Skip to main content
Glama

generate_dmarc_record

Read-onlyIdempotent

Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. policy is none|quarantine|reject; optional rua_email (aggregate-report destination), subdomain_policy, and strict_alignment. Every generated record carries np=reject — the DMARCbis tag for non-existent subdomains, which can have no legitimate aligned mail — independently of the p= you choose. The generated record is re-validated before it is returned. Present it verbatim; a human must approve before publishing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
policyYesThe requested p= policy: 'none' monitors only, 'quarantine' sends failing mail to spam, 'reject' refuses it outright. Start at 'none' unless the domain's aggregate reports already justify enforcement.
rua_emailNoMailbox to receive DMARC aggregate (RUA) reports, as a plain address like dmarc@example.com. Strongly recommended: without it nobody can see who sends as the domain.
strict_alignmentNoSet true to emit strict alignment (aspf=s adkim=s), requiring an exact domain match instead of the organizational-domain match. Leave false unless you know every sender aligns strictly.
subdomain_policyNoOptional sp= policy for subdomains when it should differ from the main p= policy. Omit to let subdomains inherit p=.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral context beyond the annotations: every generated record includes 'np=reject' regardless of p=, the record is 're-validated before it is returned,' and it must be 'present[ed] verbatim' with human approval. These details are not visible in the readOnlyHint, idempotentHint, or destructiveHint annotations, and they inform the agent's action and output handling. No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each earning its place: the first states the core function, the second summarizes parameters and the critical np=reject behavior, the third explains re-validation and the human-approval requirement. It is front-loaded and free of redundant or vague phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to detail return values. It covers the essential context: when to use (domain without a record), key behavioral traits (np=reject, re-validation), and process requirements (verbatim presentation, human approval). This is complete for a 4-parameter, 1-required tool and complements the rich schema and annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% parameter descriptions, covering policy, rua_email, subdomain_policy, and strict_alignment. The description merely summarizes these parameters (e.g., 'policy is none|quarantine|reject') without adding semantic depth beyond the schema. The np=reject mention is about output behavior, not parameter meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Build a DMARC record from scratch for a domain that has none.' This clearly distinguishes the tool from siblings like build_dmarc_upgrade (which implies working with an existing record) and validate_dmarc_record (which checks rather than builds). The phrase 'never compose one yourself' reinforces the tool's specific role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear usage condition: 'for a domain that has none,' implying this tool is for domains lacking DMARC records. It does not explicitly name alternatives or enumerate when-not-to-use scenarios, but the context is sufficiently clear. The guidance that a human must approve before publishing adds an important usage boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.4/5.0
Disambiguation5/5

Each tool targets a distinct DNS or email authentication task. Despite multiple DMARC-related tools, their purposes are clearly differentiated: build_dmarc_upgrade upgrades policies, generate_dmarc_record creates new ones, validate_dmarc_record validates pasted records, and scan_domain vs get_report differentiate fresh vs cached scans.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., build_dmarc_upgrade, check_record, scan_domain). No mixing of naming conventions, making the set predictable and easy to navigate.

Tool Count5/5

With 11 tools, the server is well-scoped for a DNS/email authentication diagnostics tool. The number covers essential operations without being overwhelming or sparse.

Completeness4/5

The tool set covers core workflows: DMARC management (generate, validate, upgrade, parse reports), DNS checks (propagation, reverse DNS, SPF lookups), and DKIM selector checks. Minor gaps exist, such as the absence of SPF validation or DKIM signature verification, but the main diagnostic and monitoring use cases are supported.