KitScout

Categories › Security › Secrets & identity

BlackVeil DNS & Email Security Scanner

MCP serverVerified domain · blackveilsecurity.comRemote● LiveFree to try

DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

Install

Remote server: your requests and data go to dns-mcp.blackveilsecurity.com. Claude Code: claude mcp add --transport http blackveil-dns-email-security-scanner https://dns-mcp.blackveilsecurity.com/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do (first 40)

The tools this server listed when we connected to it, in its own words.

  • get_access_context — Read the effective authentication context for this request: tier, owner-IP-gate disposition, a keyed pseudonymous principal reference, serve
  • check_mx — Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used
  • check_spf — Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the d
  • check_dmarc — Look up and validate a domain's DMARC record: enforcement level (none/quarantine/reject), alignment mode, and aggregate/forensic reporting d
  • check_dkim — Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519)
  • check_dnssec — Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by val
  • check_ssl — Check HTTPS/TLS posture: reachability, HSTS, HTTP-to-HTTPS redirect, and certificate issuer, expiry, days remaining and SAN count from publi
  • check_mta_sts — Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and f
  • check_ns — Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available,
  • check_caa — Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.
  • check_bimi — Check the BIMI record at default._bimi.<domain>: validates the logo URL (l=), the presence of mark-certificate authority evidence (a=; a bar
  • check_tlsrpt — Check whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its
  • check_http_security — Audit browser-facing HTTP security headers over HTTPS: Content-Security-Policy (unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Con
  • check_dane — Check DANE/TLSA pinning for SMTP: looks up TLSA records at _25._tcp.<mx-host> for each MX and validates their fields and DNSSEC backing. Rec
  • check_ptr — Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit.
  • check_dane_https — Verify DANE/TLSA pinning for HTTPS (port 443): looks up TLSA records at _443._tcp.<domain> and validates fields and DNSSEC backing. Reported
  • check_svcb_https — Validate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit.
  • check_lookalikes — Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-subs
  • check_subdomailing — Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the
  • scan_domain — Run a full DNS and email security audit for one domain across every scan-included check (SPF, DKIM, DMARC, DNSSEC and more); returns an over
  • batch_scan — Bulk-scan up to 10 domains in parallel with a full security audit each; returns score, NIST-aligned letter grade (A+ to F) and finding count
  • batch_scan_start — Start a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, norm
  • batch_scan_status — Read the owner-scoped status of an asynchronous batch scan.
  • batch_scan_findings — Fetch owner-scoped findings for a completed asynchronous batch scan.
  • compare_domains — Side-by-side security comparison of 2–5 domains. Shows relative scores, category gaps, and unique weaknesses for each domain. Use when compa
  • compare_baseline — Compare a domain's current security configuration against a fixed policy baseline to determine compliance. Use to check whether a domain mee
  • check_shadow_domains — Find alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to s
  • check_txt_hygiene — Audit TXT records for stale entries and SaaS exposure.
  • check_mx_reputation — Check whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies re
  • check_srv — Map a domain's DNS-visible service footprint by probing 19 common SRV prefixes (email, calendar, messaging, directory, web) in parallel; ret
  • check_zone_hygiene — Audit DNS zone hygiene: identifies sensitive or forgotten subdomains exposed in DNS, stale SOA records, and zone propagation issues. Use to
  • generate — Generate a DNS/email security remediation artifact. Artifact types: spf_record (build a new SPF record), dmarc_record (create a DMARC policy
  • get_domain_rank — Rank a domain against its country or global cohort using the GSI benchmark corpus. Accepts a domain score (from scan_domain) and optional co
  • get_benchmark — Get industry benchmark data: shows what percentile a domain's security score ranks at within its sector or country cohort, the mean score, a
  • get_provider_insights — Get security benchmarks and common configuration issues for a specific email or DNS service-provider cohort (e.g. Google Workspace customers
  • assess_spoofability — Compute a composite email spoofability risk score (0-100, higher = more spoofable) from SPF trust surface, DMARC enforcement and DKIM covera
  • check_resolver_consistency — Check DNS consistency across 4 public resolvers.
  • explain_finding — Explain a finding with impact and remediation.
  • map_supply_chain — Map DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to revea
  • analyze_drift — Measure whether a domain's DNS security posture improved or regressed versus a prior scan snapshot; returns a drift classification (improvin

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools