Free DNS, SPF/DKIM/DMARC, TLS, WHOIS, IP/ASN, blocklist, ping, traceroute and port checks. No key.
Scored across 24 tools
Most tools have clearly distinct diagnostic purposes, and descriptions make the boundaries understandable. A few overlaps exist, such as dns_report vs domain_health_report, dns_lookup vs mx_lookup, and spf_lookup vs spf_validate, but they are not severe enough to routinely confuse selection.
The set is consistently snake_case and mostly follows a subject_action pattern such as asn_lookup, dmarc_check, and ssl_certificate_check. Minor deviations like ping, traceroute, and domain_expiry are readable and do not undermine the overall pattern.
At 24 tools the server is on the heavy side, but the breadth of network and DNS diagnostics justifies most of them. Each tool covers a recognizable area, though some consolidation could reduce overlap.
The surface covers a wide range of DNS, email authentication, TLS, WHOIS, ASN, and reachability checks. Minor gaps remain, such as explicit reverse DNS lookup, HTTP header inspection, and deeper TLS protocol/cipher testing, but core workflows are well supported.
Look up the autonomous system (ASN) for a public IP address, or details for an ASN such as AS15169: name, country, announced prefixes and address counts.
Inputs: query (required).
Check the BIMI record of a domain, whether DMARC meets BIMI requirements, and whether the SVG logo and certificate URLs are reachable and well formed.
Inputs: domain (required).
Find the CAA records that apply to a domain (climbing to parent domains per RFC 8659) and list which certificate authorities may issue certificates.
Inputs: domain (required).
List certificates logged in Certificate Transparency for a domain (via crt.sh): issuer, validity window and names, with a summary by issuer.
Inputs: domain (required).
Check DKIM public keys for a domain. With a selector it checks that selector; without one it probes common selectors. Reports key type and RSA key length and flags weak or revoked keys.
Inputs: domain (required), selector (required).
Find and explain the DMARC record of a domain (policy, pct, rua/ruf, alignment) and flag weaknesses such as p=none or missing external report authorization.
Inputs: domain (required).
Look up DNS records of one type (A, AAAA, CNAME, MX, NS, SOA, TXT, SRV) for a domain using public resolvers.
Inputs: domain (required), record_type.
Query a domain on about 40 public resolvers in different regions and report which ones return which answers, to see whether a DNS change has propagated.
Inputs: domain_name (required), query_type.
Full DNS report for a domain: delegation from the root, every authoritative name server checked individually (reachability, recursion, TCP, consistency), SOA values, MX records and their reverse DNS, SPF, DMARC, DKIM and DNSSEC.
Inputs: domain (required).
Validate the DNSSEC chain of trust for a domain from the root down (DS, DNSKEY, RRSIG) and report each zone as secure, insecure or broken.
Inputs: domain (required).
Registration and expiry dates of a domain, with the time remaining before it expires.
Inputs: domain_name (required).
Grade a domain A to F across 11 checks (name servers, SOA, DNSSEC, MX, SPF, DMARC, CAA, HTTPS certificate, HTTP to HTTPS redirect, HSTS, IPv6), with a reason and fix for each failed check.
Inputs: domain (required).
WHOIS registration data for a domain: registrar, dates, status and name servers (personal contact data is redacted by registries).
Inputs: domain (required).
Check whether a public IPv4 address is listed on common DNS-based blocklists such as Spamhaus, Barracuda and SpamCop.
Inputs: ip_address (required).
WHOIS / registry data for a public IPv4 address: ASN, network range, owner organisation and registry.
Inputs: ip_address (required).
Identify the manufacturer registered for a MAC address prefix (OUI) using the IEEE registry.
Inputs: mac_address (required).
Check MTA-STS (TXT record and the HTTPS policy file, mode and MX patterns) and the TLS-RPT reporting record for a domain.
Inputs: domain (required).
List the mail exchanger (MX) records of a domain with their preferences.
Inputs: domain (required).
Ping a public host from httpfy servers (4 ICMP echo requests) and report packet loss and round-trip times. Useful to test reachability from outside your own network.
Inputs: host (required).
Check whether one TCP port on a public host is open, closed or filtered when tested from httpfy servers on the internet.
Inputs: host (required), port (required).
Fetch the SPF record of a domain from its authoritative name server and list its mechanisms (ip4, ip6, include, redirect, all).
Inputs: domain (required).
Validate the SPF record of a domain: syntax, single-record rule, DNS lookup count (limit 10), void lookups, includes and the all mechanism.
Inputs: domain (required).
Connect to a domain on port 443 and report the certificate chain: subject, issuer, validity dates, days remaining, SANs and chain details.
Inputs: domain (required).
Traceroute to a public host from httpfy servers (up to 10 hops). Internal hops of httpfy's own network are masked.
Inputs: host (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Free live DNS, SPF/DMARC/MX, DKIM and WHOIS lookups for any domain. No key needed to start.
Free, read-only email and DNS checks: SPF, DKIM, DMARC, MX, DNS records, blocklists, domain health.
Check SPF/DKIM/DMARC/BIMI, blacklists, SMTP/IMAP; DNS lookups; generate email DNS records.
Free, no login: verify an email address, check SPF/DKIM/DMARC, explain SMTP errors, build SPF/DMARC.
Add one secure layer between your agents and this server.
