DMARC Shark — Email DNS Checker
Server Details
Check a domain's public SPF, DMARC, MX and DKIM DNS records on demand. No account required.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 2 tools
The two tools have clearly separate roles: check_domain performs fresh DNS queries and updates the saved snapshot, while get_saved_result only reads the existing snapshot without querying DNS. There is no meaningful overlap that would cause misselection.
Both tools use snake_case with an action-first verb pattern: check_domain and get_saved_result. The naming is predictable and readable, with consistent casing and structure.
The server has a narrow purpose, and each of the two tools earns its place: one performs checks, the other retrieves saved results. The count is slightly below the typical 3–15 range, but reasonable for this focused checker.
The surface covers the core email DNS checks—SPF, DMARC, MX, and optional DKIM—plus retrieval of the last saved snapshot. Minor gaps exist around saved-result history, bulk domain checks, or additional DNS record types, but the primary workflow is covered.
Available Tools
2 toolscheck_domainCheck a domain's public email DNSAInspect
Runs fresh, bounded public SPF, DMARC, MX and optionally specified DKIM-selector DNS checks. Changes the public saved snapshot. Rate limited. DNS findings do not prove message authentication.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| selectors | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| saved | Yes | |
| domain | Yes | |
| source | Yes | |
| findings | Yes | |
| checked_at | Yes | |
| recommendations | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already declaring readOnlyHint=false, openWorldHint=true, and idempotentHint=false, the description still adds real value: it discloses rate limiting, a bounded check scope, and that the run mutates the public saved snapshot (corroborating the non-read-only hint). It also adds the important caveat that DNS findings do not prove message authentication.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded sentences with no filler; the scope, side effect, rate limit, and caveat each earn their place. Nothing repeats the tool name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. The description covers the mutation side effect, rate limit, and interpretive caveat; the only real gap is parameter-level detail (selector cap, domain format) that the schema also lacks.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for 2 parameters, so the description must carry the load. It clarifies that DKIM selectors are optional ('optionally specified DKIM-selector'), but never mentions the maxItems=2 cap on selectors or gives any hint about the domain parameter's expected format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Runs fresh, bounded ... DNS checks') and enumerates the exact resources checked (SPF, DMARC, MX, DKIM selectors). The word 'fresh' plus 'Changes the public saved snapshot' implicitly distinguishes it from the sibling get_saved_result, which by name serves previously saved results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the description signals this tool performs a new live check while get_saved_result likely reads stored output, letting an agent infer the choice. However, it never explicitly says when to use this versus the sibling, and gives no exclusion conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_saved_resultRead a saved domain checkARead-onlyInspect
Reads the last saved, timestamped public snapshot without making any DNS queries. Results expire after 90 days.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| saved | Yes | |
| domain | Yes | |
| source | Yes | |
| findings | Yes | |
| checked_at | Yes | |
| recommendations | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/non-destructive/closed-world, and the description adds real behavioral context beyond them: no DNS traffic is generated and results expire after 90 days, which tells the agent the data may be stale. It stops short of stating what happens if nothing is saved yet.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and followed by the constraint that matters most. Nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the description supplies the key operational facts (no live queries, 90-day expiry). It could be more complete by naming check_domain as the alternative and clarifying behavior when no saved snapshot exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One required parameter with 0% schema description coverage, and the description never mentions the domain argument or its expected format. The parameter is largely self-evident from context, so this is adequate but does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (reads) and resource (the last saved, timestamped public snapshot). The clause 'without making any DNS queries' implicitly contrasts it with the sibling check_domain, though it never names that sibling, so differentiation is inferential rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'without making any DNS queries' hints at when to prefer this over a live check, but there is no explicit when-to-use statement, no named alternative (check_domain), and no conditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
check_domain - First observed
get_saved_result
Related MCP Connectors
SPF, DKIM, DMARC, MTA-STS and domain-expiry checks for any domain, with SPF lookup counts.
41Check a domain's DMARC, SPF, DKIM, MX, BIMI and MTA-STS records. Generate SPF and DMARC records.
Free, read-only email and DNS checks: SPF, DKIM, DMARC, MX, DNS records, blocklists, domain health.
Check a domain's email authentication: SPF, DKIM, DMARC, BIMI, MX, MTA-STS, TLS-RPT. Score + fixes.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables users to audit a domain's email-authentication DNS configuration—covering SPF, DKIM, DMARC, MX, BIMI, MTA-STS, and TLS-RPT—and receive issues, recommendations, a 0–100 score, and A–F grade.MIT
- AlicenseAqualityCmaintenancePerforms domain security posture checks including SPF, DKIM, DMARC, TLS, and HTTP security headers.34 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables DNS and email security analysis through passive and active scanning capabilities. Provides comprehensive domain security checks including SPF, DMARC, DNSSEC validation, MX record analysis, and SMTP connectivity testing.MIT
- FlicenseAqualityDmaintenanceProvides DNS lookup and email authentication diagnostic tools (SPF, DKIM, DMARC, MX, etc.) for use with MCP-compatible clients. Enables natural language queries to check DNS records and email health.7-
Glama MCP Gateway
Add one secure layer between your agents and this server.