{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_mhhxz7pkfa6f","handle":"dns-doctor","url":"https://wellknown.network/agents/dns-doctor","links":{"self":"https://wellknown.network/agents/dns-doctor/record.json","html":"https://wellknown.network/agents/dns-doctor","markdown":"https://wellknown.network/agents/dns-doctor/record.md","api":"https://wellknown.network/api/v1/agents/dns-doctor","status":"https://wellknown.network/api/v1/agents/dns-doctor/status","claim":"https://wellknown.network/agents/dns-doctor/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/dns-doctor/claim.json","badge":"https://wellknown.network/agents/dns-doctor/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air:dnsdoctor.dev:server:dns-doctor","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"dns-doctor","summary":"Scan, fix and verify DNS: SPF, DMARC, DKIM, propagation, DNS health, expiry. Validated fixes.","description":"Scan, fix and verify DNS: SPF, DMARC, DKIM, propagation, DNS health, expiry. Validated fixes.","publisher":{"name":"dev.dnsdoctor","url":null},"homepage":"https://dnsdoctor.dev/methodology","repository":"https://github.com/dnsdoctor/claude-plugin","version":"1.7.3","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://dnsdoctor.dev/mcp","type":"mcp_streamable_http","auth":null,"probeable":true},{"url":"npm:@dnsdoctor/mcp","type":"package_npm","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-09-05T21:35:31.056978Z","publishedAt":"2026-09-05T21:35:31.056978Z","registryName":"dev.dnsdoctor/dns-doctor"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"documents.ocr","name":"OCR","confidence":0.833,"provenance":"derived"},{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":0.554,"provenance":"derived"}],"categories":["dev","documents"]},"observed":{"status":"live","statusReason":"Responded 13h ago.","lastOkAt":"2026-09-06T01:23:11.328Z","lastProbedAt":"2026-09-06T01:23:11.328Z","statusComputedAt":"2026-09-06T01:24:37.272Z","reliability30d":{"probes":1,"successRate":1,"p50Ms":84},"latestObservations":[{"at":"2026-09-06T10:25:35.157Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":98,"error":null,"detail":{"tools":[{"name":"scan_domain","description":"Force a fresh scan of a domain and return its full report: seven deterministic checks — SPF, DKIM, DMARC, MX, DNS hardening, domain/TLS expiry and blacklist lis"},{"name":"get_report","description":"Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns the same seven-ch"},{"name":"build_dmarc_upgrade","description":"Return a validated DMARC enforcement-upgrade record for a domain. A scan can justify p=quarantine at MOST: the alignment signal (valid aligned SPF and a DKIM se"},{"name":"start_monitoring_signup","description":"Return a sign-up link to give to the HUMAN who owns a domain, so they can start monitoring it themselves. Nothing is created and no email is sent by this call: "},{"name":"count_spf_lookups","description":"Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a"},{"name":"validate_dmarc_record","description":"Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews"},{"name":"generate_dmarc_record","description":"Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; option"},{"name":"check_dkim_selector","description":"Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may"},{"name":"parse_dmarc_report","description":"Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the"},{"name":"check_record","description":"Check whether a DNS change has landed: reads the record from the domain's OWN nameservers (cache-free) and from two public caching resolvers, and reports whethe"},{"name":"check_reverse_dns","description":"Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the"},{"name":"audit_spf_includes","description":"Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved tree, per"},{"name":"build_parked_domain_records","description":"Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC "},{"name":"check_propagation","description":"Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each read "},{"name":"get_alerts","description":"Read the monitoring alert log for the domains the caller's account monitors, newest first. Requires an API token. Each row carries id, domain, type, check, summ"},{"name":"get_readiness","description":"Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API toke"}],"toolCount":16,"serverName":"dns-doctor","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.7.3","protocolVersion":"2025-06-18"}},{"at":"2026-09-06T01:23:11.328Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":84,"error":null,"detail":{"tools":[{"name":"scan_domain","description":"Force a fresh scan of a domain and return its full report: seven deterministic checks — SPF, DKIM, DMARC, MX, DNS hardening, domain/TLS expiry and blacklist lis"},{"name":"get_report","description":"Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns the same seven-ch"},{"name":"build_dmarc_upgrade","description":"Return a validated DMARC enforcement-upgrade record for a domain. A scan can justify p=quarantine at MOST: the alignment signal (valid aligned SPF and a DKIM se"},{"name":"start_monitoring_signup","description":"Return a sign-up link to give to the HUMAN who owns a domain, so they can start monitoring it themselves. Nothing is created and no email is sent by this call: "},{"name":"count_spf_lookups","description":"Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a"},{"name":"validate_dmarc_record","description":"Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews"},{"name":"generate_dmarc_record","description":"Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; option"},{"name":"check_dkim_selector","description":"Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may"},{"name":"parse_dmarc_report","description":"Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the"},{"name":"check_record","description":"Check whether a DNS change has landed: reads the record from the domain's OWN nameservers (cache-free) and from two public caching resolvers, and reports whethe"},{"name":"check_reverse_dns","description":"Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the"},{"name":"audit_spf_includes","description":"Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved tree, per"},{"name":"build_parked_domain_records","description":"Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC "},{"name":"check_propagation","description":"Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each read "},{"name":"get_alerts","description":"Read the monitoring alert log for the domains the caller's account monitors, newest first. Requires an API token. Each row carries id, domain, type, check, summ"},{"name":"get_readiness","description":"Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API toke"}],"toolCount":16,"serverName":"dns-doctor","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.7.3","protocolVersion":"2025-06-18"}}],"tools":[{"name":"scan_domain","description":"Force a fresh scan of a domain and return its full report: seven deterministic checks — SPF, DKIM, DMARC, MX, DNS hardening, domain/TLS expiry and blacklist lis"},{"name":"get_report","description":"Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a first look. Returns the same seven-ch"},{"name":"build_dmarc_upgrade","description":"Return a validated DMARC enforcement-upgrade record for a domain. A scan can justify p=quarantine at MOST: the alignment signal (valid aligned SPF and a DKIM se"},{"name":"start_monitoring_signup","description":"Return a sign-up link to give to the HUMAN who owns a domain, so they can start monitoring it themselves. Nothing is created and no email is sent by this call: "},{"name":"count_spf_lookups","description":"Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_pass_all` (a"},{"name":"validate_dmarc_record","description":"Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews"},{"name":"generate_dmarc_record","description":"Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; option"},{"name":"check_dkim_selector","description":"Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector sweep may"},{"name":"parse_dmarc_report","description":"Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the"},{"name":"check_record","description":"Check whether a DNS change has landed: reads the record from the domain's OWN nameservers (cache-free) and from two public caching resolvers, and reports whethe"},{"name":"check_reverse_dns","description":"Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the"},{"name":"audit_spf_includes","description":"Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns the resolved tree, per"},{"name":"build_parked_domain_records","description":"Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC "},{"name":"check_propagation","description":"Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each read "},{"name":"get_alerts","description":"Read the monitoring alert log for the domains the caller's account monitors, newest first. Requires an API token. Each row carries id, domain, type, check, summ"},{"name":"get_readiness","description":"Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API toke"}],"package":null},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"dev.dnsdoctor/dns-doctor","url":"https://registry.modelcontextprotocol.io/v0/servers/dev.dnsdoctor%2Fdns-doctor","firstSeenAt":"2026-09-05T22:18:29.855Z","fetchedAt":"2026-09-05T22:18:29.855Z","normalizedAt":"2026-09-05T22:18:29.855Z"}]},"firstSeenAt":"2026-09-05T22:18:29.855Z","updatedAt":"2026-09-06T01:24:43.831Z"}