TamingDNS MCP Server

The short version

• Endpoint: https://tamingdns.com/mcp. Streamable HTTP, JSON-RPC 2.0 over POST, stateless.
• Auth: none. Rate limits apply per IP (see below).
• Tools: check_spf, check_dkim, check_dmarc, check_dnssec, check_dane, check_mx, check_mta_sts, check_tls_rpt, check_bimi, and analyze_email_headers. The rest of the TamingDNS diagnostics follow in later phases.
• One prompt: audit_email_auth. It runs the four email-auth checks against a domain and consolidates the result.
• Discovery: server card · llms.txt · finding-code registry.

Connect your client

Any MCP client that speaks Streamable HTTP can attach. Add the server once; after that your agent calls the tools by name.

Claude Code?

claude mcp add --transport http tamingdns https://tamingdns.com/mcp

Claude Desktop or claude.ai?

Settings → Connectors → Add custom connector. Paste https://tamingdns.com/mcp as the URL. Leave authentication blank; the server doesn't use any.

Cursor?

Add this to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "tamingdns": { "url": "https://tamingdns.com/mcp" }
  }
}

Raycast?

Open Raycast → search "Manage MCP Servers" → Add Server. Choose HTTP as the transport and paste the endpoint URL. Then ask Raycast AI something like "@tamingdns check the DMARC record for example.co.za". MCP servers in Raycast sit behind Raycast AI, which needs a Pro plan.

A client that only speaks stdio?

Bridge it with mcp-remote:

npx mcp-remote https://tamingdns.com/mcp

No MCP client? curl works

The server is plain JSON-RPC 2.0 over HTTPS POST, so anything that can make an HTTP request can use it. A weekly cron job that checks your clients' DMARC records is a one-liner. List the tools:

curl -sS -X POST https://tamingdns.com/mcp \
  -H "Content-Type: application/json" \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Run a check and pull out the grade and finding codes with jq:

curl -sS -X POST https://tamingdns.com/mcp \
  -H "Content-Type: application/json" \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/call",
           "params":{"name":"check_spf","arguments":{"domain":"google.com"}}}' \
  | jq '.result.structuredContent | {grade, status, findings: [.findings[].code]}'

The same call shape works for check_dmarc, check_dnssec, check_dane, check_mx, check_mta_sts, check_tls_rpt and check_bimi. check_dkim also wants a selector argument, and analyze_email_headers takes a headers string instead of a domain; see the table below.

The tools

There is also one prompt, audit_email_auth, which fans out across the four email-auth tools (SPF, DKIM, DMARC, BIMI) and returns a consolidated audit for a domain.

What comes back?

Every tool returns the same canonical envelope, in structuredContent and duplicated as a JSON text block:

• status: pass / warn / fail / info. The one-word answer.
• grade: A to F, with grade_reasons[] explaining each deduction in plain language.
• findings[]: structured issues with stable codes (POLICY_NONE, NEAR_LOOKUP_LIMIT, TESTING_MODE, and so on), severity, and remediation text. The full registry lives at /mcp/resources/finding-codes and via MCP resources/read.
• records[]: the raw DNS records the verdict was computed from, so an agent can show its work.
• analysis: tool-specific detail such as the SPF include tree, the DMARC discovery ladder, or the VMC chain.
• error: present only when the check itself could not run. If the DNS resolvers were unreachable, the tool returns an error with a code (DOH_TIMEOUT, DKIM_LOOKUP_FAILED), a message, and retriable: true instead of a grade-F "no record" verdict. The tools only report a missing record from a confirmed DNS answer. When retriable is true, retry after the 60-second cache window.

The MCP server, the browser tools on this site, and the in-page WebMCP tools all run the same engine code. An agent calling check_dmarc gets byte-identical grading to a human using /dmarc. There is no "API version" that lags the website.

Practical details

What are the rate limits?

Per IP, a few dozen calls a minute, enough for interactive use and scheduled checks, not for bulk scanning. Results are cached for 60 seconds per input, so a retry inside that window is free. If you need more for a legitimate use case, talk to us.

Is there really no authentication?

None. Every tool is read-only and idempotent: it looks up public DNS records and grades them. There is nothing an API key would protect.

Where is the machine-readable description?

The SEP-2127 server card is at /.well-known/mcp/server-card.json. Site-wide context for LLMs is in /llms.txt and /llms-full.txt.

Looking for the v=MCPv1 DNS-key checker?

The DNS signing-key checker that used to live at /mcp moved to /mcp-keys on 2026-06-07. Same tool, new home. This path now belongs to the MCP server itself.