dns-doctor — Claude Code MCP server: DNS and email checks
Scans a domain, checks SPF, DMARC and DKIM, and watches whether a DNS change has spread. Useful when mail bounces or lands in spam.
claude mcp add --transport http dns-doctor https://dnsdoctor.dev/mcpWhat dns-doctor does
The server hands your agent a set of DNS tools: a fresh domain scan, report parsing, a DKIM selector lookup, and a count of SPF DNS lookups against the RFC limit of 10. Every record it hands back is assembled by a deterministic engine working from RFC grammar, so the string parses on the first try instead of looking plausible and failing quietly.
The plugin ships a skill that walks scan, diagnose, fix, plus an MCP config pointing at https://dnsdoctor.dev/mcp. A local stdio server, @dnsdoctor/mcp on npm, covers setups where the hosted endpoint does not fit. Another group of tools reports how one real message authenticated: you get a single-use address, send one email, and read back the SPF, DKIM and DMARC verdicts with a score out of 10 and each deduction listed. Message bodies are not kept.
Several tools need an account token — the alert log, DMARC readiness for a monitored domain, the watched lookalike list. A call without a valid token is refused. All nineteen diagnosis tools work anonymously, which covers a one-off look at a domain. build_dmarc_upgrade caps its output at p=quarantine and returns a record only when the alignment gate passes; p=reject comes from aggregate-report evidence rather than a scan.
What it helps with
- find out why mail from a domain fails authentication
- produce a DMARC record that actually parses
- count SPF DNS lookups and stay under the limit
- confirm a DNS change reached resolvers worldwide
- turn an aggregate DMARC report into readable rows
Example prompts for the agent
- Scan example.com and tell me what is wrong with its email setup
- Count the SPF DNS lookups for example.com — are we over the limit?
- Check whether the
_dmarcrecord has propagated after my edit
How to install dns-doctor
1Platform CLI: remote server
claude mcp add --transport http dns-doctor https://dnsdoctor.dev/mcp2Platform CLI
claude mcp add dns-doctor -- npx -y @dnsdoctor/mcp1Platform CLI: remote server
codex mcp add dns-doctor --url https://dnsdoctor.dev/mcp2Platform CLI
codex mcp add dns-doctor -- npx -y @dnsdoctor/mcpConfig file
{
"mcpServers": {
"dns-doctor": {
"url": "https://dnsdoctor.dev/mcp"
}
}
}{
"mcpServers": {
"dns-doctor": {
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp"
]
}
}
}Config file
{
"servers": {
"dns-doctor": {
"type": "http",
"url": "https://dnsdoctor.dev/mcp"
}
}
}{
"servers": {
"dns-doctor": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@dnsdoctor/mcp"
]
}
}
}1Platform CLI: remote server
gemini mcp add -t http dns-doctor https://dnsdoctor.dev/mcp2Platform CLI
gemini mcp add dns-doctor npx -y @dnsdoctor/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about dns-doctor
How do I install dns-doctor in Claude Code?
Run /plugin marketplace add dnsdoctor/claude-plugin, then /plugin install dns-doctor. To add only the server, use claude mcp add --transport http dns-doctor https://dnsdoctor.dev/mcp.
What does dns-doctor do?
It scans a domain's DNS and checks email authentication — SPF, DMARC, DKIM. It also covers propagation across resolvers, MX, blacklists, and domain and SSL expiry.
Do I need an API token?
Not for diagnosis: every diagnosis tool works anonymously. A token is only needed for monitoring — the alert log, DMARC readiness and your watched domains.
