IntoDNS.ai DNS & Email Security Scanner

{
  "id": "aix_14547befff",
  "name": "IntoDNS.ai DNS & Email Security Scanner",
  "operator": "(unclaimed - source: registry-official · publisher: ai.intodns)",
  "description": "DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.",
  "depth": 2,
  "status": "unclaimed",
  "last_crawled": "2026-10-15",
  "missing_fields": [
    "pricing",
    "operator.identity"
  ],
  "skills": [
    "api-integration",
    "browser-automation",
    "cache-store",
    "citation-check",
    "cloud-ops",
    "gdpr-screen",
    "github-ops",
    "pdf-to-json",
    "vulnerability-scan"
  ],
  "protocols": {
    "mcp": "https://intodns.ai/api/mcp",
    "a2a": null
  },
  "pricing": null,
  "regions": [
    "global"
  ],
  "languages": [
    "en"
  ],
  "reputation": {
    "tasks_completed": null,
    "dispute_rate": null,
    "p95_latency_ms": 2425,
    "uptime_30d": 1,
    "onchain_volume_30d_usd": null
  },
  "aix_score": 45,
  "verification": {
    "identity": "none",
    "health": "probe/24h",
    "pricing": "unknown",
    "last_check": "2026-10-15T16:01:01.010Z"
  },
  "pricing_model": "unknown",
  "links": [
    {
      "label": "homepage",
      "url": "https://intodns.ai/mcp"
    },
    {
      "label": "repository",
      "url": "https://github.com/RoscoNL/intodns-mcp-server"
    }
  ],
  "avatar": "https://github.com/RoscoNL.png?size=160",
  "socials": [
    {
      "label": "github",
      "url": "https://github.com/RoscoNL"
    }
  ],
  "unreachable": false,
  "profile": {
    "mcp_server": "intodns",
    "mcp_version": "1.10.3",
    "tool_count": 45,
    "tools": [
      {
        "name": "scan_domain",
        "description": "Run the fast IntoDNS.ai DNS and email security scan (~3-8s). Returns a letter grade A+ to F, numeric score 0-100, structured issue list, prioritised recommendations, full DNS/email/web/security result sections, and canonical citation URLs. Read-only — no domain mutation, no destructive side effects. The default tool for agent-visible scan evidence; use get_everything_report for a deeper single-shot report including web/blacklist/sender data, or start_deep_scan for slower Internet.nl-grade analysis. After running, use explain_issue or generate_dns_fix on any returned issue. No auth."
      },
      {
        "name": "nis2_quickscan",
        "description": "Compute a NIS2 Article 21.2 readiness score for a domain by mapping the IntoDNS quickscan onto the ten NIS2 measures. Returns a 0-100 weighted total, per-measure status (Article 21.2 a-j), evidence rows, critical gaps, and concrete fix suggestions. The score reflects only the DNS and email layer of NIS2 — full NIS2 compliance also requires audit of web applications, supply chain, organisational processes, and training. Use when the user asks about NIS2 compliance, NIS2 readiness, NIS2 Article 21.2, cyber-hygiene compliance, or related EU-NIS regulation checks for a domain."
      },
      {
        "name": "get_everything_report",
        "description": "Generate the complete live IntoDNS.ai report covering DNS, email authentication, web/HTTPS, blacklist reputation, sender requirements, and canonical citation URLs in a single call. Read-only, no domain mutation. ~5-15s latency depending on backend cache state. Use when the user asks for everything, the full picture, or a deep current-state summary; use scan_domain for a faster default scan, or create_report_snapshot when the result must remain immutable for audit/ticket use. No auth, no side effects."
      },
      {
        "name": "create_report_snapshot",
        "description": "Create an immutable evidence snapshot of the current Everything Report for a domain. Returns a snapshot ID, ISO timestamp, SHA-256 content hash, and stable bookmarkable URLs for both JSON and Markdown renderings of the report. Snapshots are write-once and resolve to the same evidence months/years later — useful for tickets, audit trails, NIS2/ISO compliance evidence, and LLM citations that should not drift. A canonical POST creates one snapshot per call (additive and not idempotent); use get_report_snapshot to read it back. Use this instead of get_everything_report when the result must remain "
      },
      {
        "name": "get_report_snapshot",
        "description": "Read a previously created IntoDNS.ai Everything Report evidence snapshot by snapshot ID. Read-only GET — returns the immutable JSON report exactly as it was at snapshot creation, with the original SHA-256 content hash and timestamp. Requires `snapshotId` from create_report_snapshot. Use to verify or re-read an audit-trail evidence record without re-running a live scan; use get_everything_report for current live data instead. No auth, fully idempotent."
      },
      {
        "name": "start_deep_scan",
        "description": "Start a long-running Internet.nl deep scan (typically 30-120s). Returns a `scanId` immediately; poll get_deep_scan_status until status='finished'. Read-only — no domain mutation. Internet.nl runs an exhaustive standards-compliance audit (IPv6, DNSSEC, modern TLS, RPKI, mail authentication) used by EU governments. Use when scan_domain output is not strict enough for compliance reporting, or when the user asks for an Internet.nl-grade audit. For sub-10s answers, use scan_domain. To abort an in-progress scan, call cancel_deep_scan. No auth."
      },
      {
        "name": "get_deep_scan_status",
        "description": "Read-only status poll for a long-running Internet.nl deep scan. Returns scan progress (pending/running/finished), category scores, per-test results, and any failures. Requires a scanId returned by start_deep_scan; poll every 10-30s until status='finished'. Use after start_deep_scan; for fast single-vantage scans, prefer scan_domain. No auth, no side effects."
      },
      {
        "name": "cancel_deep_scan",
        "description": "Cancel an in-progress Internet.nl deep scan. Marks the scan cancelled; the polling loop then withdraws the upstream Internet.nl batch, usually within ten seconds. Requires `scanId` returned by start_deep_scan. Nothing is deleted: a scan that already finished keeps its results and is left alone, so calling this twice is safe. An unknown or expired scanId returns 404. Use when the user changes their mind mid-scan or when polling get_deep_scan_status would otherwise time out. No auth."
      },
      {
        "name": "lookup_dns",
        "description": "Read-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC chain validation, or check_dns_propagation for multi-resolver consensus. No auth, no rate limits beyond upstream resolver."
      },
      {
        "name": "validate_dnssec",
        "description": "Read-only DNSSEC chain validation. Walks the DS/DNSKEY chain from root, checks signatures, algorithm strength, key rollover state, and reports any broken links or unsigned zones. Returns chain steps, algorithm grades, and a boolean `valid`. Use when a domain claims DNSSEC; use lookup_dns(type='DNSKEY') for raw key data only. Single HTTP GET, no auth, no destructive actions."
      },
      {
        "name": "check_dns_propagation",
        "description": "Compare DNS responses across the nine currently configured public and authoritative resolvers to detect propagation lag, missing answers, or differing record sets. Each resolver's answer is compared as a whole RRset (order, case of names and trailing dots ignored; TXT case kept; TTLs ignored, as caches count them down). Defaults to record type A and region 'all'. Returns every resolver response, how many resolvers were queried, answered and failed, and `percentage` = share of the answering resolvers that agree on the most common answer; that is agreement, not coverage, and a failed resolver wa"
      },
      {
        "name": "check_tlsa_dane",
        "description": "Read-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practice advisories. It does not fetch or cryptographically match the live service certificate, so pair it with check_smtp_tls for SMTP certificate evidence. Use before publishing DANE records or troubleshooting DANE handover. No auth or destructive actions."
      },
      {
        "name": "check_spf",
        "description": "Read-only SPF parse and validation for a domain. Recursively walks include/redirect mechanisms to build the full lookup graph, counts DNS lookups against the RFC-7208 10-lookup limit, and returns flattening guidance when the count is close to or over the limit. Returns parsed mechanisms, lookup graph, total count, qualifier (~all / -all / +all), and warnings. Use for SPF auditing or before adding new include: senders; use check_email_security for the broader SPF+DKIM+DMARC overview. No auth, no side effects."
      },
      {
        "name": "flatten_spf",
        "description": "Read-only SPF flattening for a domain. Resolves the full include/a/mx/redirect graph to literal ip4/ip6 addresses and returns a single flattened SPF record that fits under the RFC-7208 10-lookup limit, plus lookup counts before/after, IP count, record length, whether it must be split across multiple records, and a maintenance warning. Use when a domain hits 'too many DNS lookups' (PermError) and removing unused includes is not enough; run check_spf first to see the lookup graph and whether flattening is actually needed. Flattened records are high-maintenance — they break when a provider rotate"
      },
      {
        "name": "discover_dkim",
        "description": "Read-only DKIM check for a domain. Without `selector`, heuristically queries 50 common selectors and explicitly reports that a miss is inconclusive because DKIM has no enumeration protocol. With `selector`, performs one authoritative exact lookup for a selector obtained from a DKIM-Signature header or mail provider. Returns discovery method, coverage note, parsed key tags, public-key strength, and warnings. Use exact mode whenever the selector is known; use check_email_security for the broader SPF/DKIM/DMARC overview. No auth or destructive actions."
      },
      {
        "name": "check_dmarc",
        "description": "Read-only fetch and parse of the _dmarc TXT record. Returns parsed tag map (p, sp, rua, ruf, adkim, aspf, pct, fo), policy strength assessment, alignment mode, and warnings (missing rua, p=none, weak alignment, multiple records). Use for DMARC policy review; use check_sender_requirements for combined Google/Yahoo SPF+DKIM+DMARC pass/fail verdict. Single GET, no auth, no side effects."
      },
      {
        "name": "check_bimi",
        "description": "Read-only BIMI readiness check. Parses the `default._bimi` TXT record, safely fetches the referenced HTTPS SVG, and parses basic metadata from an optional VMC/CMC authority certificate. Returns record syntax, URL reachability/content type, certificate subject/issuer/validity dates, and explicit issues. It does not certify SVG Tiny PS profile compliance, validate the full mark-certificate trust chain, verify trademark ownership, or guarantee logo display by any mailbox provider. Use for a technical preflight before a formal BIMI/VMC review. No auth or destructive actions."
      },
      {
        "name": "check_mta_sts",
        "description": "Read-only check of MTA-STS: TXT record at _mta-sts.<domain> plus the HTTPS policy file at mta-sts.<domain>/.well-known/mta-sts.txt. Returns parsed policy (mode: enforce/testing/none, mx allowlist, max_age), TLS certificate validity for the policy host, and consistency warnings between DNS and HTTPS. Use to verify enforced TLS for inbound mail; pair with check_smtp_tls for live STARTTLS validation. No auth, DNS + HTTPS GET only."
      },
      {
        "name": "check_smtp_tls",
        "description": "Live check of the first 4 MX hosts in priority order (hosts beyond 4 are not tested): opens TCP 25, runs EHLO + STARTTLS, validates TLS certificate trust chain, hostname match, expiry window, advertised EHLO capabilities, plus PTR and forward-confirmed reverse DNS. Read-only — connects and quits without sending mail. Returns per-MX TLS protocol version, certificate subject/issuer/SANs/validity/SHA-256 fingerprint, expiry days, and FCrDNS details. Use to verify inbound mail TLS posture; pair with check_mta_sts for the policy layer. May be slower (10-30s) due to live SMTP handshakes. Measured fr"
      },
      {
        "name": "check_fcrdns",
        "description": "Read-only FCrDNS (Forward-Confirmed Reverse DNS) audit for every IP that backs the domain's MX records. For each IP: looks up PTR record, then resolves that PTR's hostname back to A/AAAA records to confirm the round-trip. Returns per-IP PTR value, forward-resolution result, match verdict, and warnings (missing PTR, mismatched forward, generic ISP reverse). Use for mail deliverability audits, SpamExperts-style cluster checks, and any 'why is our mail being rejected' debugging; pair with check_blacklist for reputation signals. No auth."
      },
      {
        "name": "check_blacklist",
        "description": "Read-only query against the configured public DNSBL/RBL providers; the response lists which ones answered, which could not be measured and which are disabled. Provide either `domain` to resolve and inspect its MX IPv4 addresses or an IPv4 `ip` for a direct check; at least one is required. Returns each provider's listed/clean result, severity, removal metadata, plus unavailable and disabled provider evidence. A provider error code (e.g. Spamhaus 127.255.255.x when the query is refused), a timeout, or a list that does not answer its RFC 5782 test entry is listed under unavailableProviders: that "
      },
      {
        "name": "check_sender_requirements",
        "description": "Read-only domain-side preflight against Google/Yahoo bulk-sender requirements. Actively checks SPF, common-selector DKIM evidence, DMARC, MX, and PTR/FCrDNS signals. TLS use, one-click unsubscribe, complaint rate, and From-header behavior require a real sent message/provider telemetry and are returned as informational follow-up items, not false passes. Returns per-requirement pass/fail/warning/info plus an explicitly limited readiness summary. Use before a campaign; use analyze_raw_email or create_email_test to verify message-level requirements. Single GET, no auth."
      },
      {
        "name": "check_email_security",
        "description": "Read-only combined email-security check covering SPF parse, DKIM selector discovery, DMARC policy validation, MX IP blacklist status across major feeds, and an aggregated 0-100 email-security score with prioritised issue list. Single call replaces sequential check_spf + discover_dkim + check_dmarc + check_blacklist for the typical case. Use for one-shot email security overview; use check_sender_requirements specifically for Google/Yahoo bulk-sender compliance, or the individual check_* tools when you need only one signal. No auth, ~3-8s."
      },
      {
        "name": "create_email_test",
        "description": "Create a new IntoDNS.ai inbound email-test session. Returns a unique single-use test email address (valid 60 minutes) and a `testId` used by get_email_test or poll_email_test. This is an additive, non-idempotent POST: every call creates a fresh session but never modifies prior sessions. `language` controls result text (en/nl/de/fr, default en). Use to debug an outbound message's SPF/DKIM/DMARC, headers, and spam triggers; after sending, call poll_email_test. No auth."
      },
      {
        "name": "get_email_test",
        "description": "Read-only status read for an email-test session. Returns 'pending' until a test email arrives at the unique address returned by create_email_test, then full SPF/DKIM/DMARC/headers/spam-score result once processed. Requires `testId` from create_email_test. Use after sending a test message to that address; for explicit processing of just-arrived mail use poll_email_test instead. Idempotent GET, no auth."
      }
    ],
    "profiled_at": "2026-10-15T16:01:01.010Z"
  }
}