Koskamo

TamingDNS MCP

A remote MCP server providing DNS and email authentication diagnostic tools for AI agents. It allows querying SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, DANE, and DNSSEC records, as well as analyzing email headers and bounce codes. The server operates without authentication and returns structured JSON results identical to the web interface.

Visit TamingDNS

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

TamingDNS MCP logo, by TamingDNSVendor evidenceStreamable HTTPNo sign-inEndpoint checked 2026-11-07Operated by TamingDNS
MCP endpoint (Streamable HTTP)
https://tamingdns.com/mcp
Vendor documentation

What its tools do

10 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Read-only (10)

10 of 10 have a description · 10 of 10 declare behavior hints · 10 of 10 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Passed Official MCP Registry namespace is tied to tamingdns.com ·
  • Passed Endpoint is on the registry namespace domain ·
  • Warning Advertises resources/templates/list but does not implement it
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Check SPF, DKIM, and DMARC records for a domain
  • Analyze raw email headers for authentication results
  • Validate DNSSEC chain of trust and DANE TLSA records
  • Decode SMTP bounce messages and NDRs

Source and maintenance

Vendor evidenceRegistry 1.0.0
mcp-registry: com.tamingdns/mcp@1.0.0Project website

Protocol and capabilities

Server
tamingdns 1.0.0
MCP protocol negotiated in check
2025-11-25
Tools
10 advertised
Resources
1 advertised
Resource templates
Not advertised
Prompts
1 advertised
Server-advertised capabilities
{
  "tools": {},
  "prompts": {},
  "resources": {}
}

Tools

10 advertised

check_spf — SPF Record Checker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check the SPF record for a domain. Returns the raw record, grade (A-F), the terminal `all` qualifier (resolved through redirect= chains), structured findings (NEAR_LOOKUP_LIMIT, LOOKUP_LIMIT_EXCEEDED, PLUS_ALL_DANGEROUS, PTR_MECHANISM_DEPRECATED, etc.), and an `analysis` block with the expanded include/redirect tree and the RFC 7208 §4.6.4 lookup count. Read-only.

check_spf input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_spf output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_spf annotations
{
  "title": "SPF Record Checker",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_dkim — DKIM Checker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Look up a DKIM public key at <selector>._domainkey.<domain> and validate it. Detects key revocation (empty p=), RSA key length (KEY_TOO_SHORT below 1024, KEY_WEAK below 2048), SHA-1 hash deprecation, and t=y test mode. For selector1/selector2 it also checks a Microsoft 365 CNAME target carries the token Microsoft builds for the domain (M365_DKIM_CNAME_MISMATCH), even when no key resolves. Returns an `analysis` block with the per-key facts (key_type, key_bits, key_strength, revoked, test_mode, hash_algs, m365_cname). Read-only.

check_dkim input schema
{
  "type": "object",
  "required": [
    "domain",
    "selector"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    },
    "selector": {
      "type": "string",
      "pattern": "^[a-zA-Z0-9._-]{1,63}$",
      "maxLength": 63,
      "description": "DKIM selector, e.g. \"google\", \"selector1\", \"20230601\"."
    }
  },
  "additionalProperties": false
}
check_dkim output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_dkim annotations
{
  "title": "DKIM Checker",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_dmarc — DMARC Record Analyser
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check the _dmarc record for a domain with DUAL discovery: the RFC 7489 §6.6.3 organisational-domain ladder (what major receivers enforce today — grade/verdict anchor to it) AND the RFC 9989 §4.10 DNS Tree Walk (8-query cap, psd=n/y stop rules, fewest-labels org selection) into analysis.discovery {legacy, tree_walk, diverges}. When the two methods select different policy records or org domains, DISCOVERY_DIVERGENCE (warn) fires with a one-notch grade downgrade. Also DMARCbis tag-aware: t=/np=/psd= parsed into analysis.tags, removed tags (pct/rf/ri) emit DEPRECATED_TAG, t=y emits TESTING_MODE with a one-notch downgrade. Returns the grade (A-F) with grade_reasons, a verdict (enforced/partial/monitoring/monitoring_blind/invalid/not_configured), structured findings (NO_DMARC_RECORD, MULTIPLE_DMARC_RECORDS, INVALID_TAG, POLICY_NONE, POLICY_NONE_NO_RUA, PCT_BELOW_100, RUA_MISSING_UNDER_ENFORCEMENT, SP_NOT_ENFORCED, EXTERNAL_RUA_UNAUTHORIZED, DMARC_INHERITED_FROM_ORG, TESTING_MODE, DEPRECATED_TAG, DISCOVERY_DIVERGENCE), and an `analysis` block with the lookup ladder, discovery, source (self/org), org_domain, normalised tags, per-recipient RUA/RUF external-authorisation detail (RFC 7489 §7.1), and rua_unauthorised. Read-only.

check_dmarc input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_dmarc output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_dmarc annotations
{
  "title": "DMARC Record Analyser",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_tls_rpt — TLS-RPT Checker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check the TLS-RPT (SMTP TLS Reporting, RFC 8460) record at _smtp._tls.<domain>. Strict §3 classification: the record must BEGIN with the case-sensitive v=TLSRPTv1 tag, more than one such record means receivers treat TLS-RPT as not implemented, and rua= is required. Validates every rua= destination syntactically (mailto:/https:// — reachability is never probed), and detects the MTA-STS and DANE prerequisites over DNS (TLSA at _25._tcp of the lowest-preference MX) with outage reported as unknown, never as absence. Returns grade (A-F) with grade_reasons, a verdict (valid/partial/invalid/not_configured), structured findings (TLS_RPT_NO_RECORD, TLS_RPT_INVALID_VERSION, TLS_RPT_MULTIPLE_RECORDS, TLS_RPT_NO_RUA, TLS_RPT_RUA_INVALID_URI, TLS_RPT_NO_VALID_RUA, TLS_RPT_NO_ENFORCEMENT_POLICY), and an `analysis` block with parsed tags, per-URI rua validation detail, and the prerequisite probe results. Read-only.

check_tls_rpt input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_tls_rpt output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_tls_rpt annotations
{
  "title": "TLS-RPT Checker",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_mta_sts — MTA-STS Checker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check MTA-STS (RFC 8461) for a domain: the _mta-sts TXT record (strict §3.1 selection — case-sensitive leading v=STSv1, exactly one record, required 1-32 alphanumeric id), the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt fetched WITHOUT following redirects (§3.3), strict §3.2 policy validation (version/mode/max_age required, mx required unless mode none, max_age ≤ 31557600, duplicate keys first-wins), the policy-host X.509 certificate (§3.3 — an invalid cert means compliant senders fetch no policy), and live MX coverage against the mx: patterns (§4.1 — wildcards match exactly one leftmost label; coverage is all/partial/none, partial meaning strict senders skip the uncovered hosts per §5.1). Returns grade (A-F) with grade_reasons, a verdict (enforced/testing/reporting_only/invalid/not_configured), structured findings (MTA_STS_NO_TXT_RECORD, MTA_STS_RECORD_INVALID, MULTIPLE_MTA_STS_RECORDS, MTA_STS_POLICY_UNREACHABLE, MTA_STS_POLICY_REDIRECT, MTA_STS_POLICY_INVALID, MTA_STS_CERT_INVALID, MTA_STS_MODE_NONE, MTA_STS_MODE_TESTING, MTA_STS_MX_MISMATCH, MTA_STS_MX_PARTIAL_COVERAGE, MTA_STS_MAX_AGE_TOO_LOW), and an `analysis` block (record, policy incl. fetch_stage, cert, MX coverage detail, TLS-RPT/DANE cross-signals). Read-only.

check_mta_sts input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_mta_sts output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_mta_sts annotations
{
  "title": "MTA-STS Checker",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_bimi — BIMI Record Checker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check default._bimi.<domain>: parses the BIMI record, validates the SVG Tiny-PS logo, inspects the VMC chain (expiry, EKU, SCT, issuer-accepted, SAN match, logotype hash), and verifies the DMARC prerequisite (p=quarantine/reject at pct=100 with no sp=none — the RFC 7489 reading Gmail and Apple Mail evaluate today). DMARCbis (RFC 9989) aware: t= is parsed into analysis.dmarc.t, t=y emits TESTING_MODE (warn under p=quarantine — bis receivers read it as none; info under p=reject), and a present pct= emits DEPRECATED_TAG (removed by RFC 9989 Appendix A.6, advisory only). Returns grade (A-F), structured findings, and an `analysis` block (logo/vmc/dmarc/provider_matrix). Read-only.

check_bimi input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_bimi output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_bimi annotations
{
  "title": "BIMI Record Checker",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_dane — DANE / TLSA Validator
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Check SMTP DANE / TLSA records for a domain (RFC 7672). Resolves the MX hosts (falls back to the apex when none), looks up the TLSA record at _25._tcp.<mx-host> over binary DoH, classifies each record (usage 0-3 / selector 0-1 / matching 0-2 per RFC 7671 §2.1), and confirms the answer carried the DNSSEC AD bit — DANE is meaningless without DNSSEC, so an unsigned TLSA answer is the dominant failure mode. Returns grade (A-F) with grade_reasons, a verdict (valid/valid_with_warnings/no_dnssec/not_configured/error), structured findings (DANE_NO_TLSA, DANE_TLSA_HOST_UNSIGNED, DANE_PKIX_TA_USED_WITHOUT_CHAIN, DANE_TLSA_EXACT_MATCH, DANE_PARTIAL_COVERAGE, DANE_TLSA_INVALID_USAGE/SELECTOR/MATCHING), and an `analysis` block (per-host TLSA records + DNSSEC status, the spec-compliance signals, and the MTA-STS cross-signal). DNS-only: it never opens a port-25 STARTTLS handshake, so it proves the TLSA records exist, are well-formed, and are DNSSEC-signed — never that they match the live cert (Hostinger and Cloudflare both block outbound 25). Read-only.

check_dane input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_dane output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_dane annotations
{
  "title": "DANE / TLSA Validator",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_dnssec — DNSSEC Checker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Validate a domain's DNSSEC chain of trust. Pulls DS (at the parent), DNSKEY, and RRSIG over binary DoH, walks the chain zone-by-zone (root → TLD → domain) recomputing each DS digest against the published DNSKEYs (RFC 4034 §5.1.4), and cross-checks the AD bit across Cloudflare, Google, Quad9, and OpenDNS so a single resolver's caching can't mask a break. Returns grade (A-F) with grade_reasons, a verdict (signed/signed_no_ds/partial/unsigned/broken), structured findings (DNSSEC_UNSIGNED, DNSSEC_DS_MISSING_AT_PARENT, DNSSEC_DS_ALGORITHM_DEPRECATED, DNSSEC_DNSKEY_ALGORITHM_DEPRECATED, DNSSEC_RRSIG_EXPIRED, DNSSEC_BOGUS, DNSSEC_AD_BIT_MISSING), and an `analysis` block (the full chain-walk, the per-resolver validator matrix, NSEC3 iteration/opt-out, CDS/CDNSKEY publication, signing mode, root-anchor state). Unsigned is the common case and returns status "info" (DNSSEC is optional), not a failure; signed_no_ds (DNSKEY published, no DS at the parent yet) is treated by validators as unsigned and also returns "info"; a published-but-non-validating zone returns "fail". Read-only.

check_dnssec input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_dnssec output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_dnssec annotations
{
  "title": "DNSSEC Checker",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
check_mx — MX Record Inspector
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Inspect a domain's MX / mail-routing posture. Resolves the apex MX RRset (priority-sorted), and for each host the A/AAAA addresses, PTR + forward-confirmed reverse DNS (FCrDNS), DANE TLSA at _25._tcp.<host>, IP-literal (RFC 5321 §5) and CNAME (RFC 2181 §10.3) violations, and the mail provider. Detects the null MX (RFC 7505), a null MX wrongly mixed with real MX, and the implicit MX via the apex A/AAAA when no MX exists (RFC 5321 §5). Probes the MTA-STS and TLS-RPT prerequisites over DNS (case-sensitive per RFC 8461/8460) with outage reported as unknown, never absence. Returns grade (A-F) with grade_reasons, a verdict (healthy/warnings/misconfigured/null_mx/no_mx/implicit_mx), structured findings (NO_MX_RECORD, MX_IMPLICIT_FALLBACK, NULL_MX, NULL_MX_WITH_OTHER, MX_POINTS_TO_IP, MX_POINTS_TO_CNAME, MX_HOSTNAME_UNRESOLVABLE, NO_PTR_RECORD, FCRDNS_MISMATCH, MX_IPV6_ONLY, MX_NO_TRANSPORT_SECURITY, MX_GATEWAY_RDNS_COSMETIC, MX_SINGLE_HOST, MX_DUPLICATE_HOST, MX_SHARED_PRIORITY, MX_MTA_STS_WITHOUT_TLS_RPT), and an `analysis` block (per-host enrichment incl. provider, ips with FCrDNS status, dane_tlsa, and the prerequisite probe results). DNSSEC AD is a UI-only signal, not gradeable through the DoH contract. Read-only.

check_mx input schema
{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
      "maxLength": 253,
      "description": "Apex domain to inspect, e.g. \"google.com\". No scheme, no path."
    }
  },
  "additionalProperties": false
}
check_mx output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
check_mx annotations
{
  "title": "MX Record Inspector",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
analyze_email_headers — Email Header Analyser
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Analyse a pasted block of raw email headers for spoofing and phishing tells. Input is the raw headers (everything up to the first blank line — "Show original" / "View source"); the message body is not required. Returns structured findings + a phishing verdict (likely_phishing/verify_sender/minor_concerns/legitimate/auth_incomplete) derived from SPF/DKIM/DMARC alignment (RFC 7489 §3.1), Microsoft composite-auth compauth reason codes (000/010 enforced failure, 601 intra-org implicit failure, 001 weak posture), ARC chain integrity (RFC 8617 §5.2), homoglyph / IDN look-alike From domains (Unicode UTS #39), header smuggling via duplicate singleton headers (RFC 5322 §3.6), display-name-as-address spoofing, hidden bidi/control characters (UAX #9), Received-chain timestamps running backward (RFC 5321 §4.4), link display-text-vs-href mismatches, originating-IP FCrDNS (RFC 8601), and RFC 8058 List-Unsubscribe deliverability posture (category:compliance, never moves the verdict). Findings include DMARC_FAILED, SPF_HARD_FAIL, DKIM_SIGNATURE_FAILED, COMPAUTH_EXPLICIT_FAILURE, COMPAUTH_INTRA_ORG_IMPLICIT_FAILURE, HOMOGLYPH_DOMAIN, DUPLICATE_HEADER, DISPLAY_NAME_SPOOFED_ADDRESS, RECEIVED_TIMESTAMPS_BACKWARD, URL_DISPLAY_MISMATCH, HIDDEN_CONTROL_CHAR, BRAND_IMPERSONATION, and more (registered in docs/finding-codes.md). `status` is the finding-severity aggregate; `verdict` is the authoritative phishing judgment; `analysis` carries the verdict object + per-mechanism authentication. For privacy the echoed `input` is a digest only (from / subject / message_id) — raw headers are never returned. Read-only.

analyze_email_headers input schema
{
  "type": "object",
  "required": [
    "headers"
  ],
  "properties": {
    "headers": {
      "type": "string",
      "maxLength": 262144,
      "minLength": 1,
      "description": "Raw email headers as a single string (everything up to the first blank line — the \"Show original\" / \"View source\" output). The message body is not required."
    }
  },
  "additionalProperties": false
}
analyze_email_headers output schema
{
  "type": "object",
  "required": [
    "tool",
    "tool_version",
    "schema_version",
    "input",
    "status",
    "findings",
    "records",
    "timestamp",
    "provenance"
  ],
  "properties": {
    "tool": {
      "type": "string"
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message",
        "retriable"
      ],
      "properties": {
        "code": {
          "type": "string"
        },
        "message": {
          "type": "string"
        },
        "retriable": {
          "type": "boolean"
        }
      }
    },
    "grade": {
      "enum": [
        "A",
        "B",
        "C",
        "D",
        "F"
      ],
      "type": "string"
    },
    "input": {
      "type": "object"
    },
    "status": {
      "enum": [
        "pass",
        "warn",
        "fail",
        "info"
      ],
      "type": "string"
    },
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name",
          "type",
          "ttl",
          "data"
        ],
        "properties": {
          "ttl": {
            "type": "integer"
          },
          "data": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    },
    "verdict": {
      "type": "string"
    },
    "analysis": {
      "type": "object"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "code",
          "severity",
          "title"
        ],
        "properties": {
          "code": {
            "type": "string",
            "pattern": "^[A-Z][A-Z0-9_]+$"
          },
          "title": {
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "info",
              "warn",
              "error"
            ],
            "type": "string"
          },
          "explanation": {
            "type": "string"
          },
          "remediation": {
            "type": "string"
          }
        }
      }
    },
    "resolvers": {
      "type": "array"
    },
    "timestamp": {
      "type": "string"
    },
    "provenance": {
      "type": "object",
      "required": [
        "operated_by"
      ],
      "properties": {
        "operated_by": {
          "type": "string"
        }
      }
    },
    "tool_version": {
      "type": "string"
    },
    "grade_reasons": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "schema_version": {
      "type": "integer",
      "const": 1
    }
  }
}
analyze_email_headers annotations
{
  "title": "Email Header Analyser",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

1 advertised

audit_email_auth

Advertised by the server during the last successful anonymous check.

Run the full email-authentication audit on a domain: SPF + DMARC + DKIM (common selectors) + BIMI. Returns a consolidated grade + remediation plan.

domain
Apex domain to audit. (required)

Resources

1 advertised

TamingDNS finding-code registry

Advertised by the server during the last successful anonymous check.

Stable public-API code registry for every finding emitted by TamingDNS tools. See docs/finding-codes.md.

TamingDNS finding-code registry URI
mcp://tamingdns/resources/finding-codes

MIME type: text/markdown

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (1 of 1 answered).

  1. 2026-11-07: 1 of 1 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
559 ms
95th percentile latency
559 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 559 ms · metadata changed · 10 tool(s), 1 resource(s), 1 prompt(s); warnings: Advertises resources/templates/list but does not implement it

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http tamingdns-mcp https://tamingdns.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add tamingdns-mcp --url https://tamingdns.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable tamingdns-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "tamingdns-mcp": {
      "url": "https://tamingdns.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "tamingdns-mcp": {
      "type": "streamableHttp",
      "url": "https://tamingdns.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start tamingdns-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "tamingdns-mcp": {
      "type": "http",
      "url": "https://tamingdns.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http tamingdns-mcp https://tamingdns.com/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://tamingdns.com/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "tamingdns-mcp": {
      "serverUrl": "https://tamingdns.com/mcp"
    }
  }
}

Let your agent find its tools

Find servers like TamingDNS MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 9,321

Do you run TamingDNS MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing