{"name":"io.github.OrtaMarco/domain-security-mcp-server","slug":"ortamarco-domain-security-mcp-server","title":"Domain Security","description":"Audit a domain's email and web security: SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS, WHOIS. No API keys.","url":"https://mcp.market/server/ortamarco-domain-security-mcp-server","rating":null,"grade":"A","score":92,"certified":false,"status":"active","category":"email","tags":["email","security"],"presence":{"score":15,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-09-14T03:40:40.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/OrtaMarco/domain-security-mcp-server","website":null,"version":"1.2.1","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"domain-security-mcp-server","version":"1.2.1","transport":{"type":"stdio"}}],"tools":[{"name":"analyze_email_headers","description":"Parse raw email headers and report the SPF/DKIM/DMARC verdicts (from Authentication-Results), key fields (From, Subject, Date, Message-ID, Return-Path) and the Received hop chain with per-hop delays and total transit time. Args: - headers (string): the raw email headers. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { auth{spf,dkim,dmarc}, fields{}, hops[{in","write_action":true,"price_micros":0,"input_schema":null},{"name":"bimi_check","description":"Check a domain's BIMI record (default._bimi.<domain> TXT), which points to the brand logo (and optional VMC) displayed next to authenticated mail. BIMI requires an enforced DMARC policy to take effect. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, findings[] }. Example: \"Does cnn.com have BIMI se","write_action":false,"price_micros":0,"input_schema":null},{"name":"blacklist_check","description":"Check whether an IPv4 address (or a domain's A records) appears on email DNS blocklists (DNSBLs). Only open-access lists are queried (SpamCop, UCEPROTECT-1, DroneBL, s5h); Spamhaus and Barracuda refuse public-resolver queries and are excluded. Args: - query (string): an IPv4 address or a domain. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ips[], listedCo","write_action":false,"price_micros":0,"input_schema":null},{"name":"caa_check","description":"Check a domain's CAA (Certification Authority Authorization) records — which CAs are allowed to issue TLS certificates for it. Absence means any CA may issue. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, issue[], issuewild[], iodef[] }. Example: \"Which CAs can issue certs for google.com?\" -> caa_check(d","write_action":false,"price_micros":0,"input_schema":null},{"name":"dkim_check","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"dmarc_check","description":"Fetch and parse a domain's DMARC record (_dmarc.<domain>). Reports the policy (p=), subdomain policy (sp=), reporting addresses (rua/ruf), pct and alignment (aspf/adkim), and warns on monitor-only or partial deployments. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, policy, tags{}, findings[] }. ","write_action":false,"price_micros":0,"input_schema":null},{"name":"dns_lookup","description":"Resolve all common DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA) for a domain in one call, using public resolvers (Cloudflare/Google/Quad9). Args: - domain (string): the domain to query, e.g. \"example.com\". - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: a map of record type -> list of records. Each record has { type, host, value, priority? }. Examples: ","write_action":false,"price_micros":0,"input_schema":null},{"name":"dns_propagation","description":"Compare a domain's DNS records across multiple public resolvers worldwide (Cloudflare, Google, Quad9, OpenDNS, AdGuard) to see whether a change has propagated. Args: - domain (string): the domain to check. - type ('A'|'AAAA'|'CNAME'|'MX'|'NS'|'TXT'): record type (default 'A'). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { type, consistent, resolvers[{name,","write_action":false,"price_micros":0,"input_schema":null},{"name":"dnssec_check","description":"Check whether a domain is protected by DNSSEC. Queries DS and DNSKEY records over DNS-over-HTTPS and reads the resolver's Authenticated Data (AD) flag to confirm the chain of trust validates. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { enabled, validated, ds_records, dnskey_records, findings[] }. Example: \"Is","write_action":false,"price_micros":0,"input_schema":null},{"name":"email_auth_audit","description":"","write_action":true,"price_micros":0,"input_schema":null},{"name":"http_security_headers","description":"Fetch a URL and grade its HTTP security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP). Returns a 0–100 score, an A–F grade, and per-header notes. Args: - url (string): URL or host to check (scheme defaults to https://). - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { url, final_url","write_action":false,"price_micros":0,"input_schema":null},{"name":"ip_geolocation","description":"Geolocate an IP address (country, region, city, coordinates, time zone) using the offline DB-IP Lite database, plus its reverse-DNS hostname. No external API. Args: - ip (string): IPv4 or IPv6 address. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ip, country_iso, country_name, region, city, latitude, longitude, time_zone, hostname }. Example: \"Where is 15","write_action":false,"price_micros":0,"input_schema":null},{"name":"mta_sts_check","description":"Check a domain's MTA-STS deployment: the _mta-sts TXT record AND the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. Reports the enforcement mode (enforce/testing/none) and the listed MX hosts. MTA-STS forces TLS for inbound SMTP and blocks downgrade attacks. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). ","write_action":false,"price_micros":0,"input_schema":null},{"name":"mx_lookup","description":"Look up a domain's mail servers (MX records) with priority and the IPs they resolve to. Args: - domain (string): the domain to query. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: array of { exchange, priority, ips[] }. Example: \"What are the mail servers for github.com?\" -> mx_lookup(domain=\"github.com\").","write_action":false,"price_micros":0,"input_schema":null},{"name":"reverse_dns","description":"Resolve the PTR (reverse DNS) records for an IP address — the hostname(s) the IP maps back to. Args: - ip (string): IPv4 or IPv6 address. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { ip, hostnames: string[] }. Example: \"What hostname does 8.8.8.8 reverse to?\" -> reverse_dns(ip=\"8.8.8.8\"). Errors: returns an error if the IP is invalid or has no PTR record.","write_action":false,"price_micros":0,"input_schema":null},{"name":"spf_check","description":"Fetch and analyse a domain's SPF record. Detects: missing/multiple records, the trailing 'all' qualifier (+all/?all/~all/-all), and counts DNS-querying terms recursively against the RFC 7208 limit of 10. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, multiple_records, all_qualifier, lookup_count, ","write_action":false,"price_micros":0,"input_schema":null},{"name":"ssl_certificate","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"tls_rpt_check","description":"Check a domain's TLS-RPT record (_smtp._tls.<domain> TXT). TLS-RPT lets you receive reports about TLS delivery failures to your domain. Args: - domain (string): the domain to check. - response_format ('markdown' | 'json'): output format (default 'markdown'). Returns: { found, record, findings[] }. Example: \"Does microsoft.com publish TLS-RPT?\" -> tls_rpt_check(domain=\"microsoft.com\").","write_action":false,"price_micros":0,"input_schema":null},{"name":"whois_lookup","description":"Look up domain registration data over the raw WHOIS protocol (port 43): registrar, creation/update/expiry dates, name servers and domain status. Resolves the correct WHOIS server via IANA and follows registrar referrals. No API key. Args: - domain (string): the domain to look up. - response_format ('markdown' | 'json'): output format (default 'markdown'). JSON includes the raw WHOIS text. Returns:","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":92,"grade":"A","scanned_at":"2026-09-19T20:03:58.122Z","report":{"scannerVersion":"0.1.5","scannedAt":"2026-09-19T20:03:58.128Z","components":{"code":{"score":25,"max":25,"notes":["20 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 6 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"domain-security-mcp-server","version":"1.2.1","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":8,"publishedAt":"2026-09-14T02:47:53.748Z","repositoryUrl":"git+https://github.com/OrtaMarco/domain-security-mcp-server.git"}],"repo":{"found":true,"owner":"OrtaMarco","repo":"domain-security-mcp-server","archived":false,"pushedAt":"2026-09-14T03:40:40Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/11250913?v=4","ownerCreatedAt":"2015-03-01T00:09:23Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/11250913?v=4&s=128","source":"registry","width":128,"height":128},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-09-14T03:40:40.000Z","score":15}}}},"grade_history":[],"reviews":[]}