Domain Security

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/ortamarco-domain-security-mcp-server

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools

19 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

None found

Runs as

Node.js package

Tools (19)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• analyze_email_headersEmail Header Analyzerread-only

  Parse raw email headers and report the SPF/DKIM/DMARC verdicts (from Authentication-Results), key fields (From, Subject, Date, Message-ID, Return-Path) and the Received hop chain with per-hop delays and total transit time. Args: - headers (string): the raw email headers. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { auth{spf,dkim,dmarc}, fields{}, hops[{index,from,by,date,delaySec}], totalSec }. Example: paste the headers from "Show original" in Gmail to trace a message's path and authentication.

• bimi_checkBIMI Checkread-only

  Check a domain's BIMI record (default._bimi.<domain> TXT), which points to the brand logo (and optional VMC) displayed next to authenticated mail. BIMI requires an enforced DMARC policy to take effect. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, findings[] }. Example: "Does cnn.com have BIMI set up?" -> bimi_check(domain="cnn.com").

• blacklist_checkDNSBL Blacklist Checkread-only

  Check whether an IPv4 address (or a domain's A records) appears on email DNS blocklists (DNSBLs). Only open-access lists are queried (SpamCop, UCEPROTECT-1, DroneBL, s5h); Spamhaus and Barracuda refuse public-resolver queries and are excluded. Args: - query (string): an IPv4 address or a domain. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ips[], listedCount, checked, results[{ip, hits[{list, listed, reason, error}]}], note }. A list that did not answer carries an `error` and is not counted as clean. Example: "Is 203.0.113.5 blacklisted?" -> bl…

• caa_checkCAA Record Checkread-only

  Check a domain's CAA (Certification Authority Authorization) records — which CAs are allowed to issue TLS certificates for it. Absence means any CA may issue. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, issue[], issuewild[], iodef[] }. Example: "Which CAs can issue certs for google.com?" -> caa_check(domain="google.com").

• dkim_checkDKIM Record Checkread-only

  Look up DKIM public keys at <selector>._domainkey.<domain>. Because DKIM selectors are arbitrary and undiscoverable, you should pass the selector(s) your mail provider uses for a definitive answer; otherwise a curated list of common selectors is probed and a miss is inconclusive. Args: - domain (string): the domain to check. - selectors (string[], optional): DKIM selectors to probe. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { any_found, probed_selectors, selectors[{selector, found, record, key_type}], findings[] }. Examples: - "Does acme.c…

• dmarc_checkDMARC Record Checkread-only

  Fetch and parse a domain's DMARC record (_dmarc.<domain>). Reports the policy (p=), subdomain policy (sp=), reporting addresses (rua/ruf), pct and alignment (aspf/adkim), and warns on monitor-only or partial deployments. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, policy, tags{}, findings[] }. Example: "What is paypal.com's DMARC policy?" -> dmarc_check(domain="paypal.com").

• dns_lookupDNS Lookupread-only

  Resolve all common DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA) for a domain in one call, using public resolvers (Cloudflare/Google/Quad9). Args: - domain (string): the domain to query, e.g. "example.com". - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: a map of record type -> list of records. Each record has { type, host, value, priority? }. Examples: - "What are the MX records for stripe.com?" -> dns_lookup(domain="stripe.com") - Use ssl_certificate for TLS details, whois_lookup for registration data. Errors: returns an error if the do…

• dns_propagationDNS Propagation Checkread-only

  Compare a domain's DNS records across multiple public resolvers worldwide (Cloudflare, Google, Quad9, OpenDNS, AdGuard) to see whether a change has propagated. Args: - domain (string): the domain to check. - type ('A'|'AAAA'|'CNAME'|'MX'|'NS'|'TXT'): record type (default 'A'). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { type, consistent, resolvers[{name, server, values[], error}] }. Example: "Has the A record for example.com propagated?" -> dns_propagation(domain="example.com").

• dnssec_checkDNSSEC Checkread-only

  Check whether a domain is protected by DNSSEC. Queries DS and DNSKEY records over DNS-over-HTTPS and reads the resolver's Authenticated Data (AD) flag to confirm the chain of trust validates. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { enabled, validated, ds_records, dnskey_records, findings[] }. Example: "Is cloudflare.com DNSSEC-signed?" -> dnssec_check(domain="cloudflare.com").

• email_auth_auditEmail Authentication Auditread-only

  Headline tool. Audits a domain's email-authentication posture in one call — SPF, DKIM, DMARC and MX — then returns a 0–100 score, an A–F grade and a prioritised list of fixes. Use this first; reach for the per-record tools (spf_check, dmarc_check, dkim_check) only when you need the full detail of one mechanism. Args: - domain (string): the domain to audit. - dkim_selectors (string[], optional): DKIM selectors to probe. If omitted, common provider selectors are tried (absence is then inconclusive). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns (JSO…

• http_security_headersHTTP Security Headersread-only

  Fetch a URL and grade its HTTP security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP). Returns a 0–100 score, an A–F grade, and per-header notes. Args: - url (string): URL or host to check (scheme defaults to https://). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { url, final_url, status, grade, score, checks[{header, present, value, note}], missing[] }. Example: "Grade the security headers on https://news.ycombinator.com" -> http_security_headers(url="https://news.yco…

• ip_geolocationIP Geolocationread-only

  Geolocate an IP address (country, region, city, coordinates, time zone) using the offline DB-IP Lite database, plus its reverse-DNS hostname. No external API. Args: - ip (string): IPv4 or IPv6 address. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ip, country_iso, country_name, region, city, latitude, longitude, time_zone, hostname }. Example: "Where is 151.101.1.69 located?" -> ip_geolocation(ip="151.101.1.69"). Note: geolocation is approximate (city-level at best) and offline data may lag reality. The time zone is estimated from the coordinate…

• mta_sts_checkMTA-STS Checkread-only

  Check a domain's MTA-STS deployment: the _mta-sts TXT record AND the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. Reports the enforcement mode (enforce/testing/none) and the listed MX hosts. MTA-STS forces TLS for inbound SMTP and blocks downgrade attacks. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { dns_record_found, policy_found, mode, policy{}, findings[] }. Example: "Does gmail.com enforce MTA-STS?" -> mta_sts_check(domain="gmail.com").

• mx_lookupMX Lookupread-only

  Look up a domain's mail servers (MX records) with priority and the IPs they resolve to. Args: - domain (string): the domain to query. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: array of { exchange, priority, ips[] }. Example: "What are the mail servers for github.com?" -> mx_lookup(domain="github.com").

• reverse_dnsReverse DNS (PTR)read-only

  Resolve the PTR (reverse DNS) records for an IP address — the hostname(s) the IP maps back to. Args: - ip (string): IPv4 or IPv6 address. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ip, hostnames: string[] }. Example: "What hostname does 8.8.8.8 reverse to?" -> reverse_dns(ip="8.8.8.8"). Errors: returns an error if the IP is invalid or has no PTR record.

Signals

Stars

1

Forks

0

Open issues

0

Last commit

Oct 16, 2026 (13 days ago)

Last release

Oct 16, 2026 (13 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

io.github.OrtaMarco/domain-security-mcp-server

Version

1.2.3

Auth

No auth

Packages

npm domain-security-mcp-server

License

MIT

Repository

github.com/OrtaMarco/domain-security-mcp-server

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql