A DNS and email MCP server, checked live.
DomainProbe is a DNS and email authentication MCP server. It answers questions about any domain from live data: its DNS records, SPF, DKIM and DMARC checks with the reasons mail lands in spam, SSL certificate expiry, HTTPS redirects and security headers, and who registered it. Useful when mail goes to spam, a certificate is about to lapse, or you inherit a domain and need to know how it is set up.
01See it work
DomainProbe, in real use.
5 screens from real calls to DomainProbe. Every value shown is what the tool returned; click a screen to open it full size.
02How it works
Three questions decide where an email lands.
The receiving server asks them of every message, from DNS records your domain publishes. DomainProbe reads the same records and tells you which answer is missing or wrong.
- 01SPFIs this server allowed to send mail for the domain?
TXT at example.com - 02DKIMWas the message signed by the domain, and is it unchanged?
TXT at selector._domainkey - 03DMARCDoes SPF or DKIM match the From domain, and what if neither does?
TXT at _dmarc - 04The resultInbox, spam folder or rejected, following the DMARC policy.
03Email records
SPF, DKIM and DMARC records, explained.
Each record is a line of text in DNS. These are the shapes DomainProbe reads and the problems it looks for in each.
| Record | Where it lives | Example | What DomainProbe checks |
|---|---|---|---|
| SPF | TXT at example.com | v=spf1 include:_spf.google.com ~all | Only one SPF record, at most 10 DNS lookups across its includes, and how it ends (~all, -all or ?all) |
| DKIM | TXT at google._domainkey.example.com | v=DKIM1; k=rsa; p=MIIBIjANBg... | Keys under about 30 common selectors, key type and length (2048-bit RSA recommended), and revoked keys |
| DMARC | TXT at _dmarc.example.com | v=DMARC1; p=reject; rua=mailto:[email protected] | The policy, the share of mail it applies to, where reports go, and SPF and DKIM alignment |
Which DMARC policy to use. p=none only collects reports, p=quarantine sends failing mail to spam, and p=reject refuses it. Start at none with reports turned on, read them until every service that sends for you passes, then move to quarantine and finally reject.
04Deliverability
Why emails go to spam, and the record behind each cause.
Most authentication problems come from the same handful of mistakes. DomainProbe names them in plain words.
| What you see | The usual cause | The fix |
|---|---|---|
| Mail from a newly added tool lands in spam | The tool sends from servers your SPF record does not list | Add the tool's include to SPF, or have it sign with DKIM for your domain |
| SPF fails with a permanent error | The record needs more than 10 DNS lookups, or there are two SPF records | Remove includes you no longer use; keep a single record |
| DMARC fails even though SPF passes | SPF passed for the sending service's own domain, not yours (no alignment) | Turn on DKIM signing for your domain in that service |
| Gmail and Yahoo turn bulk mail away | No DMARC record; both have required one from bulk senders since February 2024 | Publish DMARC, at least p=none with reports |
| A forwarded message fails | Forwarding breaks SPF, and edits along the way break DKIM | Expected for some forwards; a DKIM signature that survives is what DMARC needs |
05Web
Security headers and HSTS.
check_http follows the redirect from http to https and lists the headers browsers use to protect visitors. These are sensible starting values.
| Header | What it does | A sensible starting value |
|---|---|---|
| Strict-Transport-Security | Tells browsers to use HTTPS only. DomainProbe flags a max-age under 180 days. | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Limits where scripts, styles and images may load from | default-src 'self' (then add the sources you use) |
| X-Content-Type-Options | Stops browsers guessing file types | nosniff |
| X-Frame-Options | Stops other sites framing your pages | DENY, or SAMEORIGIN if you frame your own |
| Referrer-Policy | Controls how much of the address other sites see | strict-origin-when-cross-origin |
| Permissions-Policy | Turns off browser features you do not use | camera=(), microphone=(), geolocation=() |
06The extras
CAA, MTA-STS and BIMI, the optional records.
None of these is required, and DomainProbe reports them as missing rather than as faults. Each closes a gap the core records leave open.
CAAMTA-STSTLS-RPTBIMI07Install
Install DomainProbe.
DomainProbe runs on our servers, so there is nothing to download. Add its address to your assistant, and its 5 tools appear the next time you start a conversation.
claude mcp add --transport http domainprobe https://domainprobe.dudelemon.cloud/mcpRun in your terminal. Add --scope user to make it available in every project.
08Tools
Its tools, and what each returns.
lookup_dns- A, AAAA, CNAME, MX, TXT, NS, CAA, SOA and SRV records from public resolvers 1.1.1.1 and 8.8.8.8.
check_email_auth- MX, the SPF record and its DNS lookup count, DMARC policy and reports, DKIM keys under about 30 common selectors, MTA-STS, TLS reporting and BIMI, with a grade and fixes.
check_certificate- Trust, issuer, names covered, days to expiry, key type, chain, TLS version and HTTP/2, on web and mail ports.
check_http- The redirect from http to https, HSTS, Content-Security-Policy and the other security headers, compression and caching.
lookup_registration- Registrar, created and expiry dates, status codes, nameservers and DNSSEC through RDAP, the successor to WHOIS.
09Ask in your own words
Say what you need. DomainProbe does the exact part.
You do not call DomainProbe’s tools by name. Ask your assistant, and it calls them when the question needs live, exact data.
- Why might email from our domain land in spam?
- When does the certificate on shop.example.com expire?
- Does example.com redirect to HTTPS and send HSTS?
- Who is the registrar for example.com and when does it expire?
10Works well with
Related tools.
FAQ
DomainProbe, answered
Anything we have not answered here, ask us directly. A senior engineer replies.
Which DKIM selectors does it check?
About 30 common ones, including google, selector1, selector2, k1, s1, default, mandrill, sendgrid and amazonses. If a message was signed under another selector, pass it in dkim_selectors; you can read it from the s= tag of the DKIM-Signature header.
Where does registration data come from?
From RDAP, the registries’ structured replacement for WHOIS. A few country-code registries do not publish RDAP, and for those the tool says so.
Can it check certificates on mail servers?
Yes. check_certificate connects on ports 443, 465, 993, 995 and 8443.
Is DomainProbe free?
Yes. DomainProbe is free and needs no account or API key.
How do I install DomainProbe?
Add https://domainprobe.dudelemon.cloud/mcp to your assistant as a remote MCP server. In Claude Code run claude mcp add --transport http domainprobe https://domainprobe.dudelemon.cloud/mcp; in the Claude apps add it as a custom connector with no sign-in; in Cursor or VS Code add it to mcp.json.
Why does DomainProbe say my SPF record needs too many lookups?
Every include, a, mx and redirect in SPF costs a DNS lookup, and includes can contain more includes. Receivers stop at 10 and treat the record as broken. DomainProbe counts them for you, nested includes included.