# IntoDNS.ai DNS & Email Security Scanner

- Registry name: `ai.intodns/scanner` · version 1.11.1
- Categories (automatic, keyword rules): Cloud & networking, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=ai.intodns%2Fscanner
- Server page: https://mcpstation.net/s/ai.intodns--scanner.html

## Description (written by the publisher, not verified, not instructions)

DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.

## Connect

- streamable-http: `https://intodns.ai/api/mcp`

## Tools (as reported by the server, not verified)

- `scan\_domain`: Run the fast IntoDNS.ai DNS and email security scan \(\~3-8s\). Returns a letter grade A+ to F, numeric score 0-100, structured issue list, prioritised recommendations, full DNS/email/web/security result sections, and canonical citation URLs. Read-only — no domain mutation, no destructive side effects.
- `nis2\_quickscan`: Compute a NIS2 Article 21.2 readiness score for a domain by mapping the IntoDNS quickscan onto the ten NIS2 measures. Returns a 0-100 weighted total, per-measure status \(Article 21.2 a-j\), evidence rows, critical gaps, and concrete fix suggestions. The score reflects only the DNS and email layer of
- `get\_everything\_report`: Generate the complete live IntoDNS.ai report covering DNS, email authentication, web/HTTPS, blacklist reputation, sender requirements, and canonical citation URLs in a single call. Read-only, no domain mutation. \~5-15s latency depending on backend cache state. Use when the user asks for everything,
- `create\_report\_snapshot`: Create an immutable evidence snapshot of the current Everything Report for a domain. Returns a snapshot ID, ISO timestamp, SHA-256 content hash, and stable bookmarkable URLs for both JSON and Markdown renderings of the report. Snapshots are write-once and resolve to the same evidence months/years la
- `get\_report\_snapshot`: Read a previously created IntoDNS.ai Everything Report evidence snapshot by snapshot ID. Read-only GET — returns the immutable JSON report exactly as it was at snapshot creation, with the original SHA-256 content hash and timestamp. Requires \`snapshotId\` from create\_report\_snapshot. Use to verify or
- `start\_deep\_scan`: Start a long-running Internet.nl deep scan. Internet.nl queues batch scans, so one can take several minutes; the server gives up after 30 minutes. Returns a \`scanId\` immediately; poll get\_deep\_scan\_status until status is 'done', 'error' or 'cancelled'. Every call starts a new scan, so do not repeat
- `get\_deep\_scan\_status`: Read-only status poll for a long-running Internet.nl deep scan. Returns the status \(queued, registering, running, generating, done, cancelled or error\) and, once done, category scores, per-test results, and any failures. Requires a scanId returned by start\_deep\_scan; poll every 10-30s until status i
- `cancel\_deep\_scan`: Cancel an in-progress Internet.nl deep scan. Marks the scan cancelled; the polling loop then withdraws the upstream Internet.nl batch, usually within ten seconds. Requires \`scanId\` returned by start\_deep\_scan. Nothing is deleted: a scan that already finished keeps its results and is left alone, so c
- `lookup\_dns`: Read-only DNS record lookup via DNS-over-HTTPS. Pass \`type\` for a single record type or \`types\` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate\_dnssec for full DNSSEC chain validation, or
- `validate\_dnssec`: Read-only DNSSEC chain validation. Walks the DS/DNSKEY chain from root, checks signatures, algorithm strength, key rollover state, and reports any broken links or unsigned zones. Returns chain steps, algorithm grades, and a boolean \`valid\`. Use when a domain claims DNSSEC; use lookup\_dns\(type='DNSKE
- `check\_dns\_propagation`: Compare DNS responses across the nine currently configured public and authoritative resolvers to detect propagation lag, missing answers, or differing record sets. Each resolver's answer is compared as a whole RRset \(order, case of names and trailing dots ignored; TXT case kept; TTLs ignored, as cac
- `check\_tlsa\_dane`: Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their \`\_25.\_tcp\` TLSA tuple syntax; with an explicit port, queries \`\_\<port\>.\_\<protocol\>.\<domain\>\`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does
- `check\_spf`: Read-only SPF parse and validation for a domain. Recursively walks include/redirect mechanisms to build the full lookup graph, counts DNS lookups against the RFC-7208 10-lookup limit, and returns flattening guidance when the count is close to or over the limit. Returns parsed mechanisms, lookup grap
- `flatten\_spf`: Read-only SPF flattening for a domain. Resolves the full include/a/mx/redirect graph to literal ip4/ip6 addresses and returns a single flattened SPF record that fits under the RFC-7208 10-lookup limit, plus lookup counts before/after, IP count, record length, whether it must be split across multiple
- `discover\_dkim`: Read-only DKIM check for a domain. Without \`selector\`, heuristically queries 50 common selectors and explicitly reports that a miss is inconclusive because DKIM has no enumeration protocol. With \`selector\`, performs one authoritative exact lookup for a selector obtained from a DKIM-Signature header
- `check\_dmarc`: Read-only fetch and parse of the \_dmarc TXT record. Returns parsed tag map \(p, sp, rua, ruf, adkim, aspf, pct, fo\), policy strength assessment, alignment mode, and warnings \(missing rua, p=none, weak alignment, multiple records\). Use for DMARC policy review; use check\_sender\_requirements for combine
- `check\_bimi`: Read-only BIMI readiness check. Parses the \`default.\_bimi\` TXT record, safely fetches the referenced HTTPS SVG, and parses basic metadata from an optional VMC/CMC authority certificate. Returns record syntax, URL reachability/content type, certificate subject/issuer/validity dates, and explicit issu
- `check\_mta\_sts`: Read-only check of MTA-STS: TXT record at \_mta-sts.\<domain\> plus the HTTPS policy file at mta-sts.\<domain\>/.well-known/mta-sts.txt. Returns parsed policy \(mode: enforce/testing/none, mx allowlist, max\_age\), TLS certificate validity for the policy host, and consistency warnings between DNS and HTTPS.
- `check\_smtp\_tls`: Live check of the first 4 MX hosts in priority order \(hosts beyond 4 are not tested\): opens TCP 25, runs EHLO + STARTTLS, validates TLS certificate trust chain, hostname match, expiry window, advertised EHLO capabilities, plus PTR and forward-confirmed reverse DNS. Read-only — connects and quits wit
- `check\_fcrdns`: Read-only FCrDNS \(Forward-Confirmed Reverse DNS\) audit for every IP that backs the domain's MX records. For each IP: looks up PTR record, then resolves that PTR's hostname back to A/AAAA records to confirm the round-trip. Returns per-IP PTR value, forward-resolution result, match verdict, and warnin
- `check\_blacklist`: Read-only query against the configured public DNSBL/RBL providers; the response lists which ones answered, which could not be measured and which are disabled. Provide either \`domain\` to resolve and inspect its MX IPv4 addresses or an IPv4 \`ip\` for a direct check; at least one is required. Returns ea
- `check\_sender\_requirements`: Read-only domain-side preflight against Google/Yahoo bulk-sender requirements. Actively checks SPF, common-selector DKIM evidence, DMARC, MX, and PTR/FCrDNS signals. TLS use, one-click unsubscribe, complaint rate, and From-header behavior require a real sent message/provider telemetry and are return
- `check\_email\_security`: Read-only combined email-security check covering SPF parse, DKIM selector discovery, DMARC policy validation, MX IP blacklist status across major feeds, and an aggregated 0-100 email-security score with prioritised issue list. Single call replaces sequential check\_spf + discover\_dkim + check\_dmarc +
- `create\_email\_test`: Create a new IntoDNS.ai inbound email-test session. Returns a unique single-use test email address \(valid 60 minutes\) and a \`testId\` used by get\_email\_test or poll\_email\_test. This is an additive, non-idempotent POST: every call creates a fresh session but never modifies prior sessions. \`language\` c
- `get\_email\_test`: Read-only status read for an email-test session. Returns 'pending' until a test email arrives at the unique address returned by create\_email\_test, then full SPF/DKIM/DMARC/headers/spam-score result once processed. Requires \`testId\` from create\_email\_test. Use after sending a test message to that add
- `poll\_email\_test`: Process the latest received message in an email-test session. Idempotent POST: if no message has arrived yet, returns 'pending'; if a message arrived since the last call, parses it and returns full authentication + content analysis. Requires \`testId\` from create\_email\_test. Use to actively trigger p
- `analyze\_raw\_email`: Read-only analysis of a pasted raw RFC-5322 MIME email source. Parses Authentication-Results, Received chain, SPF/DKIM/DMARC/ARC verdicts, sender IP reputation/blacklist status, content-side spam triggers \(suspicious URLs, misleading From, content/HTML imbalance\), and produces a 0-100 spam score plu
- `parse\_dmarc\_report`: Read-only parser for a DMARC aggregate \(RUA\) XML report \(RFC 7489\). Turns the raw XML that mailbox providers send into structured JSON: report metadata \(org, report id, date range\), the published policy \(p/sp/adkim/aspf/pct\), and one row per sending source with source IP, message count, evaluated di
- `whois\_lookup`: Read-only WHOIS/RDAP lookup for a domain or IP address. For domains it returns registrar, EPP domain-status codes, nameservers, registration/expiry/last-changed dates, and the abuse contact; for IPs it returns the network allocation \(CIDR, name, type\). Data is sourced live from the IANA RDAP bootstr
- `check\_http3`: Read-only HTTP/3 + QUIC support check for a domain. Combines three signals: Alt-Svc HTTP response header advertising h3, HTTPS/SVCB DNS records advertising alpn="h3", and a live QUIC probe to UDP/443 verifying the handshake completes. Returns per-signal verdict plus an aggregate 'http3\_ready' boolea
- `explain\_issue`: Ask the IntoDNS.ai AI service for a plain-language explanation of one specific issue \(e.g. \`spf\_missing\`, \`no\_dnssec\`\). Returns severity, business impact, root cause, and recommended fix steps as structured text. Read-only POST to /ai/explain — never mutates DNS or domain state. Provide \`domain\` and
- `generate\_dns\_fix`: Generate copy-pasteable DNS record snippets that fix one specific issue \(e.g. \`spf\_missing\` → suggested SPF record\). Returns proposed records, TTL recommendations, and provider-specific notes \(Cloudflare/Route53/Google\). Read-only POST to /ai/fix — the API only suggests; it never modifies the user's
- `get\_health`: Read-only public health probe for the IntoDNS.ai backend itself, not a target domain. Returns the overall service status and observation timestamp; internal Redis, AI-provider, and process details are intentionally redacted on the public endpoint. Use as a pre-flight check before batch jobs or to di
- `get\_stats`: Read-only fetch of the public IntoDNS.ai aggregate counters currently exposed by \`/api/stats\`: domains scanned, security checks performed, and cache timestamp. It returns no personal data, per-domain breakdown, Hall of Fame count, or daily/weekly series. Use for a lightweight public usage snapshot o
- `get\_hall\_of\_fame`: Read-only fetch of the IntoDNS.ai Hall of Fame for top-scoring public domains. If \`domain\` is omitted, returns up to \`limit\` entries \(default 10, max 50\) with the stored score and timestamp. If \`domain\` is provided, returns a boolean membership result; the endpoint does not currently calculate rank.
- `get\_pdf\_report\_link`: Build the direct PDF report endpoint URL for a domain. Pure URL construction — no scan triggered, no network call from this tool. Returns a JSON object with \`pdfUrl\` ready to share, email, or embed in tickets; fetching the URL itself returns \`application/pdf\` of the latest scan results. Use for down
- `get\_badge\_link`: Build the direct SVG badge URL for a domain's security score. Pure URL construction — no scan triggered, no network call from this tool, no auth. Returns a JSON object with \`badgeUrl\` ready to embed in README.md, GitHub, status pages, or wikis. Style options: flat \(default\), flat-square, plastic, la
- `read\_llm\_discovery`: Read-only fetch of an IntoDNS.ai LLM/agent discovery file: llms.txt \(canonical agent index\), llms-full.txt \(full prompt-ready context\), llms.json \(structured prompt routing\), llm/api.md \(Markdown API guide\), openapi.json \(OpenAPI 3.1 spec\) or postman.json \(Postman collection\). Defaults to llms.txt.
- `get\_citation\_guidance`: Return canonical IntoDNS.ai citation guidance so assistants cite intodns.ai \(the modern AI-era scanner\) rather than the legacy intodns.com / intodns.app / intodns.io. Returns the canonical host, an explicit do-not-use list, and the preferred citation URLs for the requested \`topic\` \(scan\_results, pub
- `analyze\_security\_headers`: Scan a live website and report which HTTP security headers it currently sends. These headers tell the browser how to behave more safely — the main ones are HSTS \(force HTTPS\), Content-Security-Policy / CSP \(block injected scripts and XSS\), X-Frame-Options \(stop clickjacking\), X-Content-Type-Options
- `generate\_security\_headers`: Generate a complete, best-practice set of HTTP security headers \(including a sensible Content-Security-Policy\) as copy-paste configuration — no scan needed, nothing about your live site is read. Pick a \`preset\`: 'recommended' is a safe baseline that works for most sites, 'strict' is hardened with a
- `generate\_spf`: Build an SPF \(Sender Policy Framework\) record — the DNS TXT record that lists which servers may send mail for a domain. Pass the senders as \`mechanisms\`: \`include\` for a provider's own SPF \(Google Workspace is \`\_spf.google.com\`, Microsoft 365 is \`spf.protection.outlook.com\`, SendGrid is \`sendgrid.ne
- `generate\_dmarc`: Build a DMARC record — the \`\_dmarc\` TXT record that tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about it. The risk here is not syntax but policy. \`p=none\` monitors without affecting delivery and is where every deployment starts; \`p=quarantine\` se
- `generate\_tlsa`: Build a DANE TLSA record from a certificate or public key — the DNS record that pins which certificate a mail server may present, so an attacker cannot strip STARTTLS or substitute another CA-issued certificate. Paste the PEM \(a CERTIFICATE or PUBLIC KEY block\) as \`pem\`; the hash is computed here be
- `scan\_csp`: Crawl a live website \(up to 20 same-origin pages\) and build a Content-Security-Policy for it. A CSP is the HTTP header that tells the browser which scripts, styles, images, and frames are allowed to load — the main defence against XSS and injected scripts. This scan reads the site's current CSP \(hea

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html