# BlackVeil DNS & Email Security Scanner

Audits a domain's email and DNS defenses: SPF, DMARC, DKIM, DNSSEC, SSL. Hosted, no API key.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: MadaBurns
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/MadaBurns/bv-mcp
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/blackveil-dns-email-security-scanner

## What it does

BlackVeil is an MCP server that hands your agent 81 tools for domain auditing. Ask Claude about `anthropic.com` and you get a breakdown of SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, CAA, MX, BIMI, HTTP headers and more. Every check is read-only: nothing on the target gets modified and no permission from the domain owner is needed.

The server is hosted at `https://dns-mcp.blackveilsecurity.com/mcp` over Streamable HTTP, with no auth. A local option exists too: the `blackveil-dns-mcp` CLI from the `blackveil-dns` npm package. Most lookups are passive, going through public Cloudflare DNS-over-HTTPS. Two tools are not: `check_authoritative_dns_infra` and `check_root_server_set` talk to authoritative and root nameservers straight over TCP/53, so on a network that blocks outbound port 53 they will fail.

Beyond the checks, the server helps you act on what it finds. `generate` builds a prioritized fix plan plus publish-ready records (`spf_record`, `dmarc_record`, `dkim_config`, `mta_sts_policy`), and `validate_fix` tells you whether a change took effect. `map_supply_chain` draws the third-party dependency graph, `simulate_attack_paths` lists spoofing and takeover routes, and `map_compliance` lines findings up against NIST 800-177, PCI DSS 4.0, SOC 2 and CIS Controls.

## Requirements
- Remote server: `https://dns-mcp.blackveilsecurity.com/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http dns https://dns-mcp.blackveilsecurity.com/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add blackveil-dns-email-security-scanner --url https://dns-mcp.blackveilsecurity.com/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "blackveil-dns-email-security-scanner": {
            "url": "https://dns-mcp.blackveilsecurity.com/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "blackveil-dns-email-security-scanner": {
            "type": "http",
            "url": "https://dns-mcp.blackveilsecurity.com/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http blackveil-dns-email-security-scanner https://dns-mcp.blackveilsecurity.com/mcp
```

## When to use it
- check whether your domain has SPF and DMARC set up
- find subdomains open to takeover
- get publish-ready DNS records for a fix
- see which third-party services send mail as your domain
- map findings to PCI DSS or SOC 2 requirements

## Example prompts
- Scan `example.com` and tell me what's wrong with its email security
- Build a fix plan for SPF and DMARC on `example.com`
- Compare `example.com` against the previous scan and show what changed

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md