dnsdoctor/claude-plugin

Scan, fix and verify a domain's DNS — email authentication (SPF, DMARC, DKIM)
first, plus multi-region propagation, SPF include supply-chain audits, MX, DNS
health, blacklists and domain/SSL expiry — from inside Claude. This plugin bundles the DNS Doctor **skill**
(the scan → diagnose → fix workflow) and an **MCP server config** pointing at the
hosted DNS Doctor tools.
The moat: every fix record you get back is generated and validated by a
deterministic engine — RFC grammar plus the SPF 10-lookup counter — **never an LLM
guess**. Your agent hands the human a record that already parses correctly, not a
plausible-looking string that silently fails.
What's inside
Tools
| Tool | Does |
|---|---|
| scan_domain | Fresh scan of a domain; full report. |
| get_report | Persisted report (scans once if none exists). |
| build_dmarc_upgrade | A validated DMARC enforcement record, capped at p=quarantine and returned only when the server-derived alignment gate passes; without that evidence the answer is reporting-first and no record is returned. p=reject comes from the readiness engine's aggregate-report evidence, never from a scan. |
| count_spf_lookups | The SPF DNS-lookup count against the RFC limit of 10. |
| validate_dmarc_record | Parse and validate a DMARC record, tag by tag. |
| generate_dmarc_record | Build a DMARC record from a policy + reporting address. |
| check_dkim_selector | Look up one DKIM selector and check the key. |
| parse_dmarc_report | Parse an aggregate (RUA) report file into rows. |
| check_record | Read any DNS record type for a name. |
| check_propagation | Whether a DNS change has gone global: six vantage points (five owner-run probes plus the server's own resolver) read the same name, returning the grid plus a deterministic verdict. Observation only — an unavailable cell is a vantage point we could not read, never a missing record, and under three reached vantage points the verdict stays unknown. |
| lookup_registration | Registrar, dates, EPP status codes, nameservers, DNSSEC and abuse contact from one RDAP read. Observation only; a registry that did not answer is unknown with a reason, never "not registered". |
| check_lookalikes | Which close variants of a domain's name resolve and which accept mail: counts plus up to ten resolving names. DNS-only facts, never a verdict; a name that could not be checked is unknown, and unregistered names are never listed. |
| check_reverse_dns | PTR / forward-confirmed reverse DNS for an IP. |
| audit_spf_includes | The SPF include/redirect tree — who can transitively send as the domain, with typed findings (broken include, confirmed-unregistered include, expiring registration, nested +all). Analysis only; no SPF fix record. |
| build_parked_domain_records | The Null MX + v=spf1 -all + p=reject; np=reject hardening pack for a domain that sends no mail. The server re-checks DNS itself and refuses when it finds evidence of mail. |
| start_monitoring_signup | A sign-up link to hand to the human who owns the domain. Sends no email and creates nothing — they open it, sign in on our page themselves (a social provider or an emailed link, whichever that deployment offers), and the domain is carried over to their dashboard already filled in; monitoring starts once they verify it with a TXT record. |
| get_alerts | **Token required.** The account's monitoring alert log, newest first. Read-only — no acknowledge, no delete. Page down with before until next_before is null before advancing since. |