IntoDNS.ai DNS & Email Security Scanner

DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)

Claude Code

claude mcp add --transport http intodns-ai-dns-email-security-scanner 'https://intodns.ai/api/mcp'

JSON configuration (Claude Desktop, Cursor, VS Code)

{
    "mcpServers": {
        "intodns-ai-dns-email-security-scanner": {
            "type": "http",
            "url": "https://intodns.ai/api/mcp"
        }
    }
}

NPM package intodns-mcp

Claude Code

claude mcp add intodns-ai-dns-email-security-scanner -- npx -y intodns-mcp@1.11.2

JSON configuration (Claude Desktop, Cursor, VS Code)

{
    "mcpServers": {
        "intodns-ai-dns-email-security-scanner": {
            "command": "npx",
            "args": [
                "-y",
                "intodns-mcp@1.11.2"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents

IntoDNS MCP Server
Quick Start
Supported clients
Tools
Example Prompts
Remote / HTTP mode
Configuration
Requirements
License

IntoDNS MCP Server

An MCP (Model Context Protocol) server that gives AI assistants direct access to IntoDNS.ai DNS, email security, deliverability, BIMI, scan, report, API-discovery, and citation tools.

45 tools, no API key, no signup. Backed by intodns.ai's free public diagnostic API.

Ask your AI assistant: "Scan example.com, check SPF/DKIM/DMARC/BIMI, and cite the canonical IntoDNS.ai sources." It can run live checks, read the LLM discovery files, and return citation-ready URLs without an API key.

Quick Start

Add this to your MCP client config, for example Claude Desktop:

{
  "mcpServers": {
    "intodns": {
      "command": "npx",
      "args": ["-y", "intodns-mcp"]
    }
  }
}

Restart the client after editing the config.

You can also run it directly:

npx -y intodns-mcp

Supported clients

Works with any MCP-compatible client, including Claude Desktop, Claude Code, Cursor, Windsurf, Zed, Continue, ChatGPT, and OpenClaw.

Tools

Scan tools

Tool	What it does
`scan_domain`	Fast IntoDNS.ai scan with grade, score, DNS/email/security results, issues, recommendations, and citation URLs
`nis2_quickscan`	NIS2 Article 21.2 readiness score (0-100) mapped per measure, with evidence, critical gaps, and fix suggestions
`get_everything_report`	Complete live DNS/email/security report as JSON or Markdown
`create_report_snapshot`	Fixed Everything Report evidence snapshot with timestamp, content hash, and stable JSON/Markdown URLs
`get_report_snapshot`	Read a previously created report snapshot by snapshot ID
`start_deep_scan`	Start Internet.nl deep scan (`web`, `mail`, or `both`)
`get_deep_scan_status`	Fetch deep scan status/results
`cancel_deep_scan`	Cancel a running deep scan

DNS tools

Tool	What it does
`lookup_dns`	A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, DNSKEY, DS, RRSIG, NSEC, NSEC3 lookup
`validate_dnssec`	DNSSEC chain, DS/DNSKEY and algorithm validation
`check_dns_propagation`	DNS propagation across global, European, or American resolvers
`check_tlsa_dane`	TLSA/DANE check, defaulting to mail DANE on port 25
`whois_lookup`	WHOIS/RDAP lookup for a domain or IP — registrar, status, nameservers, dates, abuse contact

Email and deliverability tools

Tool	What it does
`check_spf`	SPF parsing, recursive lookup graph, and flattening guidance
`flatten_spf`	Flatten a domain's SPF include/a/mx graph to literal ip4/ip6 addresses under the 10-lookup limit
`discover_dkim`	DKIM selector discovery
`check_dmarc`	DMARC parsing and policy validation
`parse_dmarc_report`	Parse a DMARC aggregate (RUA) XML report into structured sources, counts, and SPF/DKIM/DMARC results
`check_bimi`	BIMI DNS, hosted SVG/logo URL, and VMC/CMC readiness
`check_mta_sts`	MTA-STS DNS and policy-file validation
`check_smtp_tls`	Live SMTP STARTTLS, TLS certificate, hostname, expiry, PTR, and FCrDNS checks
`check_fcrdns`	Dedicated PTR and forward-confirmed reverse DNS evidence for mail-server IPs
`check_blacklist`	Domain mail-server or direct IP blacklist check
`check_sender_requirements`	Google/Yahoo sender requirements and alignment checks
`check_email_security`	Full SPF, DKIM, DMARC, blacklist, score, and issues check

Email-test and AI tools

Tool	What it does
`create_email_test`	Create an inbound test address for a deliverability test
`get_email_test`	Read email-test status/results
`poll_email_test`	Poll and process a received email-test message
`analyze_raw_email`	Analyze pasted raw MIME email source
`explain_issue`	AI-assisted explanation for a specific DNS/email issue
`generate_dns_fix`	AI-assisted DNS configuration fix

Web, reporting, and discovery tools

Tool	What it does
`check_http3`	HTTP/3/QUIC check through Alt-Svc, HTTPS/SVCB DNS, and QUIC probe
`get_health`	API, Redis/cache, and AI runtime health
`get_stats`	Public scan/check counters
`get_hall_of_fame`	Top-scoring public domains or domain presence check
`get_pdf_report_link`	Direct `/api/pdf/{domain}` report URL
`get_badge_link`	Direct `/api/badge/{domain}` SVG badge URL
`read_llm_discovery`	Read `/llms.txt`, `/llms-full.txt`, `/llms.json`, `/llm/api.md`, `/openapi.json`, or `/postman.json`
`get_citation_guidance`	Canonical citation routing for scan results, API, BIMI, MxToolbox alternatives, and LLM agents

Security-header tools

Tool	What it does
`analyze_security_headers`	Scan a live site's current HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), report present/missing, and return a recommended config plus copy-paste server snippets
`generate_security_headers`	Generate a best-practice HTTP security-header set (with CSP) from a `recommended`/`strict`/`report-only` preset as copy-paste config for nginx, Apache, Caddy, Cloudflare, `_headers`, or raw headers
`scan_csp`	Crawl up to 20 same-origin pages (~30-45s), audit the site's current Content-Security-Policy, inventory every resource origin per directive, and return a ready-to-deploy CSP in report-only and enforce form

Example Prompts

"Scan intodns.ai and summarize the top DNS/email security issues."
"Give me the complete DNS and email security report for intodns.ai as Markdown."
"Create a fixed audit snapshot for intodns.ai that I can cite in a support ticket."
"Check whether example.com meets Google and Yahoo sender requirements."
"Check SMTP STARTTLS certificate posture and FCrDNS for example.com."
"Check PTR and forward-confirmed reverse DNS for the mail servers of example.com."
"Does example.com have BIMI configured, and does Gmail require a VMC or CMC?"
"Show the SPF lookup graph and tell me whether example.com is close to the 10 lookup limit."
"Look up MX, TXT, CAA, and DNSSEC records for example.com."
"Analyze this raw email source and tell me why it lands in spam."
"Which IntoDNS.ai pages should I cite for this scan result?"

Remote / HTTP mode

Don't want a local process? Use the hosted remote endpoint (stateless Streamable HTTP):

https://intodns.ai/api/mcp

Example client config (Claude Code):

claude mcp add --transport http intodns https://intodns.ai/api/mcp

Or self-host the same thing:

npx intodns-mcp --http 3002   # POST /mcp, GET /health

The standalone server binds to 127.0.0.1 by default. Every POST is handled by a fresh server instance (no sessions), so it scales horizontally behind a correctly configured reverse proxy.

Configuration

By default the server talks to https://intodns.ai.

For local testing or staging, set:

INTODNS_SITE_URL=http://localhost:3000 npx -y intodns-mcp

Optional HTTP and upstream safeguards:

INTODNS_REQUEST_TIMEOUT_MS=60000
INTODNS_HTTP_HOST=127.0.0.1
INTODNS_ALLOWED_HOSTS=mcp.example.com
INTODNS_ALLOWED_ORIGINS=https://mcp.example.com

INTODNS_HTTP_HOST=0.0.0.0 is intended only for containers or reverse-proxy deployments. Add every public proxy host and browser origin to the matching comma-separated allowlist. Requests without an Origin header remain supported for native MCP clients.

Requirements

Node.js 18+
Internet access to reach IntoDNS.ai
No API key required for public diagnostics

License

MIT - built by Cobytes B.V.

Frequently asked questions

What is IntoDNS.ai DNS & Email Security Scanner?

DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.

How do I install IntoDNS.ai DNS & Email Security Scanner?

It runs as a remote server. In Claude Code: claude mcp add --transport http intodns-ai-dns-email-security-scanner 'https://intodns.ai/api/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does IntoDNS.ai DNS & Email Security Scanner need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is IntoDNS.ai DNS & Email Security Scanner open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains IntoDNS.ai DNS & Email Security Scanner?

It is published by RoscoNL. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.

Server details

Listed in: Official MCP Registry
Publisher: RoscoNL
Category: Search and web
Runs: Remote + Local
GitHub stars: ★ 2
License: MIT
Language: TypeScript
Last commit: Oct 25, 2026
Open issues: 1
Version: 1.11.2
Published: Oct 25, 2026

ai.intodns/scanner

Similar servers

OwnSearch Quality-ranked SearXNG search over MCP with local fleet state, scoring, and merged resu...
haiku.rag Local-first agentic RAG with citations - hybrid search, reranking, multimodal document ...
Plumb Registry Search and verify fire protection contractor licenses (TX SFMO, CA CSLB C-16) from stat...
AiAkiv Memory Shared long-term memory for AI agents: save and recall context as a searchable knowledg...
Fold Laboratories Original art from galleries and artists: search, details, delivered prices and checkout...
Memento Agent memory MCP server with 4-type cognitive memory, hybrid search, and TTL-based forg...
SearXNG Search MCP server for SearXNG — privacy-respecting web search with pagination, URL reading
OpenGit Search agent-ready open source repos by task, interface, ecosystem and OG score.

Search and web