# isitdns

> Is it DNS? Audit a site or domain that isn't working: one call says if it resolves and why. No key.

- name: net.isitdns/isitdns
- version: 2026-10-15
- connection class: R0 (autonomous)
- trust: 77/100 flags: multi-version-spam, no-repository
- quality: 84/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/net.isitdns%2Fisitdns
- tools: https://api.protogrid.dev/v1/servers/net.isitdns%2Fisitdns/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "isitdns": {
      "type": "http",
      "url": "https://isitdns.net/mcp"
    }
  }
}
```


## Trust

- hygiene: 55
- liveness: 98
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-95% +updated-5d-ago -multi-version-spam(43) -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 84/100 (good)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 3600000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 6 of 6 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,659 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 92 tool changes in 30 days
- fail `stability.rug_pull`: 20 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 6, about 1,659 tokens to load them all
- tool set hash: 2851fb0c53d2bf42fc3e7a1d31d8f5c0
- tools last changed: 2026-10-15T19:38:41.507Z
- badge: [![protogrid quality](https://protogrid.dev/badge/net.isitdns/isitdns.svg)](https://protogrid.dev/servers/net.isitdns/isitdns)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-15 `check_domain` changed (outputSchema)
- 2026-10-13 `sweep_domain` changed (outputSchema)
- 2026-10-13 `sweep_domain` changed (description, inputSchema)
  - before: Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, and CAA and ACME readiness. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under the zone (@ for the apex), 16 at most, and types 8 at most.
  - after: Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under domain (@ for domain itself), 16 at most, and types 8 at most.
- 2026-10-13 `dig` changed (inputSchema)
- 2026-10-13 `check_domain` changed (inputSchema)
- 2026-10-13 `registration` changed (description)
  - before: Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to two labels, and each HTTP read is listed with its URL, status and time.
  - after: Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to the registered domain, and each HTTP read is listed with its URL, status and time.
- 2026-10-13 `trace` changed (description)
  - before: Trace a delegation from the root to the authority, like dig +trace: each referral and its glue, lame or unreachable servers, the final answer and its TTLs. Not for one record: dig. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers for it, and type (default A) is what it asks there.
  - after: Trace a delegation from the root to the authority, like dig +trace: each referral and its glue, the one server that answered at each zone cut and any dial that failed, the final answer and its TTLs. Not for every server of a zone: sweep_domain. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers for it, and type (default A) is what it asks there.
- 2026-10-13 `dig` changed (inputSchema)
- 2026-10-12 `registration` changed (description)
  - before: Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Use it to see whether a domain is expired or on hold, not for what DNS answers (check_domain, dig). Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, with no key and a limit of 100 calls a minute per address, and no contacts are returned. A hostname is read at the name, then each parent down to two labels, and each HTTP read is listed with its URL, status and time.
  - after: Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to two labels, and each HTTP read is listed with its URL, status and time.
- 2026-10-12 `sweep_domain` changed (description)
  - before: Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, and CAA and ACME readiness. Use it after a zone change or to see whether the servers agree, not for a public resolver's answer (dig) or the delegation (trace). Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer, with no key and a limit of 100 calls a minute per address. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under the zone (@ for the apex), 16 at most, and types 8 at most.
  - after: Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, and CAA and ACME readiness. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under the zone (@ for the apex), 16 at most, and types 8 at most.

Full history: https://api.protogrid.dev/v1/servers/net.isitdns%2Fisitdns/changes

## Remotes

- https://isitdns.net/mcp (streamable-http, auth none, reachable true, uptime30d 0.94736844)

## Packages

_none_

## Tools (6)

- `check_domain`: Check a domain that is not working: whether the name resolves in public DNS, then the eleven-check audit of its zone, each row ok, warn, fail or skipped with why. DNS only, not HTTP or TLS, and not for one record: dig. Measured from the isitdns edge and its probes, never the caller's network. from moves the recursion, TTL and UDP truncation rows to that region's probe.
- `dig`: Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all): records, flags, rcode, EDE, latency. Not for a whole domain: check_domain. Asked over DoH from the isitdns edge. from moves the question to that region's probe as Do53 over UDP, and follow: true adds the CNAME chain as separate reads with DNSSEC off. A resolver given as an address must be on the board.
- `dnssec_chain`: Walk the DNSSEC chain from the root to one answer: DS and DNSKEY at each signed zone cut, key tags, signers, signature windows, and the first link that breaks or goes insecure. Not for one signed record: dig. Read through Cloudflare's resolver over DoH with CD=1 from the isitdns edge, and a key set a break would rest on again through Google's. Signature bytes are not verified, so a clean walk does not prove the answer validates. type (default A) is the record checked at the end, not OPT, RRSIG or a meta type such as ANY.
- `registration`: Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to the registered domain, and each HTTP read is listed with its URL, status and time.
- `sweep_domain`: Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under domain (@ for domain itself), 16 at most, and types 8 at most.
- `trace`: Trace a delegation from the root to the authority, like dig +trace: each referral and its glue, the one server that answered at each zone cut and any dial that failed, the final answer and its TTLs. Not for every server of a zone: sweep_domain. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers for it, and type (default A) is what it asks there.