About Domain Security
Domain Security is an MCP server published by OrtaMarco in the Browser category: audit a domain's email and web security: SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS, WHOIS. No API keys.
Recent commit activity is the strongest signal that reported issues will get attention.
Install
claude mcp add domain-security -- npx -y domain-security-mcp-servernpx -y domain-security-mcp-serverThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (18)
analyze_email_headersParse raw headers → SPF/DKIM/DMARC verdicts + Received hop chain with delays
Parameters not published.
bimi_checkCheck the `default._bimi` BIMI record
Parameters not published.
blacklist_checkIP/domain against open-access email DNSBLs
Parameters not published.
caa_checkWhich CAs may issue TLS certificates (CAA records)
Parameters not published.
dkim_checkProbe `<selector>._domainkey` keys (supply selectors or use common ones)
Parameters not published.
dmarc_checkParse DMARC policy (`p`, `sp`, `rua`, `pct`, `aspf`/`adkim`) with warnings
Parameters not published.
dns_lookupAll record types (A/AAAA/CNAME/MX/NS/TXT/SOA) via public resolvers
Parameters not published.
dns_propagationCompare a record across 5 public resolvers worldwide
Parameters not published.
dnssec_checkDS/DNSKEY presence + DNSSEC `AD` validation flag (via DoH)
Parameters not published.
http_security_headersGrade a site's HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and COOP
Parameters not published.
Show all 18 tools
ip_geolocationOffline IP geolocation ([DB-IP Lite](https://db-ip.com)) + reverse DNS
Parameters not published.
mta_sts_checkValidate the `_mta-sts` TXT **and** the `.well-known/mta-sts.txt` policy + mode
Parameters not published.
mx_lookupMail servers (MX) with priority and resolved IPs
Parameters not published.
reverse_dnsPTR records for an IP
Parameters not published.
spf_checkParse SPF; recursively count DNS lookups vs the RFC 7208 limit of 10; flag `+all`/`?all`
Parameters not published.
ssl_certificateTLS cert issuer, validity window, days-to-expiry, SANs, fingerprint
Parameters not published.
tls_rpt_checkCheck the `_smtp._tls` TLS-RPT record
Parameters not published.
whois_lookupRegistrar, dates, name servers, status (raw port-43 WHOIS, IANA-resolved)
Parameters not published.
Ask AI
Ask AI about Domain Security
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.