Domain Health

com.modernmustardseed/domain-healthVersion 1.0.0

Domain checks: SPF, DKIM, DMARC, BIMI, MTA-STS, SSL/TLS and HTTP security headers.

Status

Responds210 msNov 14, 2026, 14:09 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:09 UTC
Latency: 210 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.modernmustardseed.com/domain-healthResponds210 msNov 14, 2026, 14:09 UTC

No sign-in

Claude Code

claude mcp add --transport http domain-health https://mcp.modernmustardseed.com/domain-health

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: domain-health
Remote MCP server URL: https://mcp.modernmustardseed.com/domain-health

Cursor

{
  "mcpServers": {
    "domain-health": {
      "url": "https://mcp.modernmustardseed.com/domain-health"
    }
  }
}

VS Code

code --add-mcp '{"name":"domain-health","type":"http","url":"https://mcp.modernmustardseed.com/domain-health"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

5 tools

Tools of Domain Health
	Description		Read-only	Idempotent	Open world
`check_domain_registration`Read a domain's public registration record from its registry over RDAP (no WHOIS scraping): registrar, creation, expiry and last-change dates, status locks such as clientTransferProhibited, danger states such as redemption period or hold, and nameservers. Also compares the registry's nameservers with the live zone and checks DNSSEC. Subdomains are checked as their registered domain. Some country-code registries do not publish RDAP; the tool says so.	Read a domain's public registration record from its registry over RDAP (no WHOIS scraping): registrar, creation, expiry and last-change dates, status locks such as clientTransferProhibited, danger states such as redemption period or hold, and nameservers. Also compares the registry's nameservers with the live zone and checks DNSSEC. Subdomains are checked as their registered domain. Some country-code registries do not publish RDAP; the tool says so.	No	Yes	Yes	Yes
`check_email_auth`Explain in plain words whether email from a domain will reach the inbox and whether others can forge it. Checks MX, SPF with every include expanded and counted against the 10-lookup limit, DMARC policy, alignment and report permissions, DKIM keys at about 40 common selectors plus any you name (with key size), BIMI, MTA-STS and TLS-RPT, and the DNS rules Google, Yahoo and Microsoft set for bulk senders. Every finding has a severity, a one-sentence fix and the RFC or provider document behind it. Reads public DNS only.	Explain in plain words whether email from a domain will reach the inbox and whether others can forge it. Checks MX, SPF with every include expanded and counted against the 10-lookup limit, DMARC policy, alignment and report permissions, DKIM keys at about 40 common selectors plus any you name (with key size), BIMI, MTA-STS and TLS-RPT, and the DNS rules Google, Yahoo and Microsoft set for bulk senders. Every finding has a severity, a one-sentence fix and the RFC or provider document behind it. Reads public DNS only.	No	Yes	Yes	Yes
`check_security_headers`Read the HTTP security headers a domain's homepage sends, as a browser receives them, and grade each: Strict-Transport-Security, Content-Security-Policy, clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy, plus whether http:// redirects to https://, cookie flags, and software version disclosure. Only public web servers on ports 80 and 443 are contacted.	Read the HTTP security headers a domain's homepage sends, as a browser receives them, and grade each: Strict-Transport-Security, Content-Security-Policy, clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy, plus whether http:// redirects to https://, cookie flags, and software version disclosure. Only public web servers on ports 80 and 443 are contacted.	No	Yes	Yes	Yes
`check_ssl`Check the HTTPS certificate and TLS setup of a domain on port 443: issuer, expiry date and days left, whether the chain is complete and trusted, whether the certificate matches the name, key type and size, which TLS versions (1.0 to 1.3) the server accepts, and the CAA record that limits who may issue certificates. Checks www as well when given a bare domain. Every finding has a severity, a fix and a citation.	Check the HTTPS certificate and TLS setup of a domain on port 443: issuer, expiry date and days left, whether the chain is complete and trusted, whether the certificate matches the name, key type and size, which TLS versions (1.0 to 1.3) the server accepts, and the CAA record that limits who may issue certificates. Checks www as well when given a bare domain. Every finding has a severity, a fix and a citation.	No	Yes	Yes	Yes
`full_domain_report`Run every Domain Health check on one domain at once (email authentication, SSL and TLS, security headers, registration and DNSSEC) and answer three questions in plain words: will its email land, is its website safe, and is the domain owned well. Returns a score and grade per area, the top fixes across all areas, and every finding with its severity, fix and citation. Takes 5 to 20 seconds.	Run every Domain Health check on one domain at once (email authentication, SSL and TLS, security headers, registration and DNSSEC) and answer three questions in plain words: will its email land, is its website safe, and is the domain owned well. Returns a score and grade per area, the top fixes across all areas, and every finding with its severity, fix and citation. Takes 5 to 20 seconds.	No	Yes	Yes	Yes

Details

Registry status: Active
Published: Oct 11, 2026
Updated: Oct 11, 2026
Website: https://mcp.modernmustardseed.com/docs/domain-health⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing