Skip to main content
Glama

DomainRef - domain and email security check

Server Details

Pay-per-call domain and email security check: SPF, DKIM, DMARC, TLS, DNSSEC, BIMI, with exact fixes.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL

TDQS

A4.1/5.0

Scored across 2 tools

Disambiguation3/5

domain_check explicitly bundles 'domain age' as one of its graded checks, so it substantially overlaps with domain_age. The descriptions do differentiate intent (narrow RDAP registrar/date lookup vs. a full email/security audit with a 0-100 score), but an agent must read carefully to avoid paying twice for overlapping data.

Naming Consistency5/5

Both tools follow the same clear noun_verb pattern (domain_age, domain_check), sharing the 'domain_' prefix. Consistent and immediately readable.

Tool Count3/5

Two tools is thin for a server framed as 'domain and email security check', and the broader audit tool already subsumes the narrower one. It is defensible for a narrowly focused paid API, but the surface feels minimal rather than well-scoped.

Completeness3/5

The email-security side is thorough (SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS, BIMI, blocklist, M365). However, the domain side only covers registry age/RDAP details — no standalone DNS record lookup, IP/sender reputation, domain availability, or bulk checking, leaving gaps for common investigative workflows.

Available Tools

2 tools
domain_ageA
Read-onlyIdempotent
Inspect

PAID ($0.005). Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005. From the registry's RDAP: registrar name and IANA ID (no registrant or contact data), created, expires, last changed, status flags, DNSSEC delegation, nameservers; fail under 30 days old or expired, warn under 180 days, expiring within 30 days or on hold. A registry without RDAP is refused free. MCP: pass api_key (card checkout at /pricing); per-call x402/MPP payment is HTTP only, so without a key the result is the x402 payment requirement for the HTTP endpoint.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain or hostname, e.g. example.com (no URL, no IP)
api_keyNoAPI key (bypasses x402; metered for invoicing)

Output Schema

ParametersJSON Schema
NameRequiredDescription
jobNo
errorNoPresent on a free refusal or error; no charge
statusNo
evidenceNo
no_chargeNo
price_usdNo
disclaimerNo
how_to_payNo
bind_seriesNo
explanationNo
x_next_bindNo
http_endpointNo
payment_requiredNotrue when the call needs payment; how_to_pay explains x402 or card

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses the exact risk thresholds (fail under 30 days old or expired, warn under 180 days, expiring within 30 days or on hold), the 422 refusal behavior, and the full payment/auth model including that x402/MPP per-call payment is HTTP-only and that a missing key returns a payment requirement. That is precisely the operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The content is useful but poorly front-loaded (it opens with pricing) and materially redundant: '$0.005' appears twice and 'a registry without RDAP is refused free' is stated twice in near-identical form. Roughly a sentence of repetition could be cut without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a paid, registry-backed lookup with an output schema already covering return values, the description supplies the missing pieces: cost, payment paths, refusal conditions, and risk thresholds. It restates the returned fields even though the output schema covers them, which is mild bloat rather than a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description goes further on api_key by explaining that card checkout happens at /pricing and that per-call x402 payment is unavailable over MCP, which genuinely clarifies why the key parameter exists. The domain parameter's format guidance ('no URL, no IP') is left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific purpose ('know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain') and enumerates the returned RDAP fields. It is clear about the resource and verb, but it never distinguishes itself from the sibling domain_check tool, so an agent has no basis for choosing between them from the description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a concrete when-not ('Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422)') plus the positive trigger ('Use when you need to know...'). However, it names no alternative tool, so the routing value stops short of the explicit 'use X instead' guidance that would earn a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

domain_checkA
Read-onlyIdempotent
Inspect

PAID ($0.01). Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, plus BIMI and blocklist info, each with the exact fix record. Non-intrusive. $0.01 per domain. Returns a 0-100 score and, per check (spf, dkim, dmarc, mx, tls = website certificate, m365, registration, mta_sts, tls_rpt, dnssec, caa, bimi, dnsbl = UCEPROTECT blocklist), a pass/warn/fail/info grade, the finding and the exact record or step that fixes it. Info checks do not move the score. Invalid, nonexistent or private-only domains are refused free. MCP: pass api_key (card checkout at /pricing); per-call x402/MPP payment is HTTP only, so without a key the result is the x402 payment requirement for the HTTP endpoint.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain or hostname, e.g. example.com (no URL, no IP)
api_keyNoAPI key (bypasses x402; metered for invoicing)

Output Schema

ParametersJSON Schema
NameRequiredDescription
jobNo
errorNoPresent on a free refusal or error; no charge
statusNo
evidenceNo
no_chargeNo
price_usdNo
disclaimerNo
how_to_payNo
bind_seriesNo
explanationNo
x_next_bindNo
http_endpointNo
payment_requiredNotrue when the call needs payment; how_to_pay explains x402 or card

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, the description adds substantial behavioral context: pricing, non-intrusiveness, free refusal of invalid/private-only domains, scoring behavior for info checks, and MCP/x402 payment behavior. This is highly transparent for a paid external check.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the paid nature and primary use cases, then proceeds to output and payment details. It is information-dense and every major clause is relevant, though the repeated pricing mention and long single paragraph make it slightly less crisp.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex paid domain-security check, the description supplies the key operational context: cost, use cases, refusal behavior, return shape, per-check grading, and MCP authentication/payment requirements. An output schema exists, but the description's summary of return values is still helpful and complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented. The description still adds useful meaning for api_key by explaining the MCP payment flow, x402/MPP being HTTP-only, and what happens without a key, while the domain parameter's format is left to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource and scope: a graded domain/email security check covering SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS, BIMI, blocklists, and domain age. It also gives concrete use cases (spam diagnosis, campaign preflight, vendor due diligence, Microsoft 365 tenant confirmation), making it clearly distinguishable from narrow sibling tools such as domain_age.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear conditions for use: when mail lands in spam, before an email campaign, for vendor due diligence, or to confirm a Microsoft 365 tenant. It does not explicitly state when not to use it or name alternatives, so it earns a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updates
    • First observeddomain_age
    • First observeddomain_check

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables DNS and email security analysis through passive and active scanning capabilities. Provides comprehensive domain security checks including SPF, DMARC, DNSSEC validation, MX record analysis, and SMTP connectivity testing.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to check a domain's email authentication and health across SPF, DKIM, DMARC, BIMI, MX, MTA-STS, and TLS-RPT, returning a score and recommended fixes.
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources