{
  "markdown": "# DNS Doctor — Claude Code plugin & DNS skill (DMARC, SPF, DKIM)\n\nScan, fix and verify a domain's DNS — email authentication (SPF, DMARC, DKIM)\nfirst, plus multi-region propagation, SPF include supply-chain audits, MX, DNS\nhealth, blacklists and domain/SSL expiry — from inside Claude. This plugin bundles the DNS Doctor **skill**\n(the scan → diagnose → fix workflow) and an **MCP server config** pointing at the\nhosted DNS Doctor tools.\n\nThe moat: every fix record you get back is generated and validated by a\ndeterministic engine — RFC grammar plus the SPF 10-lookup counter — **never an LLM\nguess**. Your agent hands the human a record that already parses correctly, not a\nplausible-looking string that silently fails.\n\n## What's inside\n\n```\nclaude-plugin/\n├── .claude-plugin/plugin.json   # plugin manifest\n├── .mcp.json                    # MCP server: https://dnsdoctor.dev/mcp (HTTP)\n├── skills/dns-doctor/SKILL.md   # the scan → diagnose → fix workflow\n├── src/                         # @dnsdoctor/mcp — the local stdio MCP server\n├── tools.json                   # the 16 tool definitions (generated, never hand-edited)\n├── instructions.txt             # the server's own `initialize` guidance (generated)\n├── tests/                       # vitest suite for the stdio server\n├── package.json  tsconfig.json  # npm package + build\n├── LICENSE                      # Apache-2.0\n└── README.md\n```\n\n## Tools\n\n| Tool | Does |\n|---|---|\n| `scan_domain` | Fresh scan of a domain; full report. |\n| `get_report` | Persisted report (scans once if none exists). |\n| `build_dmarc_upgrade` | A validated DMARC enforcement record, capped at `p=quarantine` and returned only when the server-derived alignment gate passes; without that evidence the answer is reporting-first and no record is returned. `p=reject` comes from the readiness engine's aggregate-report evidence, never from a scan. |\n| `count_spf_lookups` | The SPF DNS-lookup count against the RFC limit of 10. |\n| `validate_dmarc_record` | Parse and validate a DMARC record, tag by tag. |\n| `generate_dmarc_record` | Build a DMARC record from a policy + reporting address. |\n| `check_dkim_selector` | Look up one DKIM selector and check the key. |\n| `parse_dmarc_report` | Parse an aggregate (RUA) report file into rows. |\n| `check_record` | Read any DNS record type for a name. |\n| `check_propagation` | Whether a DNS change has gone global: six vantage points (five owner-run probes plus the server's own resolver) read the same name, returning the grid plus a deterministic verdict. Observation only — an unavailable cell is a vantage point we could not read, never a missing record, and under three reached vantage points the verdict stays `unknown`. |\n| `check_reverse_dns` | PTR / forward-confirmed reverse DNS for an IP. |\n| `audit_spf_includes` | The SPF include/redirect tree — who can transitively send as the domain, with typed findings (broken include, confirmed-unregistered include, expiring registration, nested `+all`). Analysis only; no SPF fix record. |\n| `build_parked_domain_records` | The Null MX + `v=spf1 -all` + `p=reject; np=reject` hardening pack for a domain that sends no mail. The server re-checks DNS itself and refuses when it finds evidence of mail. |\n| `start_monitoring_signup` | A sign-up link to hand to the human who owns the domain. Sends no email and creates nothing — they open it, sign in on our page themselves (a social provider or an emailed link, whichever that deployment offers), and the domain is carried over to their dashboard already filled in; monitoring starts once they verify it with a TXT record. |\n| `get_alerts` | **Token required.** The account's monitoring alert log, newest first. Read-only — no acknowledge, no delete. Page down with `before` until `next_before` is `null` before advancing `since`. |\n| `get_readiness` | **Token required.** Whether one monitored domain's aggregate-report evidence justifies a stronger DMARC policy yet: `ready`, the `blockers`, and `next_record` (validated, or `null` while blocked — which is an answer, not a gap). |\n\nThe two monitoring reads are **listed for everyone and callable with a token**:\nthey appear in the tool list on both transports, and without a valid token the\ncall is refused with the page the account owner mints one on. Over the hosted\nHTTP transport the `dnsdoctor://domains` resource (your monitored domains) is\nlikewise always listed and refused without a token; the local stdio server\nregisters the tools only — no resource. Anonymous access covers all fourteen\ndiagnosis tools, which is enough for a one-off diagnosis either way.\n\n## Install\n\n### Claude Code\n\nAdd the marketplace/repo and enable the plugin:\n\n```bash\n/plugin marketplace add dnsdoctor/claude-plugin\n/plugin install dns-doctor\n```\n\n> Public home: [github.com/dnsdoctor/claude-plugin](https://github.com/dnsdoctor/claude-plugin)\n> (org `dnsdoctor`, domain-verified). The plugin is developed in the DNS Doctor\n> monorepo and published here as clean release snapshots.\n\nOr point Claude Code at a local checkout of this directory during development.\nOnce enabled, the skill auto-loads and the `dns-doctor` MCP server connects to\n`https://dnsdoctor.dev/mcp`.\n\n### claude.ai (MCP connector)\n\nAdd a custom connector with:\n\n- **URL:** `https://dnsdoctor.dev/mcp`\n- **Transport:** Streamable HTTP\n- **Auth:** none (anonymous) — or a Bearer token (below)\n\n### Any MCP client (standard config)\n\n```json\n{\n  \"mcpServers\": {\n    \"dns-doctor\": {\n      \"url\": \"https://dnsdoctor.dev/mcp\"\n    }\n  }\n}\n```\n\n## Optional: API token for monitored domains\n\nAnonymous access covers scanning and fixes. A per-account API token unlocks the\naccount's own monitoring data: the `get_alerts` and `get_readiness` tools, and\nthe `dnsdoctor://domains` resource (your continuously-monitored domains and\ntheir latest per-check statuses).\n\n1. Sign in at <https://dnsdoctor.dev> → **Settings → API tokens** → create a token.\n   The plaintext (`dnsd_…`) is shown once; copy it.\n2. Add the `Authorization` header to the server in `.mcp.json`:\n\n   ```json\n   {\n     \"mcpServers\": {\n       \"dns-doctor\": {\n         \"type\": \"http\",\n         \"url\": \"https://dnsdoctor.dev/mcp\",\n         \"headers\": { \"Authorization\": \"Bearer ${DNSDOCTOR_API_TOKEN}\" }\n       }\n     }\n   }\n   ```\n\n   Then export `DNSDOCTOR_API_TOKEN=dnsd_YOUR_TOKEN` in your environment. Never\n   commit the token.\n\n### Transport\n\nTwo supported public transports, same 16 tools:\n\n- **Hosted streamable HTTP** — `https://dnsdoctor.dev/mcp`, wired in this\n  plugin's `.mcp.json`. No install, no keys.\n- **Local stdio** — `npx -y @dnsdoctor/mcp`. A thin server that runs on your\n  machine and calls the public DNS Doctor REST API; it holds no diagnosis logic\n  of its own and relays every record string verbatim.\n\n```json\n{\n  \"mcpServers\": {\n    \"dns-doctor\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@dnsdoctor/mcp\"],\n      \"env\": { \"DNSDOCTOR_API_TOKEN\": \"dnsd_YOUR_TOKEN\" }\n    }\n  }\n}\n```\n\n`DNSDOCTOR_API_TOKEN` is optional (anonymous access covers scanning and fixes;\nthe two monitoring reads need it).\n`DNSDOCTOR_API_BASE` overrides the origin — it must be an origin that serves the\n`/api/…` paths, i.e. the public site rather than a bare backend port.\n\n### Build the stdio server from source\n\n```bash\nnpm ci\nnpm test\nnpm run build      # -> dist/index.js, the package's bin entrypoint\n```\n\n`tools.json` and `instructions.txt` are **generated from the hosted server** and\npinned by a backend test — never hand-edit them, and never add a tool\ndescription to `src/`. Both files ship in the npm tarball; without them the\nclient has no tools and none of its safety guidance.\n\n## Worked example\n\n> **You:** Our invoices keep landing in customers' spam. Domain is `example.com`.\n>\n> **Claude** (`scan_domain` → `example.com`): DMARC is at `p=none`, so nothing\n> enforces alignment — receivers can't tell your mail from a spoof. The SPF record\n> is valid, 7 of 10 lookups used. DKIM: a selector was found and is valid. Not blacklisted.\n> Domain expires in 240 days.\n>\n> **Claude** (`build_dmarc_upgrade` → `example.com`): SPF is aligned and DKIM is\n> present, so the recommendation reaches its ceiling, `p=quarantine`. Publish this\n> exact TXT record at `_dmarc.example.com` — **paste it verbatim, don't edit it**:\n>\n> ```\n> v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r; np=reject\n> ```\n>\n> Apply it in your DNS host once you've confirmed it's approved, then ask me to\n> re-scan to verify. Want the domain watched continuously with aggregate-report\n> alerts? Here is the setup link — open it and sign in:\n> https://dnsdoctor.dev/start?domain=example.com&ref=agent\n\n## Learn more\n\n- **Methodology** (how the verdicts are computed): <https://dnsdoctor.dev/methodology>\n- **REST API / OpenAPI schema:** <https://dnsdoctor.dev/api/v1/openapi.json>\n\n## License\n\nApache-2.0 — see [LICENSE](./LICENSE).\n",
  "bytes": 8892,
  "sha": "0488067422d0fa64cf827cc53e305f536a2beafaf169cda45cc76130a4c661fc",
  "repo_slug": "dnsdoctor/claude-plugin",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_dev_dnsdoctor_dns_doctor_c82fc0b8/readme"
}