# dns-doctor

Scans a domain, checks SPF, DMARC and DKIM, and watches whether a DNS change has spread. Useful when mail bounces or lands in spam.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 2
- Author: dnsdoctor
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/dnsdoctor/claude-plugin
- Updated: 2026-10-20
- HTML: https://affpapa.org/en/nevibecode/mcp/dns-doctor

## What it does

The server hands your agent a set of DNS tools: a fresh domain scan, report parsing, a DKIM selector lookup, and a count of SPF DNS lookups against the RFC limit of 10. Every record it hands back is assembled by a deterministic engine working from RFC grammar, so the string parses on the first try instead of looking plausible and failing quietly.

The plugin ships a skill that walks scan, diagnose, fix, plus an MCP config pointing at `https://dnsdoctor.dev/mcp`. A local stdio server, `@dnsdoctor/mcp` on npm, covers setups where the hosted endpoint does not fit. Another group of tools reports how one real message authenticated: you get a single-use address, send one email, and read back the SPF, DKIM and DMARC verdicts with a score out of 10 and each deduction listed. Message bodies are not kept.

Several tools need an account token — the alert log, DMARC readiness for a monitored domain, the watched lookalike list. A call without a valid token is refused. All nineteen diagnosis tools work anonymously, which covers a one-off look at a domain. `build_dmarc_upgrade` caps its output at `p=quarantine` and returns a record only when the alignment gate passes; `p=reject` comes from aggregate-report evidence rather than a scan.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://dnsdoctor.dev/mcp`

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http dns-doctor https://dnsdoctor.dev/mcp
```

2. **Platform CLI**
```bash
claude mcp add dns-doctor -- npx -y @dnsdoctor/mcp
```

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add dns-doctor --url https://dnsdoctor.dev/mcp
```

2. **Platform CLI**
```bash
codex mcp add dns-doctor -- npx -y @dnsdoctor/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "dns-doctor": {
            "url": "https://dnsdoctor.dev/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "dns-doctor": {
            "command": "npx",
            "args": [
                "-y",
                "@dnsdoctor/mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "dns-doctor": {
            "type": "http",
            "url": "https://dnsdoctor.dev/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "dns-doctor": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@dnsdoctor/mcp"
            ]
        }
    }
}
```

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http dns-doctor https://dnsdoctor.dev/mcp
```

2. **Platform CLI**
```bash
gemini mcp add dns-doctor npx -y @dnsdoctor/mcp
```

## When to use it
- find out why mail from a domain fails authentication
- produce a DMARC record that actually parses
- count SPF DNS lookups and stay under the limit
- confirm a DNS change reached resolvers worldwide
- turn an aggregate DMARC report into readable rows

## Example prompts
- Scan example.com and tell me what is wrong with its email setup
- Count the SPF DNS lookups for example.com — are we over the limit?
- Check whether the `_dmarc` record has propagated after my edit

## Similar
- [DMARKOFF — DMARC, SPF & DKIM Analytics](https://affpapa.org/en/nevibecode/mcp/dmarkoff-dmarc-spf-dkim-analytics.md) — MCP server · ★ 8
- [BlackVeil DNS & Email Security Scanner](https://affpapa.org/en/nevibecode/mcp/blackveil-dns-email-security-scanner.md) — MCP server · ★ 9
- [email-deliverability](https://affpapa.org/en/nevibecode/skills/email-deliverability.md) — skill · 315 installs
- [deliverability-qa](https://affpapa.org/en/nevibecode/skills/deliverability-qa.md) — skill · 1100 installs
- [analyzing-email-headers-for-phishing-investigation](https://affpapa.org/en/nevibecode/skills/analyzing-email-headers-for-phishing-investigation.md) — skill · 612 installs
- [analyzing-dns-logs-for-exfiltration](https://affpapa.org/en/nevibecode/skills/analyzing-dns-logs-for-exfiltration.md) — skill · 527 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md