dns-doctor

generate_dmarc_record

Read-onlyIdempotent

Use this when the user asks to create, generate or write a DMARC record for a domain that has none. Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. policy is none|quarantine|reject; optional rua_email (aggregate-report destination), subdomain_policy, and strict_alignment. Every generated record carries np=reject — the DMARCbis tag for non-existent subdomains, which can have no legitimate aligned mail — independently of the p= you choose. The generated record is re-validated before it is returned. Present it verbatim; a human must approve before publishing.

Input Schema

TableJSON Schema

Name	Required	Description
`policy`	Yes	The requested p= policy: 'none' monitors only, 'quarantine' sends failing mail to spam, 'reject' refuses it outright. Start at 'none' unless the domain's aggregate reports already justify enforcement.
`rua_email`	No	Mailbox to receive DMARC aggregate (RUA) reports, as a plain address like dmarc@example.com. Strongly recommended: without it nobody can see who sends as the domain.
`strict_alignment`	No	Set true to emit strict alignment (aspf=s adkim=s), requiring an exact domain match instead of the organizational-domain match. Leave false unless you know every sender aligns strictly.
`subdomain_policy`	No	Optional sp= policy for subdomains when it should differ from the main p= policy. Omit to let subdomains inherit p=.

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedJul 29, 2026

addedInput schema / properties / policy / description

Added value: +"The requested p= policy: 'none' monitors only, 'quarantine' sends failing mail to spam, 'reject' refuses it outright. Start at 'none' unless the domain's aggregate reports already justify enforcement."

addedInput schema / properties / rua_email / description

Added value: +"Mailbox to receive DMARC aggregate (RUA) reports, as a plain address like dmarc@example.com. Strongly recommended: without it nobody can see who sends as the domain."

addedInput schema / properties / strict_alignment / description

Added value: +"Set true to emit strict alignment (aspf=s adkim=s), requiring an exact domain match instead of the organizational-domain match. Leave false unless you know every sender aligns strictly."

addedInput schema / properties / subdomain_policy / description

Added value: +"Optional sp= policy for subdomains when it should differ from the main p= policy. Omit to let subdomains inherit p=."

Changed2 schema fields changedJul 27, 2026

addedInput schema / properties / policy / enum

Added value: +[
+  "none",
+  "quarantine",
+  "reject"
+]

changedInput schema / properties / subdomain_policy / anyOf

Previous value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "enum": [
+      "none",
+      "quarantine",
+      "reject"
+    ],
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]

AddedJul 27, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior, so the safety profile is covered. The description goes beyond by revealing the generated record always carries np=reject regardless of p=, that the record is re-validated before return, and that it must be presented verbatim with human approval before publishing. These are behavioral details not available in the schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately sized with the key trigger condition front-loaded. Each sentence adds information: when-to-use, core behavior, parameter roles, special np=reject behavior, validation, and approval requirement. No filler, though slightly wordy given the structured schema already covers parameter descriptions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations cover the read-only/idempotent nature, the description fully explains what the tool does, why, and the important constraints (np=reject, re-validation, human approval). Nothing an agent needs to invoke it correctly or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions already cover all parameters at 100%, so the baseline is 3. The description adds meaningful context, such as explaining that np=reject is independent of p=, and reinforces the purpose of rua_email and strict_alignment. This raises the value beyond mere schema repetition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('create, generate or write') and resource ('DMARC record for a domain that has none'), and differentiates from siblings like build_dmarc_upgrade and validate_dmarc_record by emphasizing building from scratch. The phrase 'never compose one yourself' further clarifies the tool's role as a validating engine, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly opens with 'Use this when the user asks to create, generate or write a DMARC record for a domain that has none,' which gives clear invocation guidance. It implies situations such as existing records or upgrades are handled elsewhere, though it does not explicitly name sibling tools or state when-not-to-use conditions. The context is clear enough for an agent to apply correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All dns-doctor tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.