DNS MCP Server

Check for BIMI (Brand Indicators for Message Identification) record. Queries {selector}._bimi.{domain} for the BIMI TXT record. Reports whether BIMI is configured, the logo SVG URL, and whether a VMC (Verified Mark Certificate) is present.

Query Certificate Transparency logs via crt.sh for a domain. Returns all certificates logged for the domain and its subdomains, including: unique names/SANs discovered (useful for subdomain enumeration), per-cert details (issuer, validity, wildcard status), active vs expired counts, and a CAA cross-reference that correctly maps intermediate CA names to their parent CA identity (e.g. E7/E8 -> letsencrypt.org) rather than doing a naive string comparison that produces false positives. Retries automatically -- crt.sh is unreliable and frequently returns empty responses or times out on the first attempt.

Check for DANE TLSA records on a domain's mail servers. DANE binds TLS certificates to DNS via TLSA records, providing cryptographic assurance that a mail server's TLS certificate is the one the domain owner intended. DANE requires DNSSEC — without it, TLSA records are ignored by compliant MTAs. Queries MX records for the domain, then checks _25._tcp.{mx_host} for TLSA records and verifies DNSSEC (AD flag) for each. Classifies each MX host as dane_valid, dane_present_no_dnssec, or no_dane.

Check a domain against DNS-based Domain Block Lists (DBLs). DBLs classify domains rather than IPs. Query pattern: {domain}.{dbl-zone}. The registered (org) domain is used for the lookup, stripping subdomains. Lists queried (in order): Spamhaus DBL — classifies: spam / phishing / malware / botnet C2 / abused-legit variants. Direct return-code lookup. URIBL (multi.uribl.com) — bitmask: black / grey / red / multi. SURBL (multi.surbl.org) — bitmask: SC / WS / AB / PH / MW / CRX. Spamhaus DBL uses dbl.spamhaus.org by default (low-volume analyst use). Set SPAMHAUS_DQS_KEY env var to enable production DQS queries.

Verify a DKIM public key record exists for a given selector and domain. Queries {selector}._domainkey.{domain} for the DKIM TXT record and parses key parameters. Reports whether the key exists, its type, and whether it has been revoked (empty p= value).

Retrieve and parse a domain's DMARC policy. Queries _dmarc.{domain} for the DMARC TXT record and parses all tags. If no record exists at the exact domain, falls back to the organizational domain (e.g., sub.example.com falls back to _dmarc.example.com). Returns the parsed policy, alignment modes, reporting URIs, and other tags.

Detect fast-flux DNS by querying a domain's A/AAAA records multiple times and comparing the returned IP sets between rounds. Fast-flux is a technique used by botnets and phishing infrastructure to evade takedowns: the domain's records rotate rapidly through a large pool of compromised hosts, with very short TTLs (often < 60 s). Detection heuristic: - Sends query_count rounds of A + AAAA queries with delay_seconds between them. - flux_detected = True when min_ttl < 300 s AND ip_set_changes > 0 Returns: - min_ttl: lowest TTL observed across all answers (seconds) - unique_ips_seen: count of distinct IPs seen across all rounds - ip_set_changes: how many times the answer set changed between consecutive rounds - all_ips: sorted list of every distinct IP observed - flux_detected: bool — True when TTL is suspiciously low AND IPs rotated - queries: per-round detail [{index, ips, ttl}]

Check for MTA-STS (Mail Transfer Agent Strict Transport Security). Queries _mta-sts.{domain} for the DNS TXT record and parses version and policy ID. When fetch_policy is True (the default), also fetches the HTTPS policy file at https://mta-sts.{domain}/.well-known/mta-sts.txt and parses the mode, MX patterns, and max_age.

Check an IP address against 8 DNS-based Real-time Blackhole Lists (RBLs). Uses the standard DNS lookup method: reverses the IP octets (IPv4) or nibbles (IPv6), appends the RBL zone, and queries for A + TXT records. An A record answer means the IP is listed; the return code identifies the listing type. RBLs queried (in order): Spamhaus ZEN, SpamCop, UCEProtect L1, UCEProtect L2, Mailspike, PSBL, Barracuda, SORBS Spamhaus ZEN uses zen.spamhaus.org by default (low-volume analyst use). Set the SPAMHAUS_DQS_KEY env var to enable production DQS queries. SORBS may timeout occasionally — handled gracefully with per-RBL error capture so a slow zone never blocks the rest of the results. Mailspike returns positive reputation codes (127.0.0.10–14) for known-good senders — these are reported with listed=false and a reputation description.

Check for SMTP TLS Reporting (TLSRPT) DNS record. Queries _smtp._tls.{domain} for the TXT record and parses version and reporting URIs. Often paired with MTA-STS.

Retrieve and recursively parse a domain's SPF policy. Enumerates all authorized sending IPs/networks by following include chains. Enforces the RFC 7208 10-lookup limit to prevent infinite recursion. Returns the raw SPF record, parsed mechanisms, authorized networks, the 'all' qualifier, and the total lookup count.

Check for TLSA records at an arbitrary host:port:protocol combination. Builds the TLSA FQDN as _{port}._{protocol}.{hostname} and queries for TLSA records with DNSSEC (DO flag set). Reports whether records exist, their parameters (usage, selector, matching type, certificate data), and whether DNSSEC validation confirms authenticity (AD flag). Useful for non-mail DANE (HTTPS on 443, XMPP, etc.) or when you already know the MX hostname and want to check it directly without the MX lookup. For a domain-level mail DANE check across all MX hosts, use check_dane.

Look up the Autonomous System Number (ASN) for an IP via Team Cymru's DNS service. Step 1 — Origin lookup: IPv4: {reversed_octets}.origin.asn.cymru.com TXT IPv6: {reversed_nibbles}.origin6.asn.cymru.com TXT Response format: "ASN | prefix | CC | registry | allocated" Step 2 — Org name lookup: AS{asn}.asn.cymru.com TXT Response format: "ASN | | CC | registry | allocated | org name" 100% DNS — no HTTP. Authoritative BGP routing data. Flags known bulletproof / high-abuse ASNs from a built-in reference list.

Test a DNS resolver for signs of DNS hijacking or tampering. WiFi routers and ISPs sometimes intercept DNS queries and return spoofed responses — captive portals, ad-injection landing pages, or NXDOMAIN redirects. This tool sends five probes directly to the specified resolver and reports a clean/suspicious/hijacked verdict with per-check detail. Checks performed: 1. NXDOMAIN probe — queries a random domain; hijacked resolvers return IPs 2. Known stable record — a.root-servers.net A must return 198.41.0.4 3. DNSSEC AD flag — cloudflare.com A; AD set means resolver validates DNSSEC 4. Resolver identity — whoami.akamai.net TXT reveals the resolver's source IP 5. Transparent proxy — queries root server directly with RD=0; RA=1 means a transparent DNS proxy is intercepting port 53 traffic Verdict logic: - hijacked: NXDOMAIN probe returned NOERROR+IPs, OR known record IP wrong - suspicious: partial failures or timeouts without a clear hijack signal - clean: all checks passed

Perform a dig-style DNS query showing full response details. Sends a direct UDP query to the specified nameserver and returns detailed response information similar to the `dig` command output. Returns: - Header flags including DNSSEC-related flags (AD=Authenticated Data, CD=Checking Disabled) - Response status (NOERROR, NXDOMAIN, SERVFAIL, etc.) - Answer, Authority, and Additional sections with full record details

Perform DNSSEC chain-of-trust validation similar to `delv +vtrace`. Walks the trust chain from the root zone down to the target domain, validating DNSKEY and DS records at each level. Reports whether each step in the chain validates successfully. This tool reconstructs the chain manually (educational "show your work" output) and cross-checks its verdict against the resolver's AD flag on the same query. If the two disagree, a "discrepancy" field explains which to trust and suggests `delv +vtrace <domain>` for final confirmation. Returns: - Chain of trust from root to target domain - Validation status at each level - DNSKEY and DS record details - Final validation result (secure/insecure/bogus)

Query DNS records safely using dnspython library. Performs standard DNS lookups for common record types using the system resolver or a specified nameserver. Returns structured results with TTL information. Supports: A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, SRV, DNSKEY, DS, TLSA, CAA, SSHFP, RRSIG, CDS, CDNSKEY, HTTPS, SVCB, NAPTR record types. No shell execution - pure Python DNS resolution via dnspython.

Perform a DNS over TLS (DoT) query showing full response details. Establishes a TLS session directly to the resolver and sends a DNSSEC-enabled query, similar to: kdig @resolver +tls +dnssec +multi <type> <domain> Returns: - TLS session: protocol version (TLS1.3), cipher suite, key bits - Header: status (NOERROR/NXDOMAIN/SERVFAIL/REFUSED), flags (qr/rd/ra/ad/aa/tc/cd) - EDNS pseudosection: version, DO flag, UDP payload size, padding bytes - Answer, Authority, Additional sections with full record details - Round-trip time in ms

Probe a zone's DNSSEC denial-of-existence mechanism (NSEC vs NSEC3). Resolves the zone's authoritative nameserver, sends a DNSSEC-enabled query for a synthetic nonexistent name, and parses the NSEC or NSEC3 records returned in the authority section. Reports whether the zone is walkable (i.e., all names can be enumerated). Also queries the NSEC3PARAM record at the zone apex and cross-checks it against actual NSEC3 records to detect re-signing misconfigurations. Example: nsec_info("example.com") might return: denial_type: "nsec" zone_walkable: true walkability_note: "Zone uses plain NSEC. Every name in the zone is exposed — each NSEC record points to the next name in alphabetical order, allowing full zone enumeration by following the chain. This is common on smaller or older zones but considered a privacy risk for zones with sensitive hostnames." vs. denial_type: "nsec3" nsec3_params: {algorithm: 1, iterations: 10, salt: "aabbccdd", opt_out: false} zone_walkable: false walkability_note: "Zone uses NSEC3 with 10 iterations and a 4-byte salt. Names are SHA-1 hashed before publication, preventing direct zone enumeration. An attacker would need offline dictionary/rainbow table attacks against the hashed names to recover hostnames."

Lightweight health check. Returns server status and timestamp with no external dependencies — no DNS queries, no HTTP requests.

Return the source code of this MCP server. Reads and returns the contents of server.py via __file__. A diagnostic/introspection tool — no parameters, no external dependencies.

Retrieve domain registration data via RDAP (modern WHOIS replacement). Looks up the IANA RDAP bootstrap to find the correct server for the TLD, then queries for registration data. Calculates domain age for risk assessment (< 30 days = HIGH RISK, < 90 days = ELEVATED). This is the one tool that makes HTTP calls (not DNS). The domain input is validated before any HTTP request is made.

Reset all per-tool call statistics and restart the session clock. Use this to start a fresh measurement window without restarting the container. Returns a confirmation with the new session start time.

Perform reverse DNS (PTR) lookup for an IP address, with forward-confirmed rDNS (FCrDNS) verification. Converts the IP to its in-addr.arpa / ip6.arpa name, queries PTR records, then resolves each PTR hostname forward (A + AAAA) to confirm it maps back to the original IP. FCrDNS pass is required for trustworthy mail server identity.

Show server configuration: dnspython version, configured nameservers, search domains, and default domain. Useful for understanding which resolver the server is using and debugging query behavior.

Return per-tool call statistics for this container session. Reports uptime, total calls, and per-tool count/errors/latency since container start. Stats reset on every container restart — in-process only, no persistence.

Convert between different timestamp formats. Useful for interpreting DNS record timestamps, SOA serial numbers, and other time-based data encountered during DNS analysis. Accepts: - ISO 8601 strings (e.g., "2024-01-15T10:30:00Z") - Unix epoch timestamps (seconds since 1970-01-01) - Human-readable strings (YYYY-MM-DD, MM/DD/YYYY) Returns conversions to ISO, epoch, human-readable, date, time, and unix_ms formats.