How do I install Dns Doctor?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Dns Doctor need an API key?

No required environment variable is listed on this record.

What transport does Dns Doctor use?

Dns Doctor is reached over HTTP.

When was Dns Doctor last checked?

Last checked 2026-11-08. Scan, fix, verify and monitor DNS: SPF, DMARC, DKIM, propagation, health, expiry. Validated fixes.

Dns Doctor MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://dnsdoctor.dev/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http dev.dnsdoctor-dns-doctor https://dnsdoctor.dev/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "dev.dnsdoctor-dns-doctor": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://dnsdoctor.dev/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Live

Transport: http
Version: 1.14.0
License

29 tools

Tools

tools/listVoice mode preview

Tool	What it does
scan_domain	Use this when the user asks to check, audit, diagnose or troubleshoot SPF, DKIM, DMARC, email authentication, email deliverability DNS, why their mail lands in spam, MX, DNS health, blacklist status, or domain/SSL expiry for a domain, or wants to fix what a scan finds (fix records for DMARC and DNS;
get_report	Use this for the same questions as scan_domain when a recent report is enough (the cheap first look); use scan_domain when the state must be re-read now. Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns the
build_dmarc_upgrade	Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine at most; reject needs monitoring evidence) — and after any report showing DMARC below enforcement. Return a validated D
start_monitoring_signup	Use this when the user asks for ongoing DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts, ongoing DNS monitoring, or website uptime monitoring and down alerts for a domain they own (a verified domain's website is checked from five locations on four continen
count_spf_lookups	Use this when the user asks about SPF 'too many lookups', the 10-lookup limit, an SPF PermError, or whether an SPF record is valid. Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a `+all`
validate_dmarc_record	Use this when the user pastes a DMARC record and asks whether it is valid, correct or safe. Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews a stronger policy and is capped at p=quarantine
generate_dmarc_record	Use this when the user asks to create, generate or write a DMARC record for a domain that has none. Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none\|quarantine\|reject; optional `rua_email` (aggregate-report destina
check_dkim_selector	Use this when the user asks whether DKIM is set up for a sending platform, whether a specific selector exists, or why DKIM fails. Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may miss. Ret
parse_dmarc_report	Use this when the user uploads or pastes a DMARC aggregate (RUA) XML report and asks what it says. Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the file's bytes base64-encoded in `content_
check_record	Use this when the user asks whether a DNS change has landed, wants a DNS record looked up, or wants to verify a record they just published — or whenever answering needs the live value of a record. Reads the record from the domain's OWN nameservers (cache-free) and from two public caching resolvers.
check_reverse_dns	Use this when the user asks about reverse DNS, PTR records, or FCrDNS for a mail server IP. Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the same IP. `verdict` is confirmed (the pair agree
audit_spf_includes	Use this when the user asks who can send email as their domain through SPF includes, or wants an SPF supply-chain or third-party sender audit. Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved tree,
build_parked_domain_records	Use this when the user asks how to protect a domain that sends no email from being spoofed. Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC record. For parked, redirect and brand-defensive
check_propagation	Use this when the user asks whether a DNS change has propagated globally, or why a record shows in one place and not another. Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each read the same name
lookup_registration	Use this when the user asks who owns a domain, when it expires, which registrar or nameservers it has, whether it is registered, or whether a transfer or delete lock is set — the WHOIS question. Read a domain's registration from the registry over RDAP: registrar (with IANA id), registration/last-cha
get_alerts	Use this when a signed-in operator asks what changed on a monitored domain, whether its website went down, or what the monitoring has flagged. Read the monitoring alert log for the domains the caller's account monitors, newest first, including website uptime incidents (site_down, site_partial, site_
get_readiness	Use this when a signed-in operator asks whether a monitored domain is ready for the next DMARC step. Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API token. Returns whether the domain is ready
list_my_domains	Use this when a signed-in operator asks which domains their DNS Doctor account monitors, or what to do next on them. Lists every domain on the caller's account with its state — verified, pending (added, ownership not proven yet) or verification_lapsed (the ownership record was removed, so monitoring
check_lookalikes	Use this when the user asks about lookalike, look-alike, typosquat or impersonation domains of their domain, or whether someone has registered a name close to theirs. DNS-only: checks the closest variants of the name and returns facts — how many resolve and how many accept mail, with up to ten resol
get_lookalikes	Use this when a signed-in operator asks which lookalike domains of a monitored domain the watch has found, how risky they are, or for one's takedown evidence. Requires an API token with monitoring:read. Returns the account's watched lookalikes for ONE verified domain, highest threat % first by defau
start_email_test	Use this when the user wants to know how a real email from them actually authenticates — whether a message from Google Workspace, Microsoft 365, a newsletter tool or an app is SPF/DKIM/DMARC aligned, why it lands in spam, or to prove DKIM signing works before tightening DMARC. Returns a single-use a
get_email_test	Use this after start_email_test, once the user says they sent the email. Returns status pending \| received \| expired \| error. pending means the message has not arrived (or is still being checked): ask the user to send it if they have not, then call again. received carries result: the sending IP and
list_email_tests	Use this when a signed-in user asks about email tests they ran before, or how a sender's earlier tests scored. Requires an API token with monitoring:read. Returns the account's own tests, newest first (optionally only those whose From names one organization): each with test_id, status, created_at, r
check_bimi	Use this when the user asks how to get their logo shown in Gmail, Yahoo, Apple Mail or other inboxes (BIMI), whether their BIMI setup works, or why their logo does not show. A live read of one host's BIMI setup: the DMARC gate (BIMI needs p=quarantine or p=reject; dmarc_sources names each policy rea
add_monitored_domain	Add a domain to the signed-in user's DNS Doctor monitoring and return the ownership-check TXT record they must publish, plus where their DNS is hosted, a provider-specific guide link and, when their provider supports it, a one-click apply URL. Re-adding a domain they already monitor returns that dom
check_domain_verification	Use this only for DNS Doctor's own ownership TXT challenge on a domain the user already added to their DNS Doctor account (add_monitored_domain). For a TXT record another service asked for (Google Workspace, Microsoft 365, Shopify or any site verification), use check_record instead. Check whether th
get_domain_records	Read the records a domain the user monitors still needs: the ownership check while it is unverified, and once verified the DMARC reporting record plus whether we have OBSERVED that record published. Read-only: it issues nothing — if a verified domain comes back with no reporting record yet, call che
watch_record_change	Use this when the user asks to be told when a DNS change they are making has finished ("let me know when it's live"). Starts a free watch on ONE record for the signed-in user: DNS Doctor rechecks it every 10 minutes for up to 48 hours with the same verdict as check_record and sends ONE email to the
check_domain_names	Use this when the user is choosing a domain name and wants to know which candidates are already registered. Pass up to 20 candidate names in ONE call (never one call per name). Each name is read live from its registry over RDAP: status is registered \| not_registered \| unknown. registered carries the

DNS Doctor MCP server and Claude Code plugin — DNS skill (DMARC, SPF, DKIM)

Scan, fix and verify a domain's DNS — email authentication (SPF, DMARC, DKIM) first, plus multi-region propagation, SPF include supply-chain audits, MX, DNS health, blacklists and domain/SSL expiry — from inside Claude. This plugin bundles the DNS Doctor skill (the scan → diagnose → fix workflow) and an MCP server config pointing at the hosted DNS Doctor tools.

The moat: every fix record you get back is generated and validated by a deterministic engine — RFC grammar plus the SPF 10-lookup counter — never an LLM guess. Your agent hands the human a record that already parses correctly, not a plausible-looking string that silently fails.

What's inside

claude-plugin/
├── .claude-plugin/plugin.json   # plugin manifest
├── .mcp.json                    # MCP server: https://dnsdoctor.dev/mcp (HTTP)
├── skills/dns-doctor/SKILL.md   # the scan → diagnose → fix workflow
├── src/                         # @dnsdoctor/mcp — the local stdio MCP server
├── tools.json                   # the tool definitions (generated, never hand-edited)
├── instructions.txt             # the server's own `initialize` guidance (generated)
├── tests/                       # vitest suite for the stdio server
├── package.json  tsconfig.json  # npm package + build
├── LICENSE                      # Apache-2.0
└── README.md

Tools

Tool	Does
`scan_domain`	Fresh scan of a domain; full report.
`get_report`	Persisted report (scans once if none exists).
`build_dmarc_upgrade`	A validated DMARC enforcement record, capped at `p=quarantine` and returned only when the server-derived alignment gate passes; without that evidence the answer is reporting-first and no record is returned. `p=reject` comes from the readiness engine's aggregate-report evidence, never from a scan.
`count_spf_lookups`	The SPF DNS-lookup count against the RFC limit of 10.
`validate_dmarc_record`	Parse and validate a DMARC record, tag by tag.
`generate_dmarc_record`	Build a DMARC record from a policy + reporting address.
`check_dkim_selector`	Look up one DKIM selector and check the key.
`parse_dmarc_report`	Parse an aggregate (RUA) report file into rows.
`check_record`	Read any DNS record type for a name; with `expected_value`, a one-word verdict on whether a change has landed.
`check_propagation`	Whether a DNS change has gone global: six vantage points (five owner-run probes plus the server's own resolver) read the same name, returning the grid plus a deterministic verdict. Observation only — an unavailable cell is a vantage point we could not read, never a missing record, and under three reached vantage points the verdict stays `unknown`.
`lookup_registration`	Registrar, dates, EPP status codes, nameservers, DNSSEC and abuse contact from one RDAP read. Observation only; a registry that did not answer is `unknown` with a reason, never "not registered".
`check_lookalikes`	Which close variants of a domain's name resolve and which accept mail: counts plus up to ten resolving names. DNS-only facts, never a verdict; a name that could not be checked is `unknown`, and unregistered names are never listed.
`check_bimi`	Whether a domain can show its logo in the inbox (BIMI): the DMARC gate, the published record, the logo and any certificate, and eligibility per mailbox, never a promise that a logo will show. With a candidate , the engine's record to publish.

The three monitoring reads are listed for everyone and callable with a token: they appear in the tool list on both transports, and without a valid token the call is refused with the page the account owner mints one on. Over the hosted HTTP transport the dnsdoctor://domains resource (your monitored domains) is likewise always listed and refused without a token; the local stdio server registers the tools only — no resource. Anonymous access covers all nineteen diagnosis tools, which is enough for a one-off diagnosis either way.

Install

Claude Code

Add the marketplace/repo and enable the plugin:

/plugin marketplace add dnsdoctor/claude-plugin
/plugin install dns-doctor

Public home: github.com/dnsdoctor/claude-plugin (org dnsdoctor, domain-verified). The plugin is developed in the DNS Doctor monorepo and published here as clean release snapshots.

Or point Claude Code at a local checkout of this directory during development. Once enabled, the skill auto-loads and the dns-doctor MCP server connects to https://dnsdoctor.dev/mcp.

claude.ai (MCP connector)

Add a custom connector with:

URL: https://dnsdoctor.dev/mcp
Transport: Streamable HTTP
Auth: none (anonymous) — or a Bearer token (below)

Any MCP client (standard config)

{
  "mcpServers": {
    "dns-doctor": {
      "url": "https://dnsdoctor.dev/mcp"
    }
  }
}

Optional: API token for monitored domains

Anonymous access covers scanning and fixes. A per-account API token unlocks the account's own monitoring data: the get_alerts, get_readiness, get_lookalikes, list_email_tests and list_my_domains tools, and the dnsdoctor://domains resource (your continuously-monitored domains and their latest per-check statuses).

Sign in at https://dnsdoctor.dev → Settings → API tokens → create a token. The plaintext (dnsd_…) is shown once; copy it.

Add the Authorization header to the server in .mcp.json:

{
  "mcpServers": {
    "dns-doctor": {
      "type": "http",
      "url": "https://dnsdoctor.dev/mcp",
      "headers": { "Authorization": "Bearer ${DNSDOCTOR_API_TOKEN}" }
    }
  }
}

Then export DNSDOCTOR_API_TOKEN=dnsd_YOUR_TOKEN in your environment. Never commit the token.

Transport

Two supported public transports, same 27 tools:

Hosted streamable HTTP — https://dnsdoctor.dev/mcp, wired in this plugin's .mcp.json. No install, no keys.
Local stdio — npx -y @dnsdoctor/[email protected]. A thin server that runs on your machine and calls the public DNS Doctor REST API; it holds no diagnosis logic of its own and relays every record string verbatim.

{
  "mcpServers": {
    "dns-doctor": {
      "command": "npx",
      "args": ["-y", "@dnsdoctor/[email protected]"],
      "env": { "DNSDOCTOR_API_TOKEN": "dnsd_YOUR_TOKEN" }
    }
  }
}

DNSDOCTOR_API_TOKEN is optional (anonymous access covers scanning and fixes; the three monitoring reads need it). DNSDOCTOR_API_BASE overrides the origin — it must be an origin that serves the /api/… paths, i.e. the public site rather than a bare backend port.

Build the stdio server from source

npm ci
npm test
npm run build      # -> dist/index.js, the package's bin entrypoint

tools.json and instructions.txt are generated from the hosted server and pinned by a backend test — never hand-edit them, and never add a tool description to src/. Both files ship in the npm tarball; without them the client has no tools and none of its safety guidance.

Worked example

You: Our invoices keep landing in customers' spam. Domain is example.com.

Claude (scan_domain → example.com): DMARC is at p=none, so nothing enforces alignment — receivers can't tell your mail from a spoof. The SPF record is valid, 7 of 10 lookups used. DKIM: a selector was found and is valid. Not blacklisted. Domain expires in 240 days.

Claude (build_dmarc_upgrade → example.com): SPF is aligned and DKIM is present, so the recommendation reaches its ceiling, p=quarantine. Publish this exact TXT record at _dmarc.example.com — paste it verbatim, don't edit it:
v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r; np=reject
Apply it in your DNS host once you've confirmed it's approved, then ask me to re-scan to verify. Want the domain watched continuously with aggregate-report alerts? Here is the setup link — open it and sign in: https://dnsdoctor.dev/start?domain=example.com&ref=agent

Learn more

Methodology (how the verdicts are computed): https://dnsdoctor.dev/methodology
REST API / OpenAPI schema: https://dnsdoctor.dev/api/v1/openapi.json

License

Apache-2.0 — see LICENSE.

Dns Doctor

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Dns Doctor?

Does Dns Doctor need an API key?

What transport does Dns Doctor use?

When was Dns Doctor last checked?

Documentation

DNS Doctor MCP server and Claude Code plugin — DNS skill (DMARC, SPF, DKIM)

What's inside

Tools

Install

Claude Code

claude.ai (MCP connector)

Any MCP client (standard config)

Optional: API token for monitored domains

Transport

Build the stdio server from source

Worked example

Learn more

License