DNS MCP Server

Real-time DNS security analysis — DNSSEC, email auth, and RDAP.

Connector by mclose · GitHub account verified by the MCP Registry

IndexedLicense unknownLocal (stdio)★ 1

Chalk Labs

Need help deploying DNS MCP Server?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/mclose-dns-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Real-time DNS security analysis — DNSSEC, email auth, and RDAP. Built for SOC investigations.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools: 24 read · 0 write · 1 delete · 1 not yet classified
Secrets: None asked for
Install scripts: None found
Runs as: Docker image

Tools by what they do 26

Read from the source code; the running server may list different tools.

Read 24 · Look things up without changing anything.

check_bimi
check_caa
check_ct_logs
check_dane
check_dbl
check_dkim
check_dmarc
check_fast_flux
check_mta_sts
check_rbl
check_smtp_tlsrpt
check_spf

Show 12 more tools

check_tlsa
check_zone_transfer
cymru_asn
detect_hijacking
dns_query
dnssec_validate
enumerate_dkim_selectors
nsec_info
ping
rdap_lookup
session_stats
whoami

Delete 1 · Delete, drop, revoke or wipe things.

reset_stats

Not yet classified 1 · We could not tell from the name and description.

reverse_dns

Network hosts it talks to 4

dns-mcp.lab.deflationhollow.net · found in code
github.com · found in code
id.deflationhollow.net · found in code
tiny-mcp.deflationhollow.net · found in code

Tools (26)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

check_bimi
BIMI (RFC 9091) record check with DMARC and VMC validation. Queries `<selector>._bimi.<domain>` TXT for the BIMI record and parses the `l=` logo URL and `a=` Verified Mark Certificate URL. Default selector is `"default"` per RFC 9091 §3. Two cross-cuts beyond a pure record fetch: - **DMARC precondition**: BIMI without DMARC at `p=quarantine` or `p=reject` is decorative — Gmail / Apple Mail gate logo display on DMARC enforcement. Disable with `check_dmarc_dependency=False`. - **VMC reachability**: confirms the VMC URL responds 200 with a plausible cert content type. Does not validate th…
check_caa
CAA record analysis with CNAME chain + wildcard delegation detection. Beyond a plain CAA lookup, this tool surfaces policy gaps a CA would actually act on at issuance time: - Tree-climbing (RFC 8659 §3): finds the effective policy when no CAA exists at the queried name. - CNAME chain tracing: follows aliases and flags hops that cross a registrable-domain boundary (third-party CAA control). - Wildcard CNAME detection: a `*.<domain>` CNAME silently delegates CAA authority for unmatched subdomains. Confirmed via a random subdomain probe. Common with ngrok/Cloudflare-Pages style platform…
check_ct_logs
Enumerate Certificate Transparency log entries for a domain. Queries Cert Spotter (primary) and crt.sh (secondary) in parallel for certificates logged under <domain> or its subdomains, merges them, and summarizes: unique subdomains, per-cert issuer/validity/wildcard flags, active vs expired counts. Primary forensic use: **subdomain enumeration** from SAN lists. Reading the result (dns_tool 0.15.0): - `sources[]` records each source's outcome (ok/empty/timeout/ rate_limited/http_error...). crt.sh is unreliable; **no negative ever rests on it alone**. - NO_CT_RECORDS (info) means Cert Spot…
check_dane
Check DANE/SMTP publication for all MX hosts of <domain>. Performs MX lookup, then queries TLSA records at port 25 for each MX host. Reports certificate usage, selector, matching type, and digest. DANE protects the domain only if BOTH the TLSA records AND the domain's own MX RRset are DNSSEC-validated (RFC 7672 §2.2.1). An unsigned MX RRset yields DANE_MX_NOT_DNSSEC_VALIDATED. PKIX usages (0/1) are unusable for SMTP. This tool does NOT connect to the mail server, so it does not verify that the TLSA records match the certificate the server actually presents. `dane_valid` means "published and…
check_dbl
Check a domain against domain block lists (Spamhaus DBL, SURBL, URIBL). Returns per-DBL listing status. Useful for triaging unknown domains in phishing emails or suspicious URLs.
check_dkim
Retrieve and strictly validate a DKIM public key for <domain>. Give either `selector`, or `headers` from a real message. With headers, the selector comes from the DKIM-Signature whose d= matches the domain (`selector_source: "header"`). Prefer headers whenever you have them: many providers (e.g. ForwardEmail `fe-<hex>`) use selectors that cannot be guessed. Returns key type (RSA / Ed25519), exact key bits, flags, the joined record, and `record_strings`. Fails closed: an undecodable key is DKIM_KEY_UNPARSEABLE, bad tag syntax is DKIM_RECORD_MALFORMED, and an empty p= is DKIM_KEY_REVOKED.
check_dmarc
Retrieve and parse a domain's DMARC policy. Falls back to the organizational domain if no policy is found at the queried name. Returns policy verdict (none/quarantine/reject), pct, subdomain policy, rua/ruf reporting addresses, and DNSSEC AD flag.
check_fast_flux
Detect fast-flux behavior by repeatedly querying <domain> A records and observing IP rotation across queries. Returns the unique IP set, ASN diversity (more ASNs = more suspicious), TTL behavior, and a heuristic verdict. Used in malware C2 and phishing infrastructure investigations.
check_mta_sts
MTA-STS (RFC 8461) DNS + policy file check for <domain>. Two-part check: (1) DNS TXT at `_mta-sts.<domain>` for the `v=STSv1; id=...` announcement; (2) HTTPS fetch of the policy file at `https://mta-sts.<domain>/.well-known/mta-sts.txt` (parses `version`, `mode`, `mx`, `max_age`). The two steps are reported separately under `dns_query` and `policy_fetch` so a missing DNS record is distinguishable from a fetchable announcement whose policy file is broken. Set `fetch_policy=False` to skip the HTTPS step (DNS-only). SSL verification on the policy fetch is always on — an invalid cert on the poli…
check_rbl
Check an IPv4 address against 8 well-known RBLs (Spamhaus ZEN, Barracuda BRBL, SORBS, etc.). Returns per-RBL listing status, return-code interpretation (e.g. Spamhaus return-code-to-listing-class mapping), and any TXT evidence records.
check_smtp_tlsrpt
SMTP TLS Reporting (RFC 8460) check for <domain>. Queries `_smtp._tls.<domain>` TXT for the TLSRPT record and validates `v=TLSRPTv1` plus `rua=` reporting destinations (each URI must be `mailto:` or `https:`). A record without a `rua=` is useless — there is no destination for aggregate TLS failure reports — and verdicts as `fail`. Pairs with `check_mta_sts`: TLSRPT alone reports the failures MTA-STS would have prevented. Returns a contract-conforming envelope with `verdict`/`findings` (RESPONSE_CONTRACT.md).
check_spf
Retrieve and recursively parse a domain's SPF policy. Enumerates all authorized sending IPs/networks by following include chains. Enforces the RFC 7208 10-lookup limit. Returns the raw SPF record, parsed mechanisms, authorized networks, the 'all' qualifier, and lookup count.
check_tlsa
Retrieve a TLSA record at the standard `_<port>._<proto>.<host>` location. Defaults to TCP port 25 (SMTP/STARTTLS). Returns certificate usage (PKIX-TA / PKIX-EE / DANE-TA / DANE-EE), selector (cert / spki), matching type (full / SHA-256 / SHA-512), and digest hex. DNS only: this tool does NOT connect to <host>, so it does not check that the records match the certificate the server presents.
check_zone_transfer
Attempt AXFR zone transfer against every authoritative NS for <domain>. Open zone transfers are a NIST SP 800-81r3 §3.1 violation: any host can enumerate the full zone, exposing hostnames, mail servers, internal structure, and DNSSEC key material to reconnaissance. Transfers should be restricted to authorised secondaries. Per-NS state is recorded as `open` / `refused` / `error`. When at least one NS allows the transfer, the first successful transfer's zone summary (SOA serial, name list capped at 200, record type summary, total record count) is preserved in `zone_data` — showing exactly what…
cymru_asn
Look up the autonomous system (ASN) and originating prefix for an IP address via Team Cymru's DNS-based service. Returns ASN, AS name, prefix, country code, registry, and allocation date. No API key required.

Show 11 more tools

detect_hijacking
Test a recursive resolver for tampering / NXDOMAIN hijacking by querying known-good and known-bad names against it. Returns whether the resolver wildcards NXDOMAIN responses (a common ISP misbehavior), serves stale or modified answers, or respects DNSSEC.
dns_query
Query the configured DoH resolver for an arbitrary DNS record type. Supports any RR type — A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, SRV, CAA, DNSKEY, DS, RRSIG, NSEC, NSEC3, TLSA, SSHFP, HTTPS, SVCB, NAPTR. When dnssec=True (default), sets the DO bit so RRSIG records are returned alongside the answer. Returns answer/authority sections, AD/CD flags, rcode, and timing. With subnet (an EDNS Client Subnet hint), the result adds an `ecs` block. Read it before claiming an answer is what that subnet sees: only `tailored: true` means that (valid for /`scope`). `scope: 0` means the authority gave its d…
dnssec_validate
Walk the full DNSSEC trust chain from the IANA root trust anchor down to <domain>, performing real cryptographic validation at every zone cut. At each delegation: validates DS RRSIG against parent ZSK, verifies DS<->DNSKEY linkage by recomputing the digest, validates DNSKEY RRSIG against the zone's own KSK, tracks RRSIG inception/expiration windows. Returns a structured result with `verdict` (validated / validated_with_warnings / failed), per-zone findings (`zones[]`), full event transcript (`events[]`), and the final answer RRset (`target_step`). Use for diagnosing DNSSEC failures (broken …
enumerate_dkim_selectors
Find a domain's DKIM keys: header evidence first, guessing last. Selectors from `headers` (DKIM-Signature with d=<domain>) are checked first, then well-known names (`dns_tool.email.COMMON_SELECTORS`). A miss is NOT evidence of "no DKIM". DNS cannot list selectors, so when nothing is found the verdict is `undetermined` (DKIM_SELECTOR_NOT_FOUND_IN_PROBE_LIST, info). Never report "this domain has no DKIM" from this tool alone. Ask for a message header instead. A header selector with no published key IS proof of breakage (DKIM_SIGNING_SELECTOR_UNPUBLISHED, high).
nsec_info
Probe a zone's NSEC / NSEC3 denial-of-existence mechanism. Returns whether NSEC or NSEC3 is in use, NSEC3 hash parameters (algorithm, iterations, salt), and zone enumeration risk. NSEC leaks the next name in zone order (enumeration trivial); NSEC3 with high iterations resists enumeration.
ping
Return current timestamp, server uptime, and dns_tool version.
rdap_lookup
Query RDAP for domain registration data. Returns registration date, expiration date, registrar, status, nameservers, and contact information when published. Useful for triaging recently-registered domains in phishing investigations (look for domains registered within the last 30 days).
reset_stats
Clear all tool-call statistics and restart the session clock. Use sparingly — once stats are cleared they cannot be recovered. Returns the new session_start timestamp.
reverse_dns
Reverse DNS (PTR) lookup for an IPv4 or IPv6 address. Builds the reverse name (`4.3.2.1.in-addr.arpa` for IPv4, the nibble-reversed `...ip6.arpa` name for IPv6) and runs a PTR query through the same path as dns_query, returning the same shape (`query.name` shows the reverse name that was asked). Use this instead of dns_query with a bare IP: dns_query would look up the literal name (e.g. "8.8.8.8.") and get NXDOMAIN from the root, which looks like "no PTR" but is not. An NXDOMAIN or empty answer here does mean the address has no PTR record.
session_stats
Return per-tool call statistics for the current server session. Session = process lifetime; counters reset on container restart. Returns uptime, total call count, and a per-tool breakdown of count / error_count / mean_ms / max_ms / first_called / last_called. Use as the final call in a multi-tool investigation to record which tools were consulted and how expensive the run was.
whoami
Return the authenticated user's identity from JWT claims.

Signals

Stars: 1
Forks: 0
Open issues: 0
Last commit: Oct 6, 2026 (24 days ago)
Last release: Mar 29, 2026 (7 months ago)
Last package publish: Mar 29, 2026 (7 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.mclose/dns-mcp
Version: 1.3.4
Auth: No auth
Packages: oci docker.io/mclose/dns-mcp:1.3.4
License: License unknown
Repository: github.com/mclose/dns-mcp
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped: 50+; launches shipped
media placements: 500+; media placements
founders on every account: 2; founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get DNS MCP Server running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Need help deploying DNS MCP Server?

Call Get help

Cite this page

DNS MCP Server. Agent Mart. https://agentmart.dev/connectors/mclose-dns-mcp (last updated 2026-10-24)