAULT_SELECTOR_NOT_FOUND, GWS_DKIM_KEY_WEAK, GWS_DMARC_MISSING, GWS_DMARC_NOT_ENFORCING, GWS_MX_NOT_GOOGLE, GWS_MTA_STS_MISSING, GWS_TLS_RPT_MISSING_UNDER_ENFORCE and more (registry: resources/read mcp://tamingdns/resources/finding-codes). Read-only. |
check_m365read-only | Audit a domain's DNS against what Microsoft 365 expects: SPF includes spf.protection.outlook.com, DKIM selector1/selector2 (CNAME target and key), DMARC policy and rua=, MX to Microsoft 365 (*.mail.protection.outlook.com or *.mx.microsoft), MTA-STS, Autodiscover to autodiscover.outlook.com, TLS-RPT, BIMI, and the Teams SIP SRV records. Built from the same envelopes check_spf, check_dkim, check_dmarc, check_mx, check_mta_sts, check_tls_rpt and check_bimi return, so it never disagrees with them. `verdict` is configured / configured_with_issues / not_detected / unknown (no indicator found Microsoft 365 and at least one did not answer). A domain with no Microsoft 365 indicator returns only M365_NOT_DETECTED (status info). A check that could not run is listed in M365_CHECK_INCOMPLETE and its `analysis.checks[]` entry is `unknown`, never "missing". Findings include M365_SPF_NO_O365_INCLUDE, M365_SPF_INVALID, M365_DKIM_SELECTOR_MISSING, M365_DKIM_NO_KEY_AT_CNAME, M365_DKIM_CNAME_MISMATCH, M365_DMARC_MISSING, M365_DMARC_NOT_ENFORCING, M365_MX_NOT_M365, M365_MTA_STS_MISSING, M365_AUTODISCOVER_MISSING, M365_TLS_RPT_MISSING_UNDER_ENFORCE and more (registry: resources/read mcp://tamingdns/resources/finding-codes). Read-only. |
check_mcp_keysread-only | Read the v=MCPv1 TXT records at a domain, the keys the MCP Registry DNS login (mcp-publisher login dns) verifies a signature against, and judge each the way the registry does: v=MCPv1; k=<algorithm>; p=<key> in that order and case, k exactly ed25519 or ecdsap384, p padded standard base64 of a 32-byte ed25519 key or a 49-byte compressed P-384 point that lies on the curve. `verdict` is not_configured (info), valid (every record usable, pass), some_invalid (warn), invalid (none usable, fail) or misplaced (fail: no usable record at the domain, but one at _mcp-auth. or _mcp-registry., which the registry never reads; MCP_KEYS_MISPLACED, analysis.misplaced); no grade. Each problem is a warn finding whose title names the key: MCP_KEYS_RECORD_IGNORED, MCP_KEYS_UNKNOWN_ALGORITHM, MCP_KEYS_KEY_NOT_BASE64, MCP_KEYS_KEY_WRONG_LENGTH, MCP_KEYS_ECDSA_NOT_COMPRESSED, MCP_KEYS_ECDSA_NOT_ON_CURVE. MCP_KEYS_NO_VALID_KEY (error) means the login will fail; MCP_KEYS_NO_RECORD (info) means there is no record, and many hosted MCP servers use OAuth instead. `analysis.keys[]` carries algorithm, key length and SHA-256 fingerprint per record; `analysis.apex` names the registrable domain when the input was a subdomain. Read-only. |
check_mta_stsread-only | Check MTA-STS (RFC 8461) for a domain: the _mta-sts TXT record (strict §3.1 selection — case-sensitive leading v=STSv1, exactly one record, required 1-32 alphanumeric id), the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt fetched WITHOUT following redirects (§3.3), strict §3.2 policy validation (version/mode/max_age required, mx required unless mode none, max_age ≤ 31557600, duplicate keys first-wins), the policy-host X.509 certificate (§3.3 — an invalid cert means compliant senders fetch no policy), and live MX coverage against the mx: patterns (§4.1 — wildcards match exactly one leftmost label; coverage is all/partial/none, partial meaning strict senders skip the uncovered hosts per §5.1). Returns grade (A-F) with grade_reasons, a verdict (enforced/testing/reporting_only/invalid/not_configured), structured findings (MTA_STS_NO_TXT_RECORD, MTA_STS_RECORD_INVALID, MULTIPLE_MTA_STS_RECORDS, MTA_STS_POLICY_UNREACHABLE, MTA_STS_POLICY_REDIRECT, MTA_STS_POLICY_INVALID, MTA_STS_CERT_INVALID, MTA_STS_MODE_NONE, MTA_STS_MODE_TESTING, MTA_STS_MX_MISMATCH, MTA_STS_MX_PARTIAL_COVERAGE, MTA_STS_MAX_AGE_TOO_LOW), and an `analysis` block (record, policy incl. fetch_stage, cert, MX coverage detail, TLS-RPT/DANE cross-signals). Read-only. |
check_mxread-only | Inspect a domain's MX / mail-routing posture. Resolves the apex MX RRset (priority-sorted), and for each host the A/AAAA addresses, PTR + forward-confirmed reverse DNS (FCrDNS), DANE TLSA at _25._tcp.<host>, IP-literal (RFC 5321 §5) and CNAME (RFC 2181 §10.3) violations, and the mail provider. Detects the null MX (RFC 7505), a null MX wrongly mixed with real MX, and the implicit MX via the apex A/AAAA when no MX exists (RFC 5321 §5). Probes the MTA-STS and TLS-RPT prerequisites over DNS (case-sensitive per RFC 8461/8460) with outage reported as unknown, never absence. Returns grade (A-F) with grade_reasons, a verdict (healthy/warnings/misconfigured/null_mx/no_mx/implicit_mx), structured findings (NO_MX_RECORD, MX_IMPLICIT_FALLBACK, NULL_MX, NULL_MX_WITH_OTHER, MX_POINTS_TO_IP, MX_POINTS_TO_CNAME, MX_HOSTNAME_UNRESOLVABLE, NO_PTR_RECORD, FCRDNS_MISMATCH, MX_IPV6_ONLY, MX_NO_TRANSPORT_SECURITY, MX_GATEWAY_RDNS_COSMETIC, MX_SINGLE_HOST, MX_DUPLICATE_HOST, MX_SHARED_PRIORITY, MX_MTA_STS_WITHOUT_TLS_RPT), and an `analysis` block (per-host enrichment incl. provider, ips with FCrDNS status, dane_tlsa, and the prerequisite probe results). DNSSEC AD is a UI-only signal, not gradeable through the DoH contract. Read-only. |
check_spfread-only | Check the SPF record for a domain. Returns the raw record, grade (A-F), the terminal `all` qualifier (resolved through redirect= chains), structured findings (NEAR_LOOKUP_LIMIT, LOOKUP_LIMIT_EXCEEDED, PLUS_ALL_DANGEROUS, PTR_MECHANISM_DEPRECATED, etc.), and an `analysis` block with the expanded include/redirect tree and the RFC 7208 §4.6.4 lookup count. Read-only. |
check_tls_rptread-only | Check the TLS-RPT (SMTP TLS Reporting, RFC 8460) record at _smtp._tls.<domain>. Strict §3 classification: the record must BEGIN with the case-sensitive v=TLSRPTv1 tag, more than one such record means receivers treat TLS-RPT as not implemented, and rua= is required. Validates every rua= destination syntactically (mailto:/https:// — reachability is never probed), and detects the MTA-STS and DANE prerequisites over DNS (TLSA at _25._tcp of the lowest-preference MX) with outage reported as unknown, never as absence. Returns grade (A-F) with grade_reasons, a verdict (valid/partial/invalid/not_configured), structured findings (TLS_RPT_NO_RECORD, TLS_RPT_INVALID_VERSION, TLS_RPT_MULTIPLE_RECORDS, TLS_RPT_NO_RUA, TLS_RPT_RUA_INVALID_URI, TLS_RPT_NO_VALID_RUA, TLS_RPT_NO_ENFORCEMENT_POLICY), and an `analysis` block with parsed tags, per-URI rua validation detail, and the prerequisite probe results. Read-only. |
check_txtread-only | Inventory a domain's TXT records and say what is wrong with them. Reads every TXT at the apex and labels each one by vendor or purpose (SPF, Google, Microsoft, Atlassian, Stripe and over a hundred more, grouped into categories), then reads 12 well-known names (_dmarc, _mta-sts, _smtp._tls, default._bimi, _acme-challenge, _amazonses and other provider tokens). Findings: TXT_MULTIPLE_SPF_LIKE (error: more than one v=spf1 record, RFC 7208 §4.5 permerror, so SPF fails for every message), TXT_APEX_DKIM_MISPLACED (error: a DKIM key at the apex, where no verifier looks), TXT_DUPLICATE_TOKEN (warn: the same vendor token twice, usually a stale one), TXT_LOCATIONS_INCOMPLETE (warn: some lookups failed; not evidence of absence) and TXT_NO_RECORDS (info). `verdict` is clean / warnings / misconfigured / incomplete / no_records; no grade. `analysis` carries apex[] (value, ttl, label, category), inventory (category to labels) and locations[] (name, label, status found/absent/failed, values). For a full SPF or DMARC judgement call check_spf or check_dmarc. Read-only. |
check_websiteread-only | Web-layer triage of one public hostname, the scan the /website page runs: A/AAAA with reverse DNS and ASN, CAA, the HTTPS redirect chain, the TLS certificate (issuer, SANs, expiry, WebPKI trust, TLS version), security headers (HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy) and cookie flags, HTTP/2 and HTTP/3 advertisement, whether plain http:// redirects to https, mixed content on the homepage, security.txt, any CDN or WAF in front (analysis.edge) and timings. `verdict` is ok, warn or fail, the same verdict the page shows; `grade_reasons` says why. Findings are one per failing or amber check: WEBSITE_TLS_UNREACHABLE, TLS_CERT_UNTRUSTED, TLS_CERT_HOSTNAME_MISMATCH, TLS_CERT_EXPIRED, WEBSITE_HTTPS_UNREACHABLE, HSTS_MISSING, CSP_MISSING, FRAME_PROTECTION_MISSING, NOSNIFF_MISSING, HTTP_NOT_REDIRECTED_TO_HTTPS, MIXED_CONTENT_ACTIVE (error); TLS_CERT_NEAR_EXPIRY, WEBSITE_NO_HTTP2, HSTS_SHORT_MAX_AGE, HSTS_NO_SUBDOMAINS, CSP_UNSAFE_INLINE, REFERRER_POLICY_MISSING, PERMISSIONS_POLICY_MISSING, HTTP_REDIRECT_NOT_HTTPS, MIXED_CONTENT (warn); WEBSITE_CHALLENGED (info: the homepage was a bot challenge, so headers were not graded). A name that resolves to a private or reserved address is refused with the non-retriable INPUT_INVALID error. One call makes about ten HTTPS requests from our server and can take 30 seconds on a slow site, so it has its own rate limit, lower than the other tools: on error -32029 wait retry_after seconds. Results are cached for 60 seconds. Read-only. |
decode_bounceread-only | Decode a pasted bounce: a full NDR email, an SMTP error line or a mail-log fragment. Finds the SMTP reply code and the enhanced status code (RFC 3463 X.Y.Z), names the provider that sent it (Google, Microsoft, Yahoo, Apple, Comcast, Proofpoint, Mimecast, Barracuda), and returns what the code means and how to fix it. `verdict` is permanent (5xx, finding BOUNCE_PERMANENT, status fail), temporary (4xx, BOUNCE_TEMPORARY, warn), delivered (2xx, pass) or no_code (BOUNCE_NO_CODE, info). When the bounce has no enhanced code, a known phrase in the wording picks the explanation and BOUNCE_CODE_INFERRED says so; analysis.enhanced_code stays null. BOUNCE_AUTH_RELATED marks codes receivers return for SPF, DKIM or DMARC failures: follow up with check_spf, check_dkim and check_dmarc on the sending domain. `analysis.entry` carries the meaning, causes, remediation[] and a link to the code's page, or is null for a code the database does not cover. The echoed `input` is the byte count only. Read-only. |
discover_dkimread-only | Find a domain's DKIM keys without knowing the selector. Looks up every selector in the TamingDNS database (over 500, covering Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES and over 100 other named providers) plus the *._domainkey wildcard, and validates each key it finds the way check_dkim does (KEY_TOO_SHORT, KEY_WEAK, KEY_REVOKED, M365_DKIM_CNAME_MISMATCH and the rest). When the MX is Mimecast it also tries Mimecast's date-stamped selectors: the year selectors (mimecastYYYY) in the call, and, if none holds a key, the dated ones (mimecastYYYYMMDD, about 3,650 names) in a background scan that takes about two minutes. That call says so (DKIM_DISCOVERY_INCOMPLETE, analysis.mimecast.readyAfter); call again after that time. The background outcome is kept for 24 hours (analysis.mimecast.cachedUntil). Returns a grade (A-F) with grade_reasons and a verdict (strong / weak / revoked-only / none / wildcard-revoked / non-sending). `analysis` lists selectors[] with key type and size, providers[], weakKeys[], revokedKeys[], unavailable (lookups that failed) and mimecast. Lookups that failed beside a match raise DKIM_DISCOVERY_INCOMPLETE (warn); the counts are a floor. Failures with no match return the retriable DKIM_LOOKUP_FAILED error, never "no key". A selector outside the database is not found here: read s= from a DKIM-Signature header (analyze_email_headers) and call check_dkim with it. One call is several hundred lookups, so it has its own rate limit. Read-only. |
Schemas: list_tools.
{
"name": "com.tamingdns/mcp",
"icons": [
{
"src": "https://tamingdns.com/favicon/android-chrome-512x512.png",
"sizes": [
"512x512"
],
"mimeType": "image/png"
},
{
"src": "https://tamingdns.com/favicon/android-chrome-192x192.png",
"sizes": [
"192x192"
],
"mimeType": "image/png"
}
],
"title": "TamingDNS",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://tamingdns.com/mcp",
"type": "streamable-http"
}
],
"version": "2.0.0",
"repository": {
"url": "https://github.com/PaulOgier/tamingdns-mcp",
"source": "github"
},
"websiteUrl": "https://tamingdns.com/mcp",
"description": "Check SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, DANE, DNSSEC and TXT; read headers and bounces."
}