# DomainDNA

> Tech stack, email security (SPF, DMARC, MX provider) and domain age API + MCP. 25 free domains/day.

- name: dev.workers.cybermax-tools.cybermax/domaindna-api
- version: 1.1.2
- connection class: R0 (autonomous)
- trust: 87/100 flags: duplicate-repo
- quality: 77/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.workers.cybermax-tools.cybermax%2Fdomaindna-api
- tools: https://api.protogrid.dev/v1/servers/dev.workers.cybermax-tools.cybermax%2Fdomaindna-api/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "domaindna-api": {
      "type": "http",
      "url": "https://domaindna-api.cybermaxtools.com/mcp?via=mcp-registry",
      "headers": {
        "x-api-key": "${X_API_KEY}"
      }
    }
  }
}
```

Placeholders to fill: `${X_API_KEY}`.

## Trust

- hygiene: 60
- liveness: 97
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-94% +updated-10d-ago -duplicate-repo(34 names)
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 77/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 4 of 4 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,330 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 50 (weight 15)

- pass `stability.changes`: 4 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 4, about 1,330 tokens to load them all
- tool set hash: 2a92eb479ed805f9045b876ee7f55484
- tools last changed: 2026-10-11T08:50:49.801Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.workers.cybermax-tools.cybermax/domaindna-api.svg)](https://protogrid.dev/servers/dev.workers.cybermax-tools.cybermax/domaindna-api)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-11 `domain_registration` changed (description, inputSchema, annotations) **meaning changed**
  - before: Domain registration only, for 1-10 domains, from the official RDAP registries: registrar, created, updated and expiry dates, age in days and status codes. Use it to spot newly registered (possibly risky) domains or upcoming expiries. The fastest and cheapest tool here; no DNS, email or website checks. Read-only.
  - after: Domain registration only, for 1-10 domains, from the official RDAP registries. Use this when you need to spot newly registered (possibly risky) domains, check who a domain is registered with, or find upcoming expiries. The fastest and cheapest tool here; no DNS, email or website checks (use domain_report for everything). Input: domains (1-10 domains, URLs or email addresses). Returns results[] with, per domain: registration (registrar, created, updated and expiry dates, age in days, status codes), errors, analyzedAt and cached. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.
- 2026-10-11 `tech_stack` changed (description, inputSchema, annotations) **meaning changed**
  - before: Website technologies only, for 1-3 sites: CMS, e-commerce platform, frameworks, analytics, tag managers, CDN, chat and more, each with the evidence it was detected from, plus the security headers the homepage sends. Use it for lead qualification or competitor research by technology. Fetches each homepage once; no DNS or registration data (use email_security or domain_registration). Read-only.
  - after: Website technologies only, for 1-3 sites. Use this when you need to know what a website is built with, for lead qualification by technology or competitor research. Fetches each homepage once; no DNS, email or registration data (use email_security or domain_registration). Input: domains (1-3 domains or URLs). Returns results[] with, per site: reachable, blocked, finalUrl, statusCode, title, description, language; technologies[] (CMS, e-commerce platform, frameworks, analytics, tag managers, CDN, chat and more, each with category and the evidence it was detected from); securityHeaders the homepage sends; errors, analyzedAt and cached. Sites that block bots return blocked=true. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.
- 2026-10-11 `email_security` changed (description, inputSchema, annotations)
  - before: Email and DNS setup only, for 1-5 domains: MX provider (e.g. Google Workspace, Microsoft 365), SPF record and its all qualifier, DMARC policy, pct and rua, A/AAAA/NS records and TXT verification tokens. Use it to check email deliverability or spoofing protection, or to see which email provider a company uses. Does not fetch the website (use tech_stack) or registration data (use domain_registration). Read-only.
  - after: Email and DNS setup only, for 1-5 domains. Use this when you need to check email deliverability or spoofing protection, or to see which email provider (Google Workspace, Microsoft 365…) a company uses. Does not fetch the website (use tech_stack) or registration data (use domain_registration). Input: domains (1-5 domains, URLs or email addresses). Returns results[] with, per domain: exists; email (MX hosts and provider, SPF record and its all qualifier, DMARC policy, pct and rua); dns (A/AAAA/NS records); verifications (services proven by TXT site-verification tokens, e.g. google, apple, atlassian); errors, analyzedAt and cached. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.
- 2026-10-11 `domain_report` changed (description, inputSchema, annotations) **meaning changed**
  - before: Everything about ONE domain in a single call: tech stack (with evidence), email provider, SPF, DMARC, DNS, RDAP registration (age, registrar, expiry), security headers and site files. Use it to profile one company end to end. For several domains and only one aspect, use email_security, tech_stack or domain_registration instead (cheaper and faster). Read-only; no data is stored.
  - after: Everything about ONE domain in a single call. Use this when you need to profile one company or website end to end (sales research, vendor or security review, due diligence). For several domains or only one aspect, use email_security, tech_stack or domain_registration instead (cheaper and faster). Input: domain (a domain, URL or email address). Returns check and results[0] with reachable, finalUrl, statusCode, title, description and language of the homepage; technologies[] (CMS, e-commerce, frameworks, analytics, CDN…, each with the evidence it was detected from); email (MX provider, SPF and DMARC policy); dns records and verification tokens; securityHeaders; registration (RDAP registrar, created and expiry dates, age); files (robots.txt, sitemap, llms.txt, security.txt); a one-line summary, analyzedAt and cached. exists tells whether the domain resolves; a site that blocks bots is flagged blocked=true. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.

Full history: https://api.protogrid.dev/v1/servers/dev.workers.cybermax-tools.cybermax%2Fdomaindna-api/changes

## Remotes

- https://domaindna-api.cybermaxtools.com/mcp?via=mcp-registry (streamable-http, auth none, reachable true, uptime30d 0.9361702)

## Packages

_none_

## Tools (4)

- `domain_registration`: Domain registration only, for 1-10 domains, from the official RDAP registries. Use this when you need to spot newly registered (possibly risky) domains, check who a domain is registered with, or find upcoming expiries. The fastest and cheapest tool here; no DNS, email or website checks (use domain_report for everything). Input: domains (1-10 domains, URLs or email addresses). Returns results[] with, per domain: registration (registrar, created, updated and expiry dates, age in days, status codes), errors, analyzedAt and cached. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.
- `domain_report`: Everything about ONE domain in a single call. Use this when you need to profile one company or website end to end (sales research, vendor or security review, due diligence). For several domains or only one aspect, use email_security, tech_stack or domain_registration instead (cheaper and faster). Input: domain (a domain, URL or email address). Returns check and results[0] with reachable, finalUrl, statusCode, title, description and language of the homepage; technologies[] (CMS, e-commerce, frameworks, analytics, CDN…, each with the evidence it was detected from); email (MX provider, SPF and DMARC policy); dns records and verification tokens; securityHeaders; registration (RDAP registrar, created and expiry dates, age); files (robots.txt, sitemap, llms.txt, security.txt); a one-line summary, analyzedAt and cached. exists tells whether the domain resolves; a site that blocks bots is flagged blocked=true. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.
- `email_security`: Email and DNS setup only, for 1-5 domains. Use this when you need to check email deliverability or spoofing protection, or to see which email provider (Google Workspace, Microsoft 365…) a company uses. Does not fetch the website (use tech_stack) or registration data (use domain_registration). Input: domains (1-5 domains, URLs or email addresses). Returns results[] with, per domain: exists; email (MX hosts and provider, SPF record and its all qualifier, DMARC policy, pct and rua); dns (A/AAAA/NS records); verifications (services proven by TXT site-verification tokens, e.g. google, apple, atlassian); errors, analyzedAt and cached. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.
- `tech_stack`: Website technologies only, for 1-3 sites. Use this when you need to know what a website is built with, for lead qualification by technology or competitor research. Fetches each homepage once; no DNS, email or registration data (use email_security or domain_registration). Input: domains (1-3 domains or URLs). Returns results[] with, per site: reachable, blocked, finalUrl, statusCode, title, description, language; technologies[] (CMS, e-commerce platform, frameworks, analytics, tag managers, CDN, chat and more, each with category and the evidence it was detected from); securityHeaders the homepage sends; errors, analyzedAt and cached. Sites that block bots return blocked=true. Limits: each domain counts as one lookup; answers cached for 1 hour per domain; 25 free domains a day per IP without a key, more with a paid key in the x-api-key header. Read-only: nothing is stored, no email is sent.