# IntoDNS > Diagnose a domain before and after you change it — DNS, DNSSEC, SPF, DKIM, DMARC, TLS — with no API key. [Canonical HTML page](https://top-mcps.com/mcp/intodns) · [server.json](https://top-mcps.com/mcp/intodns.json) · [methodology](https://top-mcps.com/about/methodology) ## Install ### Claude Desktop — `claude_desktop_config.json` Paste under mcpServers. Fully quit and reopen Claude after editing. ```json { "mcpServers": { "intodns": { "command": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } } ``` ### Claude Code — `CLI or .mcp.json` Run from your repo. Commit .mcp.json to share with your team. ```shell claude mcp add intodns -- npx -y intodns-mcp@latest ``` ### Cursor — `.cursor/mcp.json` Global path: ~/.cursor/mcp.json. Reload window after editing. ```json { "mcpServers": { "intodns": { "command": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } } ``` ### VS Code — `.vscode/mcp.json` VS Code uses the "servers" key (not "mcpServers"). ```jsonc { "servers": { "intodns": { "command": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } } ``` ### Windsurf — `~/.codeium/windsurf/mcp_config.json` Open via Cascade → hammer icon → Configure. ```json { "mcpServers": { "intodns": { "command": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } } ``` ### Cline — `cline_mcp_settings.json` Open via the Cline sidebar → MCP Servers → Edit. ```json { "mcpServers": { "intodns": { "command": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } } ``` ### Continue — `~/.continue/config.json` Continue uses modelContextProtocolServers with a transport block. ```json { "experimental": { "modelContextProtocolServers": [ { "transport": { "type": "stdio", "command": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } ] } } ``` ### Codex CLI — `~/.codex/config.toml` Codex uses TOML. Each server is a [mcp_servers.] subtable. ```shell # ~/.codex/config.toml [mcp_servers.intodns] command = "npx" args = [ "-y", "intodns-mcp@latest", ] ``` ### Zed — `~/.config/zed/settings.json` Zed calls them "context_servers". Settings live-reload on save. ```jsonc { "context_servers": { "intodns": { "command": { "path": "npx", "args": [ "-y", "intodns-mcp@latest" ] } } } } ``` ### ChatGPT — `ChatGPT → Settings → Connectors (remote URL)` Paste this into Settings → Connectors → Add custom connector. Requires ChatGPT Pro / Team / Enterprise / Edu with Developer mode enabled. ChatGPT supports remote HTTPS MCP servers only — stdio servers must be hosted on a public HTTPS endpoint first. ```json { "name": "IntoDNS", "transport": "http", "url": "https://intodns.ai/api/mcp" } ``` ## At a glance - **Maintainer:** IntoDNS.ai - **Transport:** stdio, Streamable HTTP - **Auth model:** None - **Required secrets:** None - **Supported clients:** Claude, Cursor, VS Code, Windsurf, Any MCP-compatible client - **License:** MIT - **Language:** TypeScript - **Latest version:** latest - **Last verified:** 2026-09-17 - **GitHub stars:** 2 (fetched 2026-10-15T10:09:13.488Z) - **Score:** 66/100 (rubric 2026-09 — see https://top-mcps.com/about/methodology) - **Source:** https://github.com/RoscoNL/intodns-mcp-server - **Homepage:** https://intodns.ai/ ## Tools & permissions Showing 12 of 45 tools the server reported on `tools/list`. The rest exist and are not listed here. | Tool | Description | Args | Side effects | |------|-------------|------|--------------| | `scan_domain` | Fast DNS and email-security scan returning a letter grade and structured issues. | `—` | network | | `lookup_dns` | DNS record lookup over DNS-over-HTTPS for one or many record types. | `—` | network | | `check_dns_propagation` | Compare answers across nine resolvers to detect propagation lag. | `—` | network | | `validate_dnssec` | Walk the DS/DNSKEY chain from root and check signatures and algorithm strength. | `—` | network | | `check_spf` | Parse SPF recursively and count the include/redirect lookup budget. | `—` | network | | `flatten_spf` | Resolve an SPF graph to literal ip4/ip6 addresses. | `—` | network | | `discover_dkim` | Probe common DKIM selectors and report which resolve. | `—` | network | | `check_dmarc` | Fetch and parse the _dmarc TXT record and rate policy strength. | `—` | network | | `check_smtp_tls` | Open TCP 25 on every MX, run EHLO + STARTTLS, and validate the certificate. | `—` | network | | `whois_lookup` | WHOIS/RDAP lookup returning registrar, EPP status codes and nameservers. | `—` | network | | `generate_dns_fix` | Return a copy-pasteable record that fixes one named issue. | `—` | read | | `generate_dmarc` | Build a DMARC record from a chosen policy and reporting addresses. | `—` | read | ## Security & scope - **Access scope:** read-only - **Sandbox:** Diagnostics only — no tool writes to a zone or a registrar account. - **Gotchas:** - Every tool sends the domain you ask about to the public intodns.ai API. Do not scan hostnames you consider confidential. - `check_smtp_tls` opens real TCP connections to the target's MX hosts. On a domain you do not own, that is an unsolicited connection. - The free public API is rate-limited; a bulk loop over a portfolio will be throttled. ## Quick answer **What it does.** Read-only diagnostics plus record generators: `scan_domain` (graded A+ to F), `lookup_dns`, `check_dns_propagation` across nine resolvers, `validate_dnssec`, `check_spf` / `flatten_spf`, `discover_dkim`, `check_dmarc`, `check_smtp_tls`, `whois_lookup`, and `generate_spf` / `generate_dmarc` / `generate_dns_fix` which return copy-pasteable records. **Best for:** - Verifying a DNS change actually propagated - SPF / DKIM / DMARC audits before a sending migration - DNSSEC chain validation - Generating a correct SPF or DMARC record - WHOIS/RDAP lookups with EPP status codes **Not for:** - Editing DNS (it writes nothing) - Bulk portfolio monitoring on a schedule - Air-gapped environments — every tool calls the public API ## Description IntoDNS.ai is a DNS and email-security scanner exposed as an MCP server with 45 tools and no signup. It answers the question every other server in this category leaves open: after the agent changed the zone, is the domain actually correct? Propagation across resolvers, DNSSEC chain validation, SPF lookup budgets, DKIM selector discovery, DMARC policy strength, MTA-STS, TLS on every MX, and blacklist status. ## Why it matters Registrar MCPs write records; nothing in them verifies the result, and an agent that re-reads its own change from one resolver five seconds later sees a cached answer and concludes success. This server is the check step — it queries multiple resolvers, walks the DNSSEC chain from root, and counts SPF lookups against the ten-lookup limit that silently breaks mail. ## Key features - 45 tools verified by probe, zero configuration - No API key and no signup for public diagnostics - Propagation comparison across nine resolvers - Generates fix records, not just findings - MIT, stdio plus a hosted endpoint ## FAQ ### Does it need an API key? No. The 45 public-diagnostic tools work with no signup — the server probes clean with an empty environment. The optional `INTODNS_*` variables only configure timeouts and HTTP-transport binding. ### Can it fix what it finds? It generates the record — `generate_spf`, `generate_dmarc`, `generate_dns_fix` return copy-pasteable text — but it cannot write to a zone. Pair it with Cloudflare, Porkbun or Hostinger for the write half. ### Why not just re-read the record I set? Because one resolver's cached answer is not propagation. `check_dns_propagation` queries nine resolvers and shows the disagreement, which is the failure mode an agent verifying its own change reliably misses. ## Changelog - **2026-09-17** — Refreshed install snippets and fact sheet; verified for 2026.