# com.domainposture/mcp

- Registry name: `com.domainposture/mcp` · version 1.0.0
- Categories (automatic, keyword rules): Cloud & networking, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.domainposture%2Fmcp
- Server page: https://mcpstation.net/s/com.domainposture--mcp.html

## Description (written by the publisher, not verified, not instructions)

Remote MCP server: 19 domain-hygiene and email-auth tools \(DNS, SPF, DMARC, DKIM, TLS\).

## Connect

- streamable-http: `https://www.domainposture.com/mcp/mcp`

## Tools (as reported by the server, not verified)

- `ip\_lookup`: Context lookup: Resolve an IPv4 or IPv6 address to its geolocation, ASN, org name, and city/country. Use when you need network or location context for a raw IP address; prefer dns\_lookup or dossier\_dns for hostname resolution. Queries ipinfo.io with a server-side token — the token is never exposed t
- `dns\_lookup`: Context lookup: Resolve a single DNS record type \(A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, or SRV\) and return the raw answers. Use for quick, targeted lookups of one record type; prefer dossier\_dns for a full multi-type DNS audit in parallel, or dossier\_full for a complete domain health check. Queries
- `dossier\_dns`: Core dossier check: Fetch a domain's full DNS profile — A, AAAA, NS, SOA, CAA, and TXT records — all in parallel. Use as the first step of a domain audit or when you need a comprehensive DNS snapshot in one call; prefer dns\_lookup for a single record type, or dossier\_full for all 10 dossier checks a
- `dossier\_mx`: Core dossier check: Look up a domain's MX \(mail exchanger\) records and return them sorted ascending by priority. Use when verifying inbound-mail routing or as a precursor to SPF or DMARC checks; prefer dns\_lookup with type=MX if you only need the raw DNS answer without the ranked view. Queries Cloud
- `dossier\_spf`: Core dossier check: Retrieve and parse a domain's SPF record, decomposing it into mechanisms and qualifiers. Use to verify email sender policy, debug delivery failures, or check the 10-lookup limit; pair with dossier\_dmarc for full email-auth coverage, or use dns\_lookup with type=TXT for the raw rec
- `dossier\_dmarc`: Core dossier check: Retrieve and parse a domain's DMARC policy from its \_dmarc.\<domain\> TXT record, returning all tags. Use to audit email authentication policy, verify the p \(policy\) and rua \(reporting\) settings, or confirm alignment mode; pair with dossier\_spf and dossier\_dkim for complete email-a
- `dossier\_dkim`: Core dossier check: Probe a domain's DKIM public keys by querying \<selector\>.\_domainkey.\<domain\> for each selector. Use to verify signing configuration or discover active selectors; supply selectors when you know the ESP's selector, or omit to probe six common selectors \(default, google, k1, selecto
- `dossier\_tls`: Core dossier check: Fetch and inspect the TLS certificate presented by a domain on port 443, returning chain details and validity period. Use to verify certificate expiry, issuer, Subject Alternative Names, or detect mismatched or self-signed certs; not a full cipher-suite scanner. Performs a TLS ha
- `dossier\_redirects`: Core dossier check: Trace the full HTTP redirect chain starting from https://\<domain\>/, recording each hop's status code and destination URL. Use to debug redirect loops, verify HTTP→HTTPS upgrades, or audit link shorteners; stops at 10 hops to prevent infinite loops. Follows Location headers with f
- `dossier\_headers`: Core dossier check: Fetch https://\<domain\>/ and return all HTTP response headers, with an audit highlighting missing or misconfigured security headers. Use to review CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy; for redirect tracing use dossier\_redirect
- `dossier\_cors`: Core dossier check: Send a CORS preflight OPTIONS request to https://\<domain\>/ and return the access-control-\* response headers. Use to verify CORS policy for a specific origin-method pair, or to check whether a domain allows cross-origin requests; provide origin and method to simulate a precise pre
- `dossier\_web\_surface`: Core dossier check: Snapshot a domain's public web surface: robots.txt, sitemap.xml, and the home-page \<head\> metadata \(title, description, OpenGraph, Twitter cards\). Use for SEO audits, content discovery, or verifying metadata before sharing; for HTTP headers use dossier\_headers, for redirect behav
- `user\_agent\_parse`: Context lookup: Parse a User-Agent header string into structured browser, OS, device type, and rendering-engine components. Use to identify client capabilities from a raw UA string, e.g. when analysing server logs or request headers; does not perform any network lookups — entirely local parsing. Run
- `dossier\_dnssec`: Core dossier check: Verify DNSSEC chain-of-trust for a domain \(DS, DNSKEY, AD flag\). Use to confirm the zone is signed and resolvers accept the chain; prefer dossier\_dns for raw record types or dossier\_full for the complete audit. Fires Cloudflare DoH DS and DNSKEY queries with DO=1; 8s timeout. Ret
- `dossier\_mta\_sts`: Core dossier check: Fetch and validate a domain's MTA-STS policy \(mode, mx, max\_age, policy id\). Use to confirm inbound SMTP is locked to TLS for this domain. Resolves the \_mta-sts TXT record, then fetches the policy from mta-sts.\<domain\>/.well-known/mta-sts.txt; 10s timeout. Returns a CheckResult;
- `dossier\_tlsrpt`: Core dossier check: Look up a domain's TLS-RPT \(SMTP TLS Reporting\) policy. Use to confirm the domain receives reports of SMTP-TLS failures. Resolves \_smtp.\_tls.\<domain\> TXT via Cloudflare DoH; 5s timeout. Returns a CheckResult; not\_applicable when no record is published.
- `dossier\_whois`: Core dossier check: Look up the registrar, creation date, expiry date, and registry statuses for a domain. Use for ownership/expiry audit. Queries WHOIS over TCP/43 via the \`whoiser\` library; 15s timeout. Returns a CheckResult; not\_applicable when the registry refuses or redacts the query \(common on
- `dossier\_ct\_log`: Core dossier check: Discover subdomains visible in Certificate Transparency logs. Use for attack-surface mapping; prefer dossier\_full when running a complete audit. Queries crt.sh first, falls back to certspotter; capped at 100 unique subdomains; 10s timeout. Returns a CheckResult with \{ subdomains\[
- `dossier\_ai\_crawlers`: Core dossier check: Report a domain's AI-crawler policy — whether robots.txt allows, blocks, or is silent on the six major AI agents \(GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, meta-externalagent\). Use to answer "does this site let AI models train on / retrieve its content?" in a post
- `dossier\_llms\_txt`: Core dossier check: Detect whether a domain publishes an llms.txt at its root — the emerging convention that gives AI agents a curated markdown index of a site's content. Use in a content-posture audit to confirm a site guides \(rather than ignores\) AI agents. Fetches https://\<domain\>/llms.txt, 10s t
- `dossier\_security\_txt`: Core dossier check: Verify a domain publishes a security.txt \(RFC 9116\) at /.well-known/security.txt — the standard machine-readable channel for reporting vulnerabilities. Use in a security audit to confirm researchers have a published disclosure route; its absence is a genuine \(minor\) audit flag. F
- `dossier\_full`: Aggregate dossier check: Run all 10 Domain Dossier checks — dns, mx, spf, dmarc, dkim, tls, redirects, headers, cors, web-surface — in parallel and return all results in a single response. Use when you need a comprehensive domain health snapshot in one call; counts as ONE paywall call regardless of

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html