BlackVeil DNS & Email Security Scanner — Claude Code MCP server
Audits a domain's email and DNS defenses: SPF, DMARC, DKIM, DNSSEC, SSL. Hosted, no API key.
claude mcp add --transport http dns https://dns-mcp.blackveilsecurity.com/mcpWhat BlackVeil DNS & Email Security Scanner does
BlackVeil is an MCP server that hands your agent 81 tools for domain auditing. Ask Claude about anthropic.com and you get a breakdown of SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, CAA, MX, BIMI, HTTP headers and more. Every check is read-only: nothing on the target gets modified and no permission from the domain owner is needed.
The server is hosted at https://dns-mcp.blackveilsecurity.com/mcp over Streamable HTTP, with no auth. A local option exists too: the blackveil-dns-mcp CLI from the blackveil-dns npm package. Most lookups are passive, going through public Cloudflare DNS-over-HTTPS. Two tools are not: check_authoritative_dns_infra and check_root_server_set talk to authoritative and root nameservers straight over TCP/53, so on a network that blocks outbound port 53 they will fail.
Beyond the checks, the server helps you act on what it finds. generate builds a prioritized fix plan plus publish-ready records (spf_record, dmarc_record, dkim_config, mta_sts_policy), and validate_fix tells you whether a change took effect. map_supply_chain draws the third-party dependency graph, simulate_attack_paths lists spoofing and takeover routes, and map_compliance lines findings up against NIST 800-177, PCI DSS 4.0, SOC 2 and CIS Controls.
What it helps with
- check whether your domain has SPF and DMARC set up
- find subdomains open to takeover
- get publish-ready DNS records for a fix
- see which third-party services send mail as your domain
- map findings to PCI DSS or SOC 2 requirements
Example prompts for the agent
- Scan
example.comand tell me what's wrong with its email security - Build a fix plan for SPF and DMARC on
example.com - Compare
example.comagainst the previous scan and show what changed
How to install BlackVeil DNS & Email Security Scanner
Platform CLI: remote server
claude mcp add --transport http dns https://dns-mcp.blackveilsecurity.com/mcpPlatform CLI: remote server
codex mcp add blackveil-dns-email-security-scanner --url https://dns-mcp.blackveilsecurity.com/mcpConfig file
{
"mcpServers": {
"blackveil-dns-email-security-scanner": {
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}Config file
{
"servers": {
"blackveil-dns-email-security-scanner": {
"type": "http",
"url": "https://dns-mcp.blackveilsecurity.com/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http blackveil-dns-email-security-scanner https://dns-mcp.blackveilsecurity.com/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about BlackVeil DNS & Email Security Scanner
How do I install BlackVeil DNS & Email Security Scanner in Claude Code?
Run claude mcp add --transport http blackveil-dns-email-security-scanner https://dns-mcp.blackveilsecurity.com/mcp. Then ask the agent to scan example.com.
What does BlackVeil DNS & Email Security Scanner do?
It runs 81 checks against a domain: SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, CAA, MX, BIMI and others. You get a maturity score and a list of fixes.
Do I need an API key or a local install?
No. The server is hosted and needs no auth, just the URL. You can also run it locally via the blackveil-dns-mcp CLI from the blackveil-dns npm package.
