isitdns

Walk the DNSSEC chain

dnssec_chain

Read-onlyIdempotent

Walk the DNSSEC chain from the root to one answer: DS and DNSKEY at each signed zone cut, key tags, signers, signature windows, the first link that breaks or goes insecure, and whether the zone where it goes insecure is itself signed (an island of security). Not for one signed record: dig. Read through Cloudflare's resolver over DoH with CD=1 from the isitdns edge, and a key set a break would rest on again through Google's. Signature bytes are not verified, so a clean walk does not prove the answer validates. type (default A) is the record checked at the end, not OPT, RRSIG or a meta type such as ANY, and anchor (a DS or DNSKEY record, with anchor_zone) starts the walk at that zone instead of the root.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>"
    },
    "name": "dnssec_chain"
  }
}

Input Schema

Name	Required	Description	Default
`name`	Yes	The name, e.g. www.example.com. Also as "domain"; a URL is read as its host.
`type`	No	The record type to check at the end of the chain	A
`anchor`	No	A trust anchor: "DS <key tag> <algorithm> <digest type> <digest>" or "DNSKEY <flags> <protocol> <algorithm> <key>", optionally led by its owner name
`anchor_zone`	No	The zone the anchor belongs to: the name or a parent of it. Optional when the anchor record leads with its owner

Output Schema

Name	Required	Description
`api`	Yes	The /api GET that asks it again, as a new reading
`links`	Yes	One per zone cut: zone, DS, key tags and roles, signer, problems, readFrom
`anchor`	No	The supplied anchor: zone, kind, record, keyTag, algorithm, match
`answer`	No	The end: rcode, records, signatures, denial, problems
`readAt`	Yes	When the walk began
`islandAt`	No	insecureAt when that zone is itself signed: an island of security; null when it is not, or when that was not judged (notChecked says why)
`receipts`	Yes	One per DNS read: what, of whom, from where, when, rcode, flags, EDE, ms, answer
`firstBreak`	No	The first link that breaks: at, why, readFrom (the resolvers whose readings it rests on)
`insecureAt`	No	The zone where it goes insecure
`signaturesVerified`	Yes	Always false: signature bytes are not checked

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedOct 24, 2026

addedInput schema / properties / anchor

Added value: +{
+  "description": "A trust anchor: \"DS <key tag> <algorithm> <digest type> <digest>\" or \"DNSKEY <flags> <protocol> <algorithm> <key>\", optionally led by its owner name",
+  "type": "string"
+}

addedInput schema / properties / anchor_zone

Added value: +{
+  "description": "The zone the anchor belongs to: the name or a parent of it. Optional when the anchor record leads with its owner",
+  "type": "string"
+}

addedOutput schema / properties / anchor

Added value: +{
+  "description": "The supplied anchor: zone, kind, record, keyTag, algorithm, match",
+  "type": "object"
+}

addedOutput schema / properties / islandAt

Added value: +{
+  "description": "insecureAt when that zone is itself signed: an island of security; null when it is not, or when that was not judged (notChecked says why)",
+  "type": [
+    "string",
+    "null"
+  ]
+}

Changed2 schema fields changedOct 12, 2026

changedOutput schema / properties / firstBreak / description

Previous value: -"The first link that breaks: at, why"New value: +"The first link that breaks: at, why, readFrom (the resolvers whose readings it rests on)"

changedOutput schema / properties / links / description

Previous value: -"One per zone cut: zone, DS, key tags and roles, signer, problems"New value: +"One per zone cut: zone, DS, key tags and roles, signer, problems, readFrom"

Changed1 schema field changedOct 9, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "answer": {
+      "description": "The end: rcode, records, signatures, denial, problems",
+      "type": [
+        "object",
+        "null"
+      ]
+    },
+    "api": {
+      "description": "The /api GET that asks it again, as a new reading",
+      "type": "string"
+    },
+    "firstBreak": {
+      "description": "The first link that breaks: at, why",
+      "type": [
+        "object",
+        "null"
+      ]
+    },
+    "insecureAt": {
+      "description": "The zone where it goes insecure",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "links": {
+      "description": "One per zone cut: zone, DS, key tags and roles, signer, problems",
+      "type": "array"
+    },
+    "readAt": {
+      "description": "When the walk began",
+      "type": "string"
+    },
+    "receipts": {
+      "description": "One per DNS read: what, of whom, from where, when, rcode, flags, EDE, ms, answer",
+      "type": "array"
+    },
+    "signaturesVerified": {
+      "description": "Always false: signature bytes are not checked",
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "links",
+    "signaturesVerified",
+    "readAt",
+    "api",
+    "receipts"
+  ],
+  "type": "object"
+}

Changed1 schema field changedSep 29, 2026

changedInput schema / properties / name / description

Previous value: -"The name, e.g. www.example.com. Also accepted as \"domain\"; a URL is reduced to its host."New value: +"The name, e.g. www.example.com. Also as \"domain\"; a URL is read as its host."

Changed1 schema field changedSep 28, 2026

changedInput schema / properties / name / description

Previous value: -"The name, e.g. www.example.com"New value: +"The name, e.g. www.example.com. Also accepted as \"domain\"; a URL is reduced to its host."

AddedSep 27, 2026

TDQS

A4.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true and destructiveHint=false, so safety is covered. The description still adds real behavioral context beyond that: it discloses the transport (DoH, CD=1, isitdns edge plus Google's resolver for the key set) and, crucially, that signature bytes are not verified so a clean walk does not prove validation. It does not cover rate limits or error behavior, keeping this above baseline but short of the top.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the walk's scope and its own contents, with the dig exclusion early. It is dense and the closing clause about type and anchor packs several constraints into one long sentence, but essentially every clause carries decision-relevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex (external resolvers, trust anchors, partial validation) and the description covers what the walk yields, how it is performed, its key limitation, and the parameter constraints. With an output schema present, it need not explain return shape, so nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description earns more by clarifying that type is the record checked at the end (default A) and is restricted from OPT/RRSIG/meta types, and that anchor is a DS or DNSKEY record that relocates the walk's start with anchor_zone. That is semantic guidance beyond the field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Walk the DNSSEC chain from the root to one answer'), enumerates what the walk returns at each zone cut, and explicitly rules out the sibling case ('Not for one signed record: dig'), so an agent can separate it from dig without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative (dig) and the condition that selects it, plus the alternative entry point (anchor/anchor_zone starts at a zone instead of the root) and an exclusion on the type parameter (not OPT, RRSIG or a meta type such as ANY). The when-to-use boundary is explicit rather than inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All isitdns tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?