DomainRef - domain and email security check
Server Details
Pay-per-call domain and email security check: SPF, DKIM, DMARC, TLS, DNSSEC, BIMI, with exact fixes.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 2 tools
domain_check explicitly bundles 'domain age' as one of its graded checks, so it substantially overlaps with domain_age. The descriptions do differentiate intent (narrow RDAP registrar/date lookup vs. a full email/security audit with a 0-100 score), but an agent must read carefully to avoid paying twice for overlapping data.
Both tools follow the same clear noun_verb pattern (domain_age, domain_check), sharing the 'domain_' prefix. Consistent and immediately readable.
Two tools is thin for a server framed as 'domain and email security check', and the broader audit tool already subsumes the narrower one. It is defensible for a narrowly focused paid API, but the surface feels minimal rather than well-scoped.
The email-security side is thorough (SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS, BIMI, blocklist, M365). However, the domain side only covers registry age/RDAP details — no standalone DNS record lookup, IP/sender reputation, domain availability, or bulk checking, leaving gaps for common investigative workflows.
Available Tools
2 toolsdomain_ageARead-onlyIdempotentInspect
PAID ($0.005). Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005. From the registry's RDAP: registrar name and IANA ID (no registrant or contact data), created, expires, last changed, status flags, DNSSEC delegation, nameservers; fail under 30 days old or expired, warn under 180 days, expiring within 30 days or on hold. A registry without RDAP is refused free. MCP: pass api_key (card checkout at /pricing); per-call x402/MPP payment is HTTP only, so without a key the result is the x402 payment requirement for the HTTP endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain or hostname, e.g. example.com (no URL, no IP) | |
| api_key | No | API key (bypasses x402; metered for invoicing) |
Output Schema
| Name | Required | Description |
|---|---|---|
| job | No | |
| error | No | Present on a free refusal or error; no charge |
| status | No | |
| evidence | No | |
| no_charge | No | |
| price_usd | No | |
| disclaimer | No | |
| how_to_pay | No | |
| bind_series | No | |
| explanation | No | |
| x_next_bind | No | |
| http_endpoint | No | |
| payment_required | No | true when the call needs payment; how_to_pay explains x402 or card |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, it discloses the exact risk thresholds (fail under 30 days old or expired, warn under 180 days, expiring within 30 days or on hold), the 422 refusal behavior, and the full payment/auth model including that x402/MPP per-call payment is HTTP-only and that a missing key returns a payment requirement. That is precisely the operational context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The content is useful but poorly front-loaded (it opens with pricing) and materially redundant: '$0.005' appears twice and 'a registry without RDAP is refused free' is stated twice in near-identical form. Roughly a sentence of repetition could be cut without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a paid, registry-backed lookup with an output schema already covering return values, the description supplies the missing pieces: cost, payment paths, refusal conditions, and risk thresholds. It restates the returned fields even though the output schema covers them, which is mild bloat rather than a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description goes further on api_key by explaining that card checkout happens at /pricing and that per-call x402 payment is unavailable over MCP, which genuinely clarifies why the key parameter exists. The domain parameter's format guidance ('no URL, no IP') is left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific purpose ('know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain') and enumerates the returned RDAP fields. It is clear about the resource and verb, but it never distinguishes itself from the sibling domain_check tool, so an agent has no basis for choosing between them from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a concrete when-not ('Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422)') plus the positive trigger ('Use when you need to know...'). However, it names no alternative tool, so the routing value stops short of the explicit 'use X instead' guidance that would earn a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_checkARead-onlyIdempotentInspect
PAID ($0.01). Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, plus BIMI and blocklist info, each with the exact fix record. Non-intrusive. $0.01 per domain. Returns a 0-100 score and, per check (spf, dkim, dmarc, mx, tls = website certificate, m365, registration, mta_sts, tls_rpt, dnssec, caa, bimi, dnsbl = UCEPROTECT blocklist), a pass/warn/fail/info grade, the finding and the exact record or step that fixes it. Info checks do not move the score. Invalid, nonexistent or private-only domains are refused free. MCP: pass api_key (card checkout at /pricing); per-call x402/MPP payment is HTTP only, so without a key the result is the x402 payment requirement for the HTTP endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain or hostname, e.g. example.com (no URL, no IP) | |
| api_key | No | API key (bypasses x402; metered for invoicing) |
Output Schema
| Name | Required | Description |
|---|---|---|
| job | No | |
| error | No | Present on a free refusal or error; no charge |
| status | No | |
| evidence | No | |
| no_charge | No | |
| price_usd | No | |
| disclaimer | No | |
| how_to_pay | No | |
| bind_series | No | |
| explanation | No | |
| x_next_bind | No | |
| http_endpoint | No | |
| payment_required | No | true when the call needs payment; how_to_pay explains x402 or card |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, the description adds substantial behavioral context: pricing, non-intrusiveness, free refusal of invalid/private-only domains, scoring behavior for info checks, and MCP/x402 payment behavior. This is highly transparent for a paid external check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the paid nature and primary use cases, then proceeds to output and payment details. It is information-dense and every major clause is relevant, though the repeated pricing mention and long single paragraph make it slightly less crisp.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex paid domain-security check, the description supplies the key operational context: cost, use cases, refusal behavior, return shape, per-check grading, and MCP authentication/payment requirements. An output schema exists, but the description's summary of return values is still helpful and complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented. The description still adds useful meaning for api_key by explaining the MCP payment flow, x402/MPP being HTTP-only, and what happens without a key, while the domain parameter's format is left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource and scope: a graded domain/email security check covering SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS, BIMI, blocklists, and domain age. It also gives concrete use cases (spam diagnosis, campaign preflight, vendor due diligence, Microsoft 365 tenant confirmation), making it clearly distinguishable from narrow sibling tools such as domain_age.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear conditions for use: when mail lands in spam, before an email campaign, for vendor due diligence, or to confirm a Microsoft 365 tenant. It does not explicitly state when not to use it or name alternatives, so it earns a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
domain_age - First observed
domain_check
Related MCP Connectors
One-call domain audit: MX receiving, SPF/DMARC/DKIM spoofing protection, disposable-address risk.
Check emails before you send, and get a $1 SPF/DKIM/DMARC fix plan for your domain. Pay per call.
Domain checks: SPF, DKIM, DMARC, BIMI, MTA-STS, SSL/TLS and HTTP security headers.
Check a domain's email authentication: SPF, DKIM, DMARC, BIMI, MX, MTA-STS, TLS-RPT. Score + fixes.
Related MCP Servers
- AlicenseAqualityBmaintenanceProvides comprehensive email deliverability and domain registration analysis, evaluating SPF, DKIM, DMARC, DNS records, and expiry to identify issues and suggest fixes.51MIT
- AlicenseNot gradedqualityDmaintenanceEnables DNS and email security analysis through passive and active scanning capabilities. Provides comprehensive domain security checks including SPF, DMARC, DNSSEC validation, MX record analysis, and SMTP connectivity testing.MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to check a domain's email authentication and health across SPF, DKIM, DMARC, BIMI, MX, MTA-STS, and TLS-RPT, returning a score and recommended fixes.MIT
- AlicenseAqualityCmaintenancePerforms domain security posture checks including SPF, DKIM, DMARC, TLS, and HTTP security headers.33 npmMIT
Glama MCP Gateway
Add one secure layer between your agents and this server.