BlackVeil DNS & Email Security Scanner

com.blackveilsecurity/dnsVersion 3.114.0

DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

Status

Responds698 msNov 14, 2026, 13:49 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:49 UTC
Latency: 698 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://dns-mcp.blackveilsecurity.com/mcpResponds698 msNov 14, 2026, 13:49 UTC

No sign-in

Claude Code

claude mcp add --transport http dns https://dns-mcp.blackveilsecurity.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: dns
Remote MCP server URL: https://dns-mcp.blackveilsecurity.com/mcp

Cursor

{
  "mcpServers": {
    "dns": {
      "url": "https://dns-mcp.blackveilsecurity.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"dns","type":"http","url":"https://dns-mcp.blackveilsecurity.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

82 tools

Tools of BlackVeil DNS & Email Security Scanner
	Description		Read-only	Idempotent	Open world
`analyze_drift`Measure whether a domain's DNS security posture improved or regressed versus a prior scan snapshot; returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements and regressions. Use for "did our score improve or regress since last time?"; not compare_baseline, which checks compliance with a fixed policy.	Measure whether a domain's DNS security posture improved or regressed versus a prior scan snapshot; returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements and regressions. Use for "did our score improve or regress since last time?"; not compare_baseline, which checks compliance with a fixed policy.	No	Yes	Yes	Yes
`assess_spoofability`Compute a composite email spoofability risk score (0-100, higher = more spoofable) from SPF trust surface, DMARC enforcement and DKIM coverage. Returns a risk level (minimal to critical), per-control sub-scores and a plain-language summary. Use when asked how easy it is to spoof email from a domain, or for a composite spoofing risk score.	Compute a composite email spoofability risk score (0-100, higher = more spoofable) from SPF trust surface, DMARC enforcement and DKIM coverage. Returns a risk level (minimal to critical), per-control sub-scores and a plain-language summary. Use when asked how easy it is to spoof email from a domain, or for a composite spoofing risk score.	No	Yes	Yes	Yes
`batch_scan`Bulk-scan up to 10 domains in parallel with a full security audit each; returns score, NIST-aligned letter grade (A+ to F) and finding counts per domain. Use to audit several domains at once; use compare_domains for a side-by-side comparison of 2-5 domains. scoringModelVersion (policy) is independent of dnsChecksPackageVersion (engine); cite scoringConfigHash with scores.	Bulk-scan up to 10 domains in parallel with a full security audit each; returns score, NIST-aligned letter grade (A+ to F) and finding counts per domain. Use to audit several domains at once; use compare_domains for a side-by-side comparison of 2-5 domains. scoringModelVersion (policy) is independent of dnsChecksPackageVersion (engine); cite scoringConfigHash with scores.	No	Yes	Yes	Yes
`batch_scan_findings`Fetch owner-scoped findings for a completed asynchronous batch scan.	Fetch owner-scoped findings for a completed asynchronous batch scan.	No	Yes	Yes	No
`batch_scan_start`Start a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, normalized inputs, and scoring versions returns the same job.	Start a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, normalized inputs, and scoring versions returns the same job.	No	No	Yes	Yes
`batch_scan_status`Read the owner-scoped status of an asynchronous batch scan.	Read the owner-scoped status of an asynchronous batch scan.	No	Yes	Yes	No
`brand_audit_batch_start`Enqueue an async brand audit across up to 50 target domains with optional standard/deep discovery depth, brand aliases, and caller-supplied candidate domains. Returns { auditId, queuedAt, targetCount, etaSeconds } immediately; poll with brand_audit_status and fetch results with brand_audit_get_report once complete. Each target consumes 1 unit of the monthly BRAND_AUDIT_QUOTAS budget.	Enqueue an async brand audit across up to 50 target domains with optional standard/deep discovery depth, brand aliases, and caller-supplied candidate domains. Returns { auditId, queuedAt, targetCount, etaSeconds } immediately; poll with brand_audit_status and fetch results with brand_audit_get_report once complete. Each target consumes 1 unit of the monthly BRAND_AUDIT_QUOTAS budget.	No	No	No	Yes
`brand_audit_get_report`Fetch the result JSON of a completed brand audit: the per-target CheckResult when `target` is set, else the audit-level aggregate; returns notReady while in flight. When a PDF sidecar exists, metadata includes pdfUrl, an authenticated /reports/ download link (same bearer credential). Targets whose PDF is still rendering include pdfPending, so poll again.	Fetch the result JSON of a completed brand audit: the per-target CheckResult when `target` is set, else the audit-level aggregate; returns notReady while in flight. When a PDF sidecar exists, metadata includes pdfUrl, an authenticated /reports/ download link (same bearer credential). Targets whose PDF is still rendering include pdfPending, so poll again.	No	Yes	Yes	No
`brand_audit_single`Run a full brand audit on one target (optional standard/deep depth, brand aliases, candidate domains). Discovers brand-related domains, looks up registrar and registrant, and classifies each as consolidated, shadowIt, authorized vendor, indeterminate or impersonation. Gated by monthly BRAND_AUDIT_QUOTAS (free/agent=0, developer=50, partner=200, enterprise=500, owner=unlimited).	Run a full brand audit on one target (optional standard/deep depth, brand aliases, candidate domains). Discovers brand-related domains, looks up registrar and registrant, and classifies each as consolidated, shadowIt, authorized vendor, indeterminate or impersonation. Gated by monthly BRAND_AUDIT_QUOTAS (free/agent=0, developer=50, partner=200, enterprise=500, owner=unlimited).	No	No	No	Yes
`brand_audit_status`Poll the status of an enqueued brand audit. Returns audit-level status (queued \| running \| completed \| failed), progress 'N/M', and per-target statuses. Owner-scoped — auditIds owned by other principals surface as notFound.	Poll the status of an enqueued brand audit. Returns audit-level status (queued \| running \| completed \| failed), progress 'N/M', and per-target statuses. Owner-scoped — auditIds owned by other principals surface as notFound.	No	Yes	Yes	No
`check_agent_discovery`Assess IETF BANDAID agent-discovery DNS records: finds SVCB agent records under _agents, reports whether the discovery zone is DNSSEC-anchored (unsigned means spoofable endpoints), evaluates DANE/TLSA binding trust and checks capability-document integrity (cap / cap-sha256). Read-only; uses Private-Use SVCB param code points pending IANA assignment.	Assess IETF BANDAID agent-discovery DNS records: finds SVCB agent records under _agents, reports whether the discovery zone is DNSSEC-anchored (unsigned means spoofable endpoints), evaluates DANE/TLSA binding trust and checks capability-document integrity (cap / cap-sha256). Read-only; uses Private-Use SVCB param code points pending IANA assignment.	No	Yes	Yes	Yes
`check_authoritative_dns_infra`Measure a hostname's authoritative DNS posture by querying its nameservers directly over TCP/53 from one vantage: reachability, AA flag, recursion exposure, SOA serial consistency, DNSKEY/RRSIG presence (not validation), IPv4/IPv6 parity. Authenticated callers also get a zone-transfer refusal test (no zone data retrieved) and CHAOS disclosure. UDP, BGP, RPKI, anycast not measured.	Measure a hostname's authoritative DNS posture by querying its nameservers directly over TCP/53 from one vantage: reachability, AA flag, recursion exposure, SOA serial consistency, DNSKEY/RRSIG presence (not validation), IPv4/IPv6 parity. Authenticated callers also get a zone-transfer refusal test (no zone data retrieved) and CHAOS disclosure. UDP, BGP, RPKI, anycast not measured.	No	Yes	Yes	Yes
`check_bimi`Check the BIMI record at default._bimi.<domain>: validates the logo URL (l=), the presence of mark-certificate authority evidence (a=; a bare URL, so VMC vs CMC is not determined), and the DMARC enforcement prerequisite (p=quarantine/reject) mail clients require. Use to assess brand-logo readiness in inboxes. Part of the scan_domain audit.	Check the BIMI record at default._bimi.<domain>: validates the logo URL (l=), the presence of mark-certificate authority evidence (a=; a bare URL, so VMC vs CMC is not determined), and the DMARC enforcement prerequisite (p=quarantine/reject) mail clients require. Use to assess brand-logo readiness in inboxes. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_caa`Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.	Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dane`Check DANE/TLSA pinning for SMTP: looks up TLSA records at _25._tcp.<mx-host> for each MX and validates their fields and DNSSEC backing. Records are reported present but UNVERIFIED: there is no port-25 certificate probe, so a pin is never compared to the certificate actually served. Use for SMTP DANE; use check_dane_https for port 443. Part of the scan_domain audit.	Check DANE/TLSA pinning for SMTP: looks up TLSA records at _25._tcp.<mx-host> for each MX and validates their fields and DNSSEC backing. Records are reported present but UNVERIFIED: there is no port-25 certificate probe, so a pin is never compared to the certificate actually served. Use for SMTP DANE; use check_dane_https for port 443. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dane_https`Verify DANE/TLSA pinning for HTTPS (port 443): looks up TLSA records at _443._tcp.<domain> and validates fields and DNSSEC backing. Reported present but UNVERIFIED in every deployment: comparison with the served certificate is withdrawn (the probe cannot observe the origin certificate), so a stale pin is NOT detected. Use check_dane for SMTP. Part of the scan_domain audit.	Verify DANE/TLSA pinning for HTTPS (port 443): looks up TLSA records at _443._tcp.<domain> and validates fields and DNSSEC backing. Reported present but UNVERIFIED in every deployment: comparison with the served certificate is withdrawn (the probe cannot observe the origin certificate), so a stale pin is NOT detected. Use check_dane for SMTP. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dbl`Check domain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL). Returns listing status with decoded return codes.	Check domain reputation against DNS-based Domain Block Lists (Spamhaus DBL, URIBL, SURBL). Returns listing status with decoded return codes.	No	Yes	Yes	Yes
`check_dkim`Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound. Part of the scan_domain audit.	Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dmarc`Look up and validate a domain's DMARC record: enforcement level (none/quarantine/reject), alignment mode, and aggregate/forensic reporting destinations. Use to find a domain's DMARC enforcement, whether it sends aggregate reports, or whether it is protected against email impersonation; not check_shadow_domains (TLD variants) or assess_spoofability (composite score). Part of the scan_domain audit.	Look up and validate a domain's DMARC record: enforcement level (none/quarantine/reject), alignment mode, and aggregate/forensic reporting destinations. Use to find a domain's DMARC enforcement, whether it sends aggregate reports, or whether it is protected against email impersonation; not check_shadow_domains (TLD variants) or assess_spoofability (composite score). Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dnskey_strength`Audit DNSKEY signing algorithms used for DNSSEC: reports the algorithm in use (RSA/SHA-1, RSA/SHA-256, ECDSA P-256, Ed25519, etc.) and flags deprecated ones (RSA/SHA-1, DSA), independent of whether the chain validates. Use when asked which algorithm signs DNSSEC keys or if deprecated DNSKEY algorithms are in use. Part of the scan_domain audit.	Audit DNSKEY signing algorithms used for DNSSEC: reports the algorithm in use (RSA/SHA-1, RSA/SHA-256, ECDSA P-256, Ed25519, etc.) and flags deprecated ones (RSA/SHA-1, DSA), independent of whether the chain validates. Use when asked which algorithm signs DNSSEC keys or if deprecated DNSKEY algorithms are in use. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dnssec`Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_domain audit.	Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_dnssec_chain`Walk the full DNSSEC chain of trust from the DNS root down to the target domain, tracing DS/DNSKEY records and algorithm usage at each zone level. Use when asked to trace the chain of trust from the DNS root, or to see the full DNSSEC delegation path step by step.	Walk the full DNSSEC chain of trust from the DNS root down to the target domain, tracing DS/DNSKEY records and algorithm usage at each zone level. Use when asked to trace the chain of trust from the DNS root, or to see the full DNSSEC delegation path step by step.	No	Yes	Yes	Yes
`check_fast_flux`Detect fast-flux DNS behavior: performs multiple rounds of A/AAAA queries and checks whether IP addresses are rotating rapidly on each DNS query (a sign of botnet or malicious infrastructure). Compares IP answer sets and TTLs across rounds to identify rapidly rotating infrastructure used to hide malicious activity.	Detect fast-flux DNS behavior: performs multiple rounds of A/AAAA queries and checks whether IP addresses are rotating rapidly on each DNS query (a sign of botnet or malicious infrastructure). Compares IP answer sets and TTLs across rounds to identify rapidly rotating infrastructure used to hide malicious activity.	No	Yes	Yes	Yes
`check_http_security`Audit browser-facing HTTP security headers over HTTPS: Content-Security-Policy (unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/COEP/CORP; also detects CDN/WAF interception. Returns per-header findings for missing or weak protection against XSS, clickjacking and cross-origin attacks. Part of the scan_domain audit.	Audit browser-facing HTTP security headers over HTTPS: Content-Security-Policy (unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/COEP/CORP; also detects CDN/WAF interception. Returns per-header findings for missing or weak protection against XSS, clickjacking and cross-origin attacks. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_llms_txt`Inspect a domain's /llms.txt and /llms-full.txt for links and install commands an AI agent could inherit. Sweeps external link hosts for dangling CNAMEs and deprovisioned-service fingerprints (evidence, not proof it is claimable) and checks npm/PyPI install package names for unregistered names and OSV malicious-package advisories. Detection only, not scored; notAssessed lists unmeasured items.	Inspect a domain's /llms.txt and /llms-full.txt for links and install commands an AI agent could inherit. Sweeps external link hosts for dangling CNAMEs and deprovisioned-service fingerprints (evidence, not proof it is claimable) and checks npm/PyPI install package names for unregistered names and OSV malicious-package advisories. Detection only, not scored; notAssessed lists unmeasured items.	No	Yes	Yes	Yes
`check_lookalikes`Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual-confusion domains registered by attackers. Distinct from check_shadow_domains (TLD variants with auth gaps) and discover_brand_domains (legitimate brand portfolio).	Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual-confusion domains registered by attackers. Distinct from check_shadow_domains (TLD variants with auth gaps) and discover_brand_domains (legitimate brand portfolio).	No	Yes	Yes	Yes
`check_mta_sts`Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether inbound SMTP is protected against TLS downgrade or MITM — distinct from check_dane which uses TLSA pinning. Part of the scan_domain audit.	Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether inbound SMTP is protected against TLS downgrade or MITM — distinct from check_dane which uses TLSA pinning. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_mx`Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbound mail for a domain, or to see MX record configuration. Part of the scan_domain audit.	Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbound mail for a domain, or to see MX record configuration. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_mx_reputation`Check whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies reverse DNS for MX hosts. Use when you want to know if your mail server IP is blacklisted, or if your MX is on any blocklist — distinct from check_rbl which checks a specific IP directly.	Check whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies reverse DNS for MX hosts. Use when you want to know if your mail server IP is blacklisted, or if your MX is on any blocklist — distinct from check_rbl which checks a specific IP directly.	No	Yes	Yes	Yes
`check_ns`Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required glue addresses. Use to detect stale registrar delegations, lame nameservers, and intermittent resolution risk. Part of the scan_domain audit.	Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required glue addresses. Use to detect stale registrar delegations, lame nameservers, and intermittent resolution risk. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_nsec_walkability`Assess zone walkability risk by analyzing NSEC3PARAM configuration. Detects plain NSEC zones, weak NSEC3 parameters, and opt-out flags.	Assess zone walkability risk by analyzing NSEC3PARAM configuration. Detects plain NSEC zones, weak NSEC3 parameters, and opt-out flags.	No	Yes	Yes	Yes
`check_ptr`Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit.	Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_rbl`Check MX server IP reputation against 6 DNS-based Real-time Blocklists (SpamCop, UCEProtect, Mailspike, Barracuda, PSBL). Resolves MX hosts to IPs first.	Check MX server IP reputation against 6 DNS-based Real-time Blocklists (SpamCop, UCEProtect, Mailspike, Barracuda, PSBL). Resolves MX hosts to IPs first.	No	Yes	Yes	Yes
`check_realtime_threat_feed`Check a domain against BlackVeil real-time threat intelligence (curated intel-gateway feed). Distinct from DNSBL checks. Operator-deploy only; degrades to info when unprovisioned.	Check a domain against BlackVeil real-time threat intelligence (curated intel-gateway feed). Distinct from DNSBL checks. Operator-deploy only; degrades to info when unprovisioned.	No	Yes	Yes	Yes
`check_resolver_consistency`Check DNS consistency across 4 public resolvers.	Check DNS consistency across 4 public resolvers.	No	Yes	Yes	Yes
`check_root_server_set`Query a rotating sample of 3 root servers per call and compare the priming NS set, glue, SOA serials, and cross-root consistency against the embedded official root hints. Uses BV_INFRA_PROBE when available; without it, returns the embedded hints as reference data only.	Query a rotating sample of 3 root servers per call and compare the priming NS set, glue, SOA serials, and cross-root consistency against the embedded official root hints. Uses BV_INFRA_PROBE when available; without it, returns the embedded hints as reference data only.	No	Yes	Yes	Yes
`check_shadow_domains`Find alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to spoof email. Use when asked about TLD variants with email auth gaps — distinct from check_lookalikes which detects typosquat/homoglyph impersonation domains.	Find alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to spoof email. Use when asked about TLD variants with email auth gaps — distinct from check_lookalikes which detects typosquat/homoglyph impersonation domains.	No	Yes	Yes	Yes
`check_spf`Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use when you need to know who is permitted to send email as a domain. Part of the scan_domain audit.	Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use when you need to know who is permitted to send email as a domain. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_srv`Map a domain's DNS-visible service footprint by probing 19 common SRV prefixes (email, calendar, messaging, directory, web) in parallel; returns discovered services and flags insecure advertisements such as plaintext IMAP/POP3/LDAP with no encrypted variant. No match among probed prefixes is not proof the domain has no services. Use to map DNS-visible services.	Map a domain's DNS-visible service footprint by probing 19 common SRV prefixes (email, calendar, messaging, directory, web) in parallel; returns discovered services and flags insecure advertisements such as plaintext IMAP/POP3/LDAP with no encrypted variant. No match among probed prefixes is not proof the domain has no services. Use to map DNS-visible services.	No	Yes	Yes	Yes
`check_ssl`Check HTTPS/TLS posture: reachability, HSTS, HTTP-to-HTTPS redirect, and certificate issuer, expiry, days remaining and SAN count from public CT logs (the latest LOGGED certificate, which may differ from the one served). TLS protocol versions and cipher suites are not assessed. Use to verify HTTPS/HSTS and certificate expiry. Part of the scan_domain audit.	Check HTTPS/TLS posture: reachability, HSTS, HTTP-to-HTTPS redirect, and certificate issuer, expiry, days remaining and SAN count from public CT logs (the latest LOGGED certificate, which may differ from the one served). TLS protocol versions and cipher suites are not assessed. Use to verify HTTPS/HSTS and certificate expiry. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_subdomailing`Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you want to know if an SPF include chain can be hijacked through a dangling domain, or to detect subdomain mailing risk hidden in SPF includes. Part of the scan_domain audit.	Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you want to know if an SPF include chain can be hijacked through a dangling domain, or to detect subdomain mailing risk hidden in SPF includes. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_subdomain_takeover`Sweep subdomains for dangling CNAMEs pointing at deprovisioned cloud services an attacker could claim (subdomain takeover); detects 16 provider families such as AWS S3/CloudFront, Azure, GCP Storage, Heroku, GitHub Pages, Vercel and Firebase. Use when asked if subdomains point to deprovisioned services. Pair with discover_subdomains to widen candidates (it returns a CT sample).	Sweep subdomains for dangling CNAMEs pointing at deprovisioned cloud services an attacker could claim (subdomain takeover); detects 16 provider families such as AWS S3/CloudFront, Azure, GCP Storage, Heroku, GitHub Pages, Vercel and Firebase. Use when asked if subdomains point to deprovisioned services. Pair with discover_subdomains to widen candidates (it returns a CT sample).	No	Yes	Yes	Yes
`check_svcb_https`Validate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit.	Validate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_tlsrpt`Check whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its reporting destination (rua= mailto:/https:), flagging a missing record, duplicate records, or an invalid/absent reporting URI. Complements MTA-STS by giving visibility into TLS delivery failures. Part of the scan_domain audit.	Check whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its reporting destination (rua= mailto:/https:), flagging a missing record, duplicate records, or an invalid/absent reporting URI. Complements MTA-STS by giving visibility into TLS delivery failures. Part of the scan_domain audit.	No	Yes	Yes	Yes
`check_txt_hygiene`Audit TXT records for stale entries and SaaS exposure.	Audit TXT records for stale entries and SaaS exposure.	No	Yes	Yes	Yes
`check_zone_hygiene`Audit DNS zone hygiene: identifies sensitive or forgotten subdomains exposed in DNS, stale SOA records, and zone propagation issues. Use to find any sensitive subdomains that should not be publicly visible, or to audit overall DNS zone cleanliness.	Audit DNS zone hygiene: identifies sensitive or forgotten subdomains exposed in DNS, stale SOA records, and zone propagation issues. Use to find any sensitive subdomains that should not be publicly visible, or to audit overall DNS zone cleanliness.	No	Yes	Yes	Yes
`compare_baseline`Compare a domain's current security configuration against a fixed policy baseline to determine compliance. Use to check whether a domain meets a policy requirement — not for tracking improvement/regression over time (use analyze_drift) and not for comparing multiple domains (use compare_domains).	Compare a domain's current security configuration against a fixed policy baseline to determine compliance. Use to check whether a domain meets a policy requirement — not for tracking improvement/regression over time (use analyze_drift) and not for comparing multiple domains (use compare_domains).	No	Yes	Yes	Yes
`compare_domains`Side-by-side security comparison of 2–5 domains. Shows relative scores, category gaps, and unique weaknesses for each domain. Use when comparing your security posture against a competitor, or doing a head-to-head comparison between multiple domains.	Side-by-side security comparison of 2–5 domains. Shows relative scores, category gaps, and unique weaknesses for each domain. Use when comparing your security posture against a competitor, or doing a head-to-head comparison between multiple domains.	No	Yes	Yes	Yes
`cymru_asn`Map domain IPs to Autonomous System Numbers via Team Cymru DNS. Returns ASN, prefix, country, registry, and organization for each IP. Flags high-risk hosting ASNs.	Map domain IPs to Autonomous System Numbers via Team Cymru DNS. Returns ASN, prefix, country, registry, and organization for each IP. Flags high-risk hosting ASNs.	No	Yes	Yes	Yes
`delete_brand_audit_watch`Permanently removes a recurring brand-audit watch by watchId. Owner-scoped — a watchId owned by another principal surfaces as notFound. Returns confirmation of deletion.	Permanently removes a recurring brand-audit watch by watchId. Owner-scoped — a watchId owned by another principal surfaces as notFound. Returns confirmation of deletion.	Yes	No	Yes	No
`discover_brand_domains`Discover all domains that belong to a brand's portfolio by aggregating certificate, DNS, redirect, and mail-policy signals. Use when asked what domains are part of a brand portfolio, or to find all domains related to a brand. Pass the EXACT seed domain verbatim — do NOT normalize or substitute a canonical domain.	Discover all domains that belong to a brand's portfolio by aggregating certificate, DNS, redirect, and mail-policy signals. Use when asked what domains are part of a brand portfolio, or to find all domains related to a brand. Pass the EXACT seed domain verbatim — do NOT normalize or substitute a canonical domain.	No	Yes	Yes	Yes
`discover_brand_domains_findings`Fetch the ranked candidate domains (the discovery CheckResult) for an async run started with discover_brand_domains_start. Returns notReady while the discovery is still in-flight; the discovery result once complete. Owner-scoped.	Fetch the ranked candidate domains (the discovery CheckResult) for an async run started with discover_brand_domains_start. Returns notReady while the discovery is still in-flight; the discovery result once complete. Owner-scoped.	No	Yes	Yes	No
`discover_brand_domains_start`Start an async brand-domain discovery for the EXACT seed domain provided (the async sibling of discover_brand_domains, which can run ~24s and time out interactive clients). Same args as discover_brand_domains. Returns { auditId, queuedAt, etaSeconds } immediately; poll with discover_brand_domains_status and fetch ranked candidates with discover_brand_domains_findings once complete.	Start an async brand-domain discovery for the EXACT seed domain provided (the async sibling of discover_brand_domains, which can run ~24s and time out interactive clients). Same args as discover_brand_domains. Returns { auditId, queuedAt, etaSeconds } immediately; poll with discover_brand_domains_status and fetch ranked candidates with discover_brand_domains_findings once complete.	No	No	No	Yes
`discover_brand_domains_status`Poll the status of an async brand-domain discovery started with discover_brand_domains_start. Returns status (queued \| running \| completed \| failed) and progress. Owner-scoped — operationIds owned by other principals surface as notFound.	Poll the status of an async brand-domain discovery started with discover_brand_domains_start. Returns status (queued \| running \| completed \| failed) and progress. Owner-scoped — operationIds owned by other principals surface as notFound.	No	Yes	Yes	No
`discover_subdomains`Find subdomains via Certificate Transparency logs to reveal shadow IT and forgotten services. Returns a CT SAMPLE, not an asset inventory: counts are a lower bound, hosts without a logged certificate never appear, and a per-source `coverage` record states what was consulted. `countBasis` marks totalSubdomains as `sample` or a cut-recall `floor`; `concreteSubdomains` excludes wildcards.	Find subdomains via Certificate Transparency logs to reveal shadow IT and forgotten services. Returns a CT SAMPLE, not an asset inventory: counts are a lower bound, hosts without a logged certificate never appear, and a per-source `coverage` record states what was consulted. `countBasis` marks totalSubdomains as `sample` or a cut-recall `floor`; `concreteSubdomains` excludes wildcards.	No	Yes	Yes	Yes
`explain_finding`Explain a finding with impact and remediation.	Explain a finding with impact and remediation.	No	Yes	Yes	No
`generate`Generate a DNS/email security remediation artifact. Artifact types: spf_record (build a new SPF record), dmarc_record (create a DMARC policy), dkim_config (DKIM key setup), mta_sts_policy (generate an MTA-STS policy file), fix_plan (prioritized remediation plan for all findings), or rollout_plan (phased DMARC enforcement timeline). Use when asked to generate or create a record or policy.	Generate a DNS/email security remediation artifact. Artifact types: spf_record (build a new SPF record), dmarc_record (create a DMARC policy), dkim_config (DKIM key setup), mta_sts_policy (generate an MTA-STS policy file), fix_plan (prioritized remediation plan for all findings), or rollout_plan (phased DMARC enforcement timeline). Use when asked to generate or create a record or policy.	No	Yes	Yes	Yes
`get_access_context`Read the effective authentication context for this request: tier, owner-IP-gate disposition, a keyed pseudonymous principal reference, server version and observation time. Performs no target checks or quota/session/cache/job writes. An unavailable result is not anonymous/free fallback.	Read the effective authentication context for this request: tier, owner-IP-gate disposition, a keyed pseudonymous principal reference, server version and observation time. Performs no target checks or quota/session/cache/job writes. An unavailable result is not anonymous/free fallback.	No	Yes	Yes	No
`get_benchmark`Get industry benchmark data: shows what percentile a domain's security score ranks at within its sector or country cohort, the mean score, and the most common DNS security failures across the industry. Use when asked how a score compares to the industry average, what percentile a score is in, or what the most common security failures are in an industry or sector.	Get industry benchmark data: shows what percentile a domain's security score ranks at within its sector or country cohort, the mean score, and the most common DNS security failures across the industry. Use when asked how a score compares to the industry average, what percentile a score is in, or what the most common security failures are in an industry or sector.	No	Yes	Yes	No
`get_domain_rank`Rank a domain against its country or global cohort using the GSI benchmark corpus. Accepts a domain score (from scan_domain) and optional country/sector; returns a percentile: "scores better than X% of peers". Owner-gate exempt — public cohort data only.	Rank a domain against its country or global cohort using the GSI benchmark corpus. Accepts a domain score (from scan_domain) and optional country/sector; returns a percentile: "scores better than X% of peers". Owner-gate exempt — public cohort data only.	No	Yes	Yes	No
`get_provider_insights`Get security benchmarks and common configuration issues for a specific email or DNS service-provider cohort (e.g. Google Workspace customers, Microsoft 365 customers). Use when asked how an email service provider compares to competitors on security posture, or to see typical misconfigurations for a named vendor's customers.	Get security benchmarks and common configuration issues for a specific email or DNS service-provider cohort (e.g. Google Workspace customers, Microsoft 365 customers). Use when asked how an email service provider compares to competitors on security posture, or to see typical misconfigurations for a named vendor's customers.	No	Yes	Yes	No
`list_brand_audit_watches`Returns the caller's recurring brand-audit watches: watchId, domain, interval, webhook presence, last-run time, and active state. Owner-scoped. Read-only.	Returns the caller's recurring brand-audit watches: watchId, domain, interval, webhook presence, last-run time, and active state. Owner-scoped. Read-only.	No	Yes	Yes	No
`map_compliance`Map scan findings to compliance frameworks: NIST 800-177, PCI DSS 4.0, SOC 2, CIS Controls. Shows pass/fail/partial status per control.	Map scan findings to compliance frameworks: NIST 800-177, PCI DSS 4.0, SOC 2, CIS Controls. Shows pass/fail/partial status per control.	No	Yes	Yes	Yes
`map_supply_chain`Map DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to reveal which third-party vendors can send email as the domain, control DNS, or access integrated services. Use when asked to map third-party or supply-chain dependencies — not for listing who can send email (use check_spf for that).	Map DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to reveal which third-party vendors can send email as the domain, control DNS, or access integrated services. Use when asked to map third-party or supply-chain dependencies — not for listing who can send email (use check_spf for that).	No	Yes	Yes	Yes
`osint_investigate_domain_start`Start an async OSINT investigation for a domain. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.	Start an async OSINT investigation for a domain. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.	No	No	No	Yes
`osint_investigate_email_start`Start an async OSINT investigation for an email address (breach exposure, account correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.	Start an async OSINT investigation for an email address (breach exposure, account correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.	No	No	No	Yes
`osint_investigate_infrastructure_start`Start an async deep-infrastructure OSINT investigation for a query (domain, IP, or org). Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.	Start an async deep-infrastructure OSINT investigation for a query (domain, IP, or org). Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.	No	No	No	Yes
`osint_investigate_supply_chain_start`Start an async supply-chain OSINT investigation for a query. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.	Start an async supply-chain OSINT investigation for a query. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns an investigationId immediately — poll with osint_investigation_status.	No	No	No	Yes
`osint_investigate_username_start`Start an async OSINT investigation for a username (cross-platform presence, breach correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.	Start an async OSINT investigation for a username (cross-platform presence, breach correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.	No	No	No	Yes
`osint_investigation_report`Retrieve the final report of a completed OSINT investigation by investigationId. For a deep_infrastructure investigation the report also composes discover_subdomains for the target (a cached CT sample under `ctDiscovery`, never an inventory). Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned or not yet complete.	Retrieve the final report of a completed OSINT investigation by investigationId. For a deep_infrastructure investigation the report also composes discover_subdomains for the target (a cached CT sample under `ctDiscovery`, never an inventory). Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned or not yet complete.	No	Yes	Yes	Yes
`osint_investigation_status`Poll the status of an OSINT investigation by investigationId. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns current status (running \| completed \| failed) and progress metadata.	Poll the status of an OSINT investigation by investigationId. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns current status (running \| completed \| failed) and progress metadata.	No	Yes	Yes	No
`prioritize_portfolio_leads`Rank a brand’s portfolio (or an explicit domain set) into prioritized registrar-partner sales leads by product-gap value × severity. Multi-domain, paid. Reuses map_registrar_products per domain, then ranks. Distinct from map_registrar_products (per-domain product mapping) and batch_scan (raw scores).	Rank a brand’s portfolio (or an explicit domain set) into prioritized registrar-partner sales leads by product-gap value × severity. Multi-domain, paid. Reuses map_registrar_products per domain, then ranks. Distinct from map_registrar_products (per-domain product mapping) and batch_scan (raw scores).	No	Yes	Yes	Yes
`rdap_lookup`Fetch domain registration data via RDAP (modern WHOIS replacement). Returns the domain registrar (the company the domain was registered with), registrant contact, creation/expiration dates, EPP status codes, and domain age. Use when asked who registered the domain, who the registrar is, or when the registration expires — distinct from check_ns which identifies the DNS nameserver provider.	Fetch domain registration data via RDAP (modern WHOIS replacement). Returns the domain registrar (the company the domain was registered with), registrant contact, creation/expiration dates, EPP status codes, and domain age. Use when asked who registered the domain, who the registrar is, or when the registration expires — distinct from check_ns which identifies the DNS nameserver provider.	No	Yes	Yes	Yes
`register_brand_audit_watch`Creates a recurring brand-audit watch for a domain on a daily/weekly/monthly cadence. Each run enqueues a fresh brand_audit_batch_start and (when a webhook is configured) POSTs a diff webhook on classification drift. Returns the new watchId. Owner-scoped; per-principal cap of 20 active watches.	Creates a recurring brand-audit watch for a domain on a daily/weekly/monthly cadence. Each run enqueues a fresh brand_audit_batch_start and (when a webhook is configured) POSTs a diff webhook on classification drift. Returns the new watchId. Owner-scoped; per-principal cap of 20 active watches.	No	No	No	Yes
`resolve_spf_chain`Trace the full SPF include chain for a domain. Recursively resolves all includes, shows lookup count, tree depth, and flags circular includes or exceeding the 10-lookup limit.	Trace the full SPF include chain for a domain. Recursively resolves all includes, shows lookup count, tree depth, and flags circular includes or exceeding the 10-lookup limit.	No	Yes	Yes	Yes
`scan_buckets_findings`Retrieve findings from a completed cloud-bucket discovery scan by scanId. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. The scanId is required so reads can be owner-scoped; target and provider filters are optional.	Retrieve findings from a completed cloud-bucket discovery scan by scanId. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. The scanId is required so reads can be owner-scoped; target and provider filters are optional.	No	Yes	Yes	No
`scan_buckets_start`Start an async cloud-bucket discovery scan for a target domain. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns a scanId immediately — poll progress with scan_buckets_status and retrieve results with scan_buckets_findings.	Start an async cloud-bucket discovery scan for a target domain. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns a scanId immediately — poll progress with scan_buckets_status and retrieve results with scan_buckets_findings.	No	No	No	Yes
`scan_buckets_status`Poll the status of a cloud-bucket discovery scan by scanId. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns scan status (running \| completed \| failed) and progress metadata.	Poll the status of a cloud-bucket discovery scan by scanId. Operator-deploy only; targets must be operator-authorized on the recon watchlist; degrades to info when unprovisioned. Returns scan status (running \| completed \| failed) and progress metadata.	No	Yes	Yes	No
`scan_domain`Run a full DNS and email security audit for one domain across every scan-included check (SPF, DKIM, DMARC, DNSSEC and more); returns an overall score, NIST-aligned letter grade (A+ to F), maturity stage and prioritized findings. Use for a comprehensive audit, overall grade or email security maturity level. Cite scoringConfigHash with a score; model and engine versions are not comparable.	Run a full DNS and email security audit for one domain across every scan-included check (SPF, DKIM, DMARC, DNSSEC and more); returns an overall score, NIST-aligned letter grade (A+ to F), maturity stage and prioritized findings. Use for a comprehensive audit, overall grade or email security maturity level. Cite scoringConfigHash with a score; model and engine versions are not comparable.	No	Yes	Yes	Yes
`sge_quickscan`Check whether ONE domain meets the New Zealand Secure Government Email (SGE) requirements due October 2026. Reports seven controls (DMARC p=reject, SPF -all, DKIM, SMTP transport TLS, MTA-STS enforce, TLS-RPT, sub-domain coverage) as satisfied, not satisfied or NOT MEASURED, with evidence. A DNS-only result tops out at INDETERMINATE, which is not a pass. Not map_compliance (NIST/PCI/SOC 2/CIS).	Check whether ONE domain meets the New Zealand Secure Government Email (SGE) requirements due October 2026. Reports seven controls (DMARC p=reject, SPF -all, DKIM, SMTP transport TLS, MTA-STS enforce, TLS-RPT, sub-domain coverage) as satisfied, not satisfied or NOT MEASURED, with evidence. A DNS-only result tops out at INDETERMINATE, which is not a pass. Not map_compliance (NIST/PCI/SOC 2/CIS).	No	Yes	Yes	Yes
`simulate_attack_paths`Analyze current DNS posture and enumerate specific attack paths an adversary could exploit, with severity, feasibility, steps, and mitigations.	Analyze current DNS posture and enumerate specific attack paths an adversary could exploit, with severity, feasibility, steps, and mitigations.	No	Yes	Yes	Yes
`validate_fix`Re-check a specific security control after applying a fix, to confirm the finding is now resolved. Use only when a fix has already been applied and you want to verify or confirm the remediation was successful — not for initial inspection of a record.	Re-check a specific security control after applying a fix, to confirm the finding is now resolved. Use only when a fix has already been applied and you want to verify or confirm the remediation was successful — not for initial inspection of a record.	No	Yes	Yes	Yes

Details

Registry status: Active
Published: Nov 14, 2026
Updated: Nov 14, 2026
Website: https://www.blackveilsecurity.com/dns⁠ (opens in a new tab)
Repository: https://github.com/MadaBurns/bv-mcp⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing