IntoDNS.ai DNS & Email Security Scanner

Generate DMARC record

generate_dmarc

Read-onlyIdempotent

Build a DMARC record — the _dmarc TXT record that tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about it. The risk here is not syntax but policy. p=none monitors without affecting delivery and is where every deployment starts; p=quarantine sends failures to spam; p=reject refuses them outright, which silently destroys legitimate mail from any sender that was missed and gives that sender no explanation. Always publish a rua address: without aggregate reports there is no way to see which senders fail before enforcing against them. Use percentage to apply an enforcing policy to only part of the mail while rolling out. Returns the record, the host to publish it on (_dmarc), and warnings covering the mistakes that actually break mail — enforcing without reporting, reject at full coverage, pct at p=none, and strict alignment breaking subdomain senders and ESPs. Nothing is looked up or stored. A rua/ruf entry that is not a mailbox (name@example.com, optionally mailto: and a !size) or a pct outside 1-100 is refused with an error instead of a record.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "generate_dmarc"
  }
}

Input Schema

Name	Required	Description
`pct`	No	Alias for `percentage`, matching the DNS tag name.
`rua`	No	Aggregate report address(es). mailto: is added automatically.
`ruf`	No	Forensic report address(es). Contains message content and is honoured by very few receivers.
`policy`	No	p= — start at 'none' and only enforce once reports show all legitimate senders aligning. Defaults to none.
`percentage`	No	pct= — share of mail the policy applies to, for a gradual rollout. Has no effect at p=none. Also accepted as `pct`.
`spfAlignment`	No	aspf= — strict requires an exact domain match and breaks subdomain senders.
`dkimAlignment`	No	adkim= — strict requires an exact domain match and breaks many ESPs.
`reportInterval`	No	ri= — seconds between aggregate reports. Defaults to 86400 (daily).
`subdomainPolicy`	No	sp= — a different policy for subdomains. Omitted when it matches the main policy.

Schema Changelog

Changes observed during successful MCP inspections.

First observedAug 21, 2026

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: nothing is looked up or stored, the return payload includes the record, the `_dmarc` host, and warnings for the specific misconfigurations that break mail. It also discloses input validation behavior (rua not a mailbox, pct outside 1-100 refused with an error).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what the tool produces and the central risk (policy, not syntax) before the parameter narrative. It is dense but long; the warnings enumeration is close to restating what the return payload section already implies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description covers the return shape (record, host, warnings), the non-storage behavior, and error conditions. An agent has everything needed to call it and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline is 3; the description earns extra credit by explaining the policy trade-offs (none/quarantine/reject), why rua is mandatory in practice, and that percentage is inert at p=none, which the schema only states tersely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Build a DMARC record') and defines what the record is in DMARC terms. It implicitly distinguishes itself from the inspection siblings (check_dmarc, parse_dmarc_report) by being generative, but never names them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operational guidance: start at p=none, always publish rua, use percentage for phased rollout, and warns that reject at full coverage destroys legitimate mail. It doesn't route the agent to a sibling for auditing an existing record, which keeps it just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All IntoDNS.ai DNS & Email Security Scanner tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.