DNS MCP Server
Wraps a forensics-grade DNS toolkit into 19 MCP tools for SOC workflows. You get DNSSEC chain validation with full cryptographic verification from root anchors, SPF/DKIM/DMARC/DANE email security checks, RDAP registration lookups, RBL/DBL reputation queries, and fast-flux detection. The server runs as a containerized HTTP endpoint with OAuth via Pocket ID rather than stdio, so you can host it once and connect from any MCP client. Ships with four analyst prompt templates including phishing triage and NIST 800-81r3 compliance audits. Built by a practitioner who wanted the same queries available at the command line accessible through Claude without tab-switching between dig, drill, and WHOIS.
- GitHub stars
- 1
- tools
- 19
- transport
- STDIO
- last updated
- Mar 29, 2026
Tools
19 toolsPublic tool metadata for what this MCP can expose to an agent.
pingServer uptime, current timestamp, dns_tool version + commit hash
Server uptime, current timestamp, dns_tool version + commit hash
No parameter schema in public metadata yet.
whoamiAuthenticated user identity from JWT claims
Authenticated user identity from JWT claims
No parameter schema in public metadata yet.
dns_queryStandard DNS lookup over DoH — 20 record types (A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, SRV, CAA, DNSKEY, DS, RRSIG, NSEC, NSEC3, TLSA, SSHFP, HTTPS, SVCB, NAPTR). Optional subnet sends an EDNS Client Subnet hint (RFC 7871); the ecs block says whether the answer was really tail...
Standard DNS lookup over DoH — 20 record types (A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, SRV, CAA, DNSKEY, DS, RRSIG, NSEC, NSEC3, TLSA, SSHFP, HTTPS, SVCB, NAPTR). Optional subnet sends an EDNS Client Subnet hint (RFC 7871); the ecs block says whether the answer was really tail...
No parameter schema in public metadata yet.
dnssec_validateFull DNSSEC chain walk from IANA root trust anchor down to target. Real cryptographic validation at every zone cut. Returns structured verdict + per-zone findings + event transcript
Full DNSSEC chain walk from IANA root trust anchor down to target. Real cryptographic validation at every zone cut. Returns structured verdict + per-zone findings + event transcript
No parameter schema in public metadata yet.
nsec_infoNSEC / NSEC3 denial-of-existence analysis — zone walkability assessment, NSEC3 hash parameters, opt-out detection
NSEC / NSEC3 denial-of-existence analysis — zone walkability assessment, NSEC3 hash parameters, opt-out detection
No parameter schema in public metadata yet.
check_spfSPF record parsing with recursive include resolution (RFC 7208 10-lookup limit)
SPF record parsing with recursive include resolution (RFC 7208 10-lookup limit)
No parameter schema in public metadata yet.
check_dmarcDMARC policy retrieval with organizational domain fallback
DMARC policy retrieval with organizational domain fallback
No parameter schema in public metadata yet.
check_dkimDKIM public key record verification for a selector + domain pair
DKIM public key record verification for a selector + domain pair
No parameter schema in public metadata yet.
enumerate_dkim_selectorsProbe a domain for DKIM keys at well-known selector names; returns the selectors that resolve
Probe a domain for DKIM keys at well-known selector names; returns the selectors that resolve
No parameter schema in public metadata yet.
check_daneDANE TLSA records for all MX hosts of a domain
DANE TLSA records for all MX hosts of a domain
No parameter schema in public metadata yet.
check_tlsaStandalone TLSA record lookup at _<port>._<proto>.<host>
Standalone TLSA record lookup at _<port>._<proto>.<host>
No parameter schema in public metadata yet.
check_rblIP reputation against 8 DNS-based RBLs (Spamhaus ZEN, SpamCop, UCEProtect L1/L2, Mailspike, PSBL, Barracuda, SORBS)
IP reputation against 8 DNS-based RBLs (Spamhaus ZEN, SpamCop, UCEProtect L1/L2, Mailspike, PSBL, Barracuda, SORBS)
No parameter schema in public metadata yet.
check_dblDomain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL)
Domain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL)
No parameter schema in public metadata yet.
cymru_asnASN lookup via Team Cymru DNS service — BGP prefix, org, country
ASN lookup via Team Cymru DNS service — BGP prefix, org, country
No parameter schema in public metadata yet.
check_fast_fluxFast-flux detection — repeated A/AAAA queries to identify rotating IPs and short TTLs
Fast-flux detection — repeated A/AAAA queries to identify rotating IPs and short TTLs
No parameter schema in public metadata yet.
detect_hijackingTest a recursive resolver for tampering — NXDOMAIN wildcards, DNSSEC handling, identity
Test a recursive resolver for tampering — NXDOMAIN wildcards, DNSSEC handling, identity
No parameter schema in public metadata yet.
rdap_lookupDomain registration data via RDAP (modern WHOIS replacement)
Domain registration data via RDAP (modern WHOIS replacement)
No parameter schema in public metadata yet.
session_statsPer-tool call statistics for the current process — count, error_count, mean_ms, max_ms, first/last_called timestamps; plus session uptime and total call count
Per-tool call statistics for the current process — count, error_count, mean_ms, max_ms, first/last_called timestamps; plus session uptime and total call count
No parameter schema in public metadata yet.
reset_statsClear all tool-call statistics and restart the session clock.
Clear all tool-call statistics and restart the session clock.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
DNS MCP Server
Real-time DNS security analysis for AI assistants via MCP. Gives your assistant the ability to investigate domains the way a practitioner would — DNSSEC chain validation, email authentication posture, and registration intelligence — without leaving your chat session.
Built by a cybersecurity professional for SOC investigation workflows. Not a toy — the same queries you would run at the command line, accessible through any MCP-compatible assistant in real time.
Architecture (2.0.0)
dns-mcp is a Streamable HTTP MCP server with OAuth via Pocket
ID. Tool implementations are thin wrappers around the
dns_tool Python library, which
owns all DNS logic. The server itself is ~430 lines of code: auth bootstrap,
tool registration, and prompt loading.
Details
- Repository
- github.com/mclose/dns-mcp
- Categories
- Communication & Messaging, Security & Pentesting
- Package
docker.io/mclose/dns-mcp:1.3.4- Transport
- STDIO
- Registry
- MCP registry, active
Related Communication & Messaging MCP servers
View all
Impact Mcpshashwatgtm/impact-mcpIMPACT: 8 B2B positioning and messaging tools by Helix GTM Consulting1stars
Synapbussynapbus/synapbusMCP-native agent-to-agent messaging hub with channels, DMs, and semantic search1stars
FastMCP server that pages on-call via 100+ notification channels (Apprise wrappeadelaidasofia/paging-mcpFastMCP server that pages on-call via 100+ notification channels (Apprise wrapper)0stars
AgentDM: Agent to Agent Communication Platformagentdmai/agentdmAgent communication platform for agent to agent messaging via MCP. Messages, channels, skills.0stars
Dreamlitdreamlit-ai/dreamlit-mcpCreate, test, publish, and manage Dreamlit notification workflows from AI clients.0stars
Marketing & Brand Context by Marcoraccromp/marcora-mcpThe context layer for go-to-market teams0stars