isitdns

Sweep a zone's nameservers

sweep_domain

Read-onlyIdempotent

Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at its api: URL. names are labels under domain (@ for domain itself), 16 at most, and types 8 at most.

Input Schema

TableJSON Schema

Name	Required	Description
`names`	No	Labels under domain, "@" for domain itself. Default: @, www, _dmarc, _acme-challenge
`types`	No	Record types. Default: SOA, NS, A, AAAA, MX, TXT, CAA
`domain`	Yes	The zone or name to sweep, e.g. example.com. Also as "name"; a URL is read as its host.

Output Schema

TableJSON Schema

Name	Required	Description
`api`	Yes	The /api GET that asks it again, as a new reading
`zone`	No	The zone swept
`results`	No	One row per name and type: flags, answers, not asked
`servers`	No	Each nameserver address: name, address, family
`holdback`	No	The sample: addresses known, addresses asked, and each address not asked with why
`receipts`	No	One per DNS read: what, of whom, from where, when, rcode, flags, EDE, ms, answer
`notPrinted`	No	Counts trimmed to fit, all at api
`certReadiness`	No	Per name: the CAA set that governs it and its _acme-challenge TXT and CNAME

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedOct 13, 2026

changedInput schema / properties / names / description

Previous value: -"Relative labels to ask, \"@\" for the apex. Default: @, www, _dmarc, _acme-challenge"New value: +"Labels under domain, \"@\" for domain itself. Default: @, www, _dmarc, _acme-challenge"

changedOutput schema / properties / certReadiness / description

Previous value: -"Per name: CAA and ACME readiness"New value: +"Per name: the CAA set that governs it and its _acme-challenge TXT and CNAME"

Changed1 schema field changedOct 9, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "api": {
+      "description": "The /api GET that asks it again, as a new reading",
+      "type": "string"
+    },
+    "certReadiness": {
+      "description": "Per name: CAA and ACME readiness",
+      "type": "array"
+    },
+    "holdback": {
+      "description": "The sample: addresses known, addresses asked, and each address not asked with why",
+      "type": "object"
+    },
+    "notPrinted": {
+      "description": "Counts trimmed to fit, all at api",
+      "type": "object"
+    },
+    "receipts": {
+      "description": "One per DNS read: what, of whom, from where, when, rcode, flags, EDE, ms, answer",
+      "type": "array"
+    },
+    "results": {
+      "description": "One row per name and type: flags, answers, not asked",
+      "type": "array"
+    },
+    "servers": {
+      "description": "Each nameserver address: name, address, family",
+      "type": "array"
+    },
+    "zone": {
+      "description": "The zone swept",
+      "type": "string"
+    }
+  },
+  "required": [
+    "api"
+  ],
+  "type": "object"
+}

Changed1 schema field changedSep 29, 2026

changedInput schema / properties / domain / description

Previous value: -"The zone or name to sweep, e.g. example.com. Also accepted as \"name\"; a URL is reduced to its host."New value: +"The zone or name to sweep, e.g. example.com. Also as \"name\"; a URL is read as its host."

Changed1 schema field changedSep 28, 2026

changedInput schema / properties / domain / description

Previous value: -"The zone or name to sweep, e.g. example.com"New value: +"The zone or name to sweep, e.g. example.com. Also accepted as \"name\"; a URL is reduced to its host."

AddedSep 26, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent/non-destructive, and the description adds genuinely new behavioral context: queries are sent with RD=0 over TCP from the isitdns edge or a probe, every unasked question is listed with a reason, and responses over 22,000 bytes are truncated with counts, with the full sweep available at an api: URL.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and scope are front-loaded in the first clause, and the closing sentence packs the hard limits efficiently. The middle is written in clipped, subject-less fragments ('Asked with RD=0 over TCP...', 'named on each answer') that cost readability for a marginal word saving.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return formatting need not be explained, and the description still covers scope, exclusions, transport behavior, per-question omission reasons, truncation, and where to fetch the full result. Nothing material for correct invocation appears missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds constraints the schema omits: names are labels under domain with '@' meaning the zone apex, capped at 16 names and 8 types. That cap information is only available in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

It names a specific verb (sweep) and resource (a zone's nameservers) and spells out exactly what is compared and reported: disagreements, lame/silent servers, serial and TTL differences, CAA, and _acme-challenge records. It also explicitly separates itself from the sibling 'dig' by stating it is not a public-resolver answer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The exclusion 'Not for a public resolver's answer: dig' gives a clear negative trigger and names the alternative tool. However, it never states positively when to reach for a sweep (e.g. auditing delegation consistency or pre-migration checks), so the agent must infer the positive case from the capability list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All isitdns tools Inspect

Try in Browser

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?