TamingDNS

com.tamingdns/mcp · v2.0.0

Check SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, DANE, DNSSEC and TXT; read headers and bounces.

Website Source code Set it up

Connect Remote server

Terminal

claude mcp add --transport http mcp https://tamingdns.com/mcp

~/.cursor/mcp.json

{
  "mcpServers": {
    "mcp": {
      "url": "https://tamingdns.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "mcp": {
      "type": "http",
      "url": "https://tamingdns.com/mcp"
    }
  }
}

Claude Desktop

Settings > Connectors > Add custom connector
URL: https://tamingdns.com/mcp

Tools 19 found in our last check

check_spf
Check the SPF record for a domain. Returns the raw record, grade (A-F), the terminal `all` qualifier (resolved through redirect= chains), structured findings (NEAR_LOOKUP_LIMIT, LOOKUP_LIMIT_EXCEEDED, PLUS_ALL_DANGEROUS, PTR_MECHANISM_DEPRECATED, etc.), and an `analysis` block w…
check_dkim
Look up a DKIM public key at <selector>._domainkey.<domain> and validate it. Detects key revocation (empty p=), RSA key length (KEY_TOO_SHORT below 1024, KEY_WEAK below 2048), SHA-1 hash deprecation, and t=y test mode. For selector1/selector2 it also checks a Microsoft 365 CNAME…
discover_dkim
Find a domain's DKIM keys without knowing the selector. Looks up every selector in the TamingDNS database (over 500, covering Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES and over 100 other named providers) plus the *._domainkey wildcard, and validates each k…
check_dmarc
Check the _dmarc record for a domain with DUAL discovery: the RFC 7489 §6.6.3 organisational-domain ladder (what major receivers enforce today — grade/verdict anchor to it) AND the RFC 9989 §4.10 DNS Tree Walk (8-query cap, psd=n/y stop rules, fewest-labels org selection) into a…
check_tls_rpt
Check the TLS-RPT (SMTP TLS Reporting, RFC 8460) record at _smtp._tls.<domain>. Strict §3 classification: the record must BEGIN with the case-sensitive v=TLSRPTv1 tag, more than one such record means receivers treat TLS-RPT as not implemented, and rua= is required. Validates eve…
check_mta_sts
Check MTA-STS (RFC 8461) for a domain: the _mta-sts TXT record (strict §3.1 selection — case-sensitive leading v=STSv1, exactly one record, required 1-32 alphanumeric id), the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt fetched WITHOUT following redirects (§3…
check_bimi
Check default._bimi.<domain>: parses the BIMI record, validates the SVG Tiny-PS logo, inspects the VMC chain (expiry, EKU, SCT, issuer-accepted, SAN match, logotype hash), and verifies the DMARC prerequisite (p=quarantine/reject at pct=100 with no sp=none — the RFC 7489 reading…
check_dane
Check SMTP DANE / TLSA records for a domain (RFC 7672). Resolves the MX hosts (falls back to the apex when none), looks up the TLSA record at _25._tcp.<mx-host> over binary DoH, classifies each record (usage 0-3 / selector 0-1 / matching 0-2 per RFC 7671 §2.1), and confirms the…
check_dnssec
Validate a domain's DNSSEC chain of trust. Pulls DS (at the parent), DNSKEY, and RRSIG over binary DoH, walks the chain zone-by-zone (root → TLD → domain) recomputing each DS digest against the published DNSKEYs (RFC 4034 §5.1.4), and cross-checks the AD bit across Cloudflare, G…
check_mx
Inspect a domain's MX / mail-routing posture. Resolves the apex MX RRset (priority-sorted), and for each host the A/AAAA addresses, PTR + forward-confirmed reverse DNS (FCrDNS), DANE TLSA at _25._tcp.<host>, IP-literal (RFC 5321 §5) and CNAME (RFC 2181 §10.3) violations, and the…
check_m365
Audit a domain's DNS against what Microsoft 365 expects: SPF includes spf.protection.outlook.com, DKIM selector1/selector2 (CNAME target and key), DMARC policy and rua=, MX to Microsoft 365 (*.mail.protection.outlook.com or *.mx.microsoft), MTA-STS, Autodiscover to autodiscover.…
check_google_workspace
Audit a domain's DNS against what Google Workspace expects: MX to Google (smtp.google.com, or the legacy aspmx hosts Google still supports), SPF includes _spf.google.com, a DKIM key at the default google selector (google._domainkey), DMARC policy and rua=, MTA-STS, TLS-RPT and B…
check_dns_propagation
Ask 14 public DoH resolvers in North and South America, Europe and Asia (Google, Cloudflare, Quad9, CIRA, Comcast, Mullvad, DNSPod, IIJ, DNS.SB and more) for one record type at one name, and report whether they agree. Use it after changing a record to see whether the change has…
check_txt
Inventory a domain's TXT records and say what is wrong with them. Reads every TXT at the apex and labels each one by vendor or purpose (SPF, Google, Microsoft, Atlassian, Stripe and over a hundred more, grouped into categories), then reads 12 well-known names (_dmarc, _mta-sts,…
decode_bounce
Decode a pasted bounce: a full NDR email, an SMTP error line or a mail-log fragment. Finds the SMTP reply code and the enhanced status code (RFC 3463 X.Y.Z), names the provider that sent it (Google, Microsoft, Yahoo, Apple, Comcast, Proofpoint, Mimecast, Barracuda), and returns…
analyze_dmarc_report
Read one DMARC aggregate (RUA) report, the XML a receiver sends to the rua= address, pasted as text (decompress a .xml.gz first). Returns who reported and when (analysis.report), the policy the domain published (analysis.policy), message totals and the split into DMARC-capable,…
check_website
Web-layer triage of one public hostname, the scan the /website page runs: A/AAAA with reverse DNS and ASN, CAA, the HTTPS redirect chain, the TLS certificate (issuer, SANs, expiry, WebPKI trust, TLS version), security headers (HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy…
check_mcp_keys
Read the v=MCPv1 TXT records at a domain, the keys the MCP Registry DNS login (mcp-publisher login dns) verifies a signature against, and judge each the way the registry does: v=MCPv1; k=<algorithm>; p=<key> in that order and case, k exactly ed25519 or ecdsap384, p padded standa…
analyze_email_headers
Analyse a pasted block of raw email headers for spoofing and phishing tells. Input is the raw headers (everything up to the first blank line — "Show original" / "View source"); the message body is not required. Returns structured findings + a phishing verdict (one of likely_phis…

Details

Endpoint	`https://tamingdns.com/mcp` (Streamable HTTP)
First published	13 Nov 2026
Last updated	13 Nov 2026
Registry name	`com.tamingdns/mcp`

More search and web servers See all

Live status

Live

Typical response: 135 ms
Answered: 100% of 2 checks
Last check: 13 Nov 2026

30 days agoToday

We connect daily without credentials and run initialize and tools/list.

Pair it with live search

Agents that use TamingDNS often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/com-tamingdns-mcp/badge.svg)](https://nestdaddy.com/mcp/servers/com-tamingdns-mcp)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.