Dns Intelligence

@guardbee/mcp-dns-intelligence

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

An MCP server that enumerates DNS records, detects SPF / DMARC / DKIM misconfigurations, and finds subdomains (Certificate Transparency + wordlist) that can be taken over. Uses Node.js's built-in dns/promises — no external dependencies.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

---

Features

• Full DNS Enumeration — A, AAAA, MX, NS, TXT, CNAME, SOA records
• SPF Analysis — +all, ?all, duplicate records, and the RFC 7208 limits counted the way receivers do: DNS lookups across nested include/redirect (max 10), void lookups (max 2), include loops and missing includes
• DMARC Analysis — policy (none/quarantine/reject), pct, missing rua address
• DKIM Check — probes 9 common selectors (default, google, selector1, mail, etc.)
• Subdomain Discovery — names from Certificate Transparency logs (crt.sh and Cert Spotter, queried in parallel; only the domain name is sent) plus a 75-name wordlist, with wildcard DNS filtered out; every live name is checked for subdomain takeover
• Email Security Summary — combined SPF + DMARC + DKIM analysis with copy-pasteable fix recommendations
• 23 Unit Tests — pure logic tests, no network connection required

---

Quick Start

npm install -g @guardbee/mcp-dns-intelligence

Add to claude_desktop_config.json:

{

"mcpServers": { "guardbee-dns-intelligence": { "command": "npx", "args": ["-y", "@guardbee/mcp-dns-intelligence"] } } }

---

MCP Tools

Example Usage

You can ask Claude:

"Is there a problem with example.com's DNS configuration?"

"Audit example.com's email security — SPF, DMARC, and DKIM"

"List example.com's subdomains, flag any dangling ones"

"What are example.com's MX records?"

Example Output

Email Security Check: example.com

──────────────────────────────────────────────────

── SPF ───────────────────────────────────────── ✓ v=spf1 include:_spf.google.com -all

── DMARC ─────────────────────────────────────── ✗ No DMARC record found at _dmarc.example.com Add: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

── DKIM ──────────────────────────────────────── ✓ Found DKIM selectors: google

---

SPF Findings

DMARC Findings

Subdomains without their own DMARC record inherit the parent domain's (sp= policy), as receivers do. Subdomain enumeration detects wildcard DNS and leaves out names answered only by the wildcard.

DKIM, MX and Transport Findings

SPF_MISSING is 🟠 High when the domain has MX records (with a starting record, e.g. v=spf1 include:_spf.google.com ~all for Google Workspace) and 🟡 Medium otherwise (suggests v=spf1 -all).

Nameserver Findings

Each nameserver of a zone is queried directly over DNS (UDP/TCP 53): an SOA query without recursion, an AXFR request (only the first messages are read — the zone is never downloaded), and a recursive query for a name it does not host. Skip with --no-ns-probe / nameserverProbe: false.

DNSSEC and CAA Findings

DNSSEC is read through DNS-over-HTTPS (dns.google), comparing a validating query with a cd=1 (checking disabled) one, because Node's resolver cannot see DS/DNSKEY records or the AD flag. CAA follows RFC 8659 (nearest ancestor), and the issuer of the certificate served on :443 is compared against it. Both checks are skipped with http: false.

Subdomain Takeover Detection

Each live subdomain with a CNAME is checked, following the CNAME chain (up to 5 hops). The wildcard record is checked too: a dangling *.domain makes every unlisted name claimable.

Each page fingerprint was checked against a random unclaimed name on the provider. Providers whose "not found" page no longer carries a stable marker are not listed. HTTP checks send one GET / to the subdomain (HTTPS, then HTTP); turn them off with --no-http / httpProbe: false. Use check_takeover / takeover for hostnames you already know.

---

CLI — CI/CD Integration

In addition to MCP server mode, this can also be used directly as a CLI:

# Full DNS + email security check

npx @guardbee/mcp-dns-intelligence check example.com

Fail only on high and above

npx @guardbee/mcp-dns-intelligence check example.com --fail-on=high

Subdomain scan — exits 1 if a dangling CNAME is found

npx @guardbee/mcp-dns-intelligence subdomains example.com

Subdomain scan with higher concurrency

npx @guardbee/mcp-dns-intelligence subdomains example.com --concurrency=50

JSON output

npx @guardbee/mcp-dns-intelligence check example.com --format=json

Several domains with an A–F grade each and a summary table (or every domain in guardbee.yml when none is given)

npx @guardbee/mcp-dns-intelligence check example.com example.de example.co.uk npx @guardbee/mcp-dns-intelligence check --format=sarif > dns.sarif

Grades: each finding deducts points (critical 40, high 20, medium 8, low 2) and the worst finding caps the grade — any critical is F, any high at most C, any medium at most B.

Exit codes: 0 = no issues · 1 = findings above threshold / dangling subdomain · 2 = error

Configuration via guardbee.y