Dns Doctor MCP server
{
"mcpServers": {
"dns-doctor": {
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp@latest"
],
"env": {
"DNSDOCTOR_API_TOKEN": "<dnsdoctor_api_token>"
}
}
}
}{
"mcpServers": {
"dns-doctor": {
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp@latest"
],
"env": {
"DNSDOCTOR_API_TOKEN": "<dnsdoctor_api_token>"
}
}
}
}{
"mcpServers": {
"dns-doctor": {
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp@latest"
],
"env": {
"DNSDOCTOR_API_TOKEN": "<dnsdoctor_api_token>"
}
}
}
}{
"servers": {
"dns-doctor": {
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp@latest"
],
"env": {
"DNSDOCTOR_API_TOKEN": "${input:dnsdoctor_api_token}"
}
}
},
"inputs": [
{
"id": "dnsdoctor_api_token",
"type": "promptString",
"description": "Dnsdoctor api token",
"password": true
}
]
}{
"mcpServers": {
"dns-doctor": {
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp@latest"
],
"env": {
"DNSDOCTOR_API_TOKEN": "<dnsdoctor_api_token>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @dnsdoctor/mcpversion 1.9.0
What it does
DNS Doctor exposes tools for scanning, diagnosing, and fixing DNS configuration for email authentication (SPF, DMARC, DKIM), DNS propagation, and domain health. It is for developers and domain operators who need to validate and generate correct DNS records with deterministic fixes based on RFC specifications rather than LLM inference.
- Scan a domain's DNS records and receive a full report of email authentication setup, propagation status, and health issues.
- Generate and validate DMARC, SPF, and DKIM records with guaranteed RFC compliance before deploying them to DNS.
- Audit SPF include chains to find broken includes, expired registrations, and other supply-chain issues in your domain's mail sender configuration.
Tools this server exposes
| Tool | Does |
|---|---|
| scan_domain | Perform a fresh scan of a domain and return a full report. |
| get_report | Retrieve a persisted report for a domain, running a scan if none exists. |
| build_dmarc_upgrade | Generate a validated DMARC enforcement record based on alignment evidence; returns reporting-only policy if enforcement readiness gates do not pass. |
| count_spf_lookups | Count the DNS lookup cost of an SPF record against the RFC limit of 10. |
| validate_dmarc_record | Parse and validate a DMARC record, checking each tag. |
| generate_dmarc_record | Build a DMARC record from a policy and reporting address. |
| check_dkim_selector | Look up a DKIM selector and verify the key. |
| parse_dmarc_report | Parse an aggregate (RUA) DMARC report file into rows. |
| check_record | Read any DNS record type for a given name. |
| check_propagation | Verify whether a DNS change has propagated globally across six vantage points and return a verdict. |
| check_reverse_dns | Look up PTR records and verify forward-confirmed reverse DNS for an IP. |
| audit_spf_includes | Analyze the SPF include and redirect tree to identify broken includes, unregistered domains, expiring registrations, and nested `+all` directives. |
| build_parked_domain_records | Generate hardening DNS records (Null MX, SPF `-all`, DMARC `p=reject`) for a domain that does not send mail. |
| start_monitoring_signup | Provide a sign-up link for domain monitoring; the owner completes setup themselves on the DNS Doctor dashboard. |
| get_alerts | Retrieve monitoring alert history for an authenticated account; requires API token. |
| get_readiness | Check whether a monitored domain's aggregate-report evidence supports a stronger DMARC policy; requires API token. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.