KitScout

Categories › Web & Browser › SEO & site audits

TamingDNS

MCP serverVerified domain · tamingdns.comRemote● LiveFree to try

Check SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, DANE, DNSSEC and TXT; read headers and bounces.

Install

Remote server: your requests and data go to tamingdns.com. Claude Code: claude mcp add --transport http tamingdns https://tamingdns.com/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

  • check_spf — Check the SPF record for a domain. Returns the raw record, grade (A-F), the terminal `all` qualifier (resolved through redirect= chains), st
  • check_dkim — Look up a DKIM public key at <selector>._domainkey.<domain> and validate it. Detects key revocation (empty p=), RSA key length (KEY_TOO_SHOR
  • discover_dkim — Find a domain's DKIM keys without knowing the selector. Looks up every selector in the TamingDNS database (over 500, covering Google Workspa
  • check_dmarc — Check the _dmarc record for a domain with DUAL discovery: the RFC 7489 §6.6.3 organisational-domain ladder (what major receivers enforce tod
  • check_tls_rpt — Check the TLS-RPT (SMTP TLS Reporting, RFC 8460) record at _smtp._tls.<domain>. Strict §3 classification: the record must BEGIN with the cas
  • check_mta_sts — Check MTA-STS (RFC 8461) for a domain: the _mta-sts TXT record (strict §3.1 selection — case-sensitive leading v=STSv1, exactly one record,
  • check_bimi — Check default._bimi.<domain>: parses the BIMI record, validates the SVG Tiny-PS logo, inspects the VMC chain (expiry, EKU, SCT, issuer-accep
  • check_dane — Check SMTP DANE / TLSA records for a domain (RFC 7672). Resolves the MX hosts (falls back to the apex when none), looks up the TLSA record a
  • check_dnssec — Validate a domain's DNSSEC chain of trust. Pulls DS (at the parent), DNSKEY, and RRSIG over binary DoH, walks the chain zone-by-zone (root →
  • check_mx — Inspect a domain's MX / mail-routing posture. Resolves the apex MX RRset (priority-sorted), and for each host the A/AAAA addresses, PTR + fo
  • check_m365 — Audit a domain's DNS against what Microsoft 365 expects: SPF includes spf.protection.outlook.com, DKIM selector1/selector2 (CNAME target and
  • check_google_workspace — Audit a domain's DNS against what Google Workspace expects: MX to Google (smtp.google.com, or the legacy aspmx hosts Google still supports),
  • check_dns_propagation — Ask 14 public DoH resolvers in North and South America, Europe and Asia (Google, Cloudflare, Quad9, CIRA, Comcast, Mullvad, DNSPod, IIJ, DNS
  • check_txt — Inventory a domain's TXT records and say what is wrong with them. Reads every TXT at the apex and labels each one by vendor or purpose (SPF,
  • decode_bounce — Decode a pasted bounce: a full NDR email, an SMTP error line or a mail-log fragment. Finds the SMTP reply code and the enhanced status code
  • analyze_dmarc_report — Read one DMARC aggregate (RUA) report, the XML a receiver sends to the rua= address, pasted as text (decompress a .xml.gz first). Returns wh
  • check_website — Web-layer triage of one public hostname, the scan the /website page runs: A/AAAA with reverse DNS and ASN, CAA, the HTTPS redirect chain, th
  • check_mcp_keys — Read the v=MCPv1 TXT records at a domain, the keys the MCP Registry DNS login (mcp-publisher login dns) verifies a signature against, and ju
  • analyze_email_headers — Analyse a pasted block of raw email headers for spoofing and phishing tells. Input is the raw headers (everything up to the first blank line

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools