DMARC Shark — Email DNS Checker

Check a domain's public email DNS

check_domain

Runs fresh, bounded public SPF, DMARC, MX, DANE/TLSA, TLS-RPT, BIMI, MTA-STS, optional DKIM-selector and resolver DNSSEC validation checks. Changes the public saved snapshot. Rate limited. Clients should obtain user approval before calling. Findings do not prove message authentication, TLS use or enforcement, DANE certificate matching, brand verification, logo display, or report delivery.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "check_domain"
  }
}

Input Schema

Name	Required	Description	Default
`domain`	Yes
`selectors`	No
`bimi_selector`	No

Output Schema

Name	Required	Description	Default
`saved`	Yes
`dnssec`	No
`domain`	Yes
`source`	Yes
`findings`	Yes
`checked_at`	Yes
`recommendations`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedNov 5, 2026
- addedInput schema / properties / bimi_selector
```
Added value: +{
+  "maxLength": 253,
+  "type": "string"
+}
```
- addedOutput schema / properties / dnssec
```
Added value: +{
+  "type": "object"
+}
```
First observedOct 19, 2026

TDQS

A4.1/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations by disclosing that the call mutates state ('Changes the public saved snapshot'), is rate limited, and requires user approval before invocation. The closing sentence is unusually valuable: it enumerates the inferences the findings do NOT support (message authentication, TLS enforcement, DANE matching, brand verification, logo display, report delivery), which directly guards against the most likely misinterpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with zero filler, front-loaded with the action and scope before the operational constraints and the caveats. Every clause carries information an agent needs; nothing restates the tool name or the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, state-mutating, network-dependent tool the description covers the important ground, and an output schema exists so return values need not be explained. The remaining gap is parameter-level: the purpose and constraints of 'bimi_selector' and the two-item cap on 'selectors' are absent given 0% schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden: it explains that DKIM selectors are optional ('optional DKIM-selector'), which gives meaning to the 'selectors' array. It says nothing about the required 'domain' parameter, the maxItems=2 cap on selectors, or the 'bimi_selector' parameter at all, so a third of the parameters remain undocumented anywhere and the two-item limit will surprise an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb ('Runs fresh, bounded') and enumerates the exact record types checked (SPF, DMARC, MX, DANE/TLSA, TLS-RPT, BIMI, MTA-STS, DKIM-selector, DNSSEC), which is far beyond a tautology. It never names the sibling get_saved_result, so the distinction between a fresh check and retrieving an existing result is only implied by 'Changes the public saved snapshot'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Runs fresh' signals the use case and the approval prerequisite plus rate limiting give operational context an agent needs before calling. However, there is no explicit statement of when an agent should call get_saved_result instead of paying for a fresh check, so the alternative is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All DMARC Shark — Email DNS Checker tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?