domain-setup-mcp

domain_audit

Read-only

Checks public DNS records for one or more domains to verify SPF, DKIM, DMARC, and MX configuration without requiring a Cloudflare token.

Instructions

Check SPF, DKIM, DMARC and MX on public DNS for each domain. Read-only; needs no Cloudflare token.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domains": "<domains>"
    },
    "name": "domain_audit"
  }
}

Input Schema

Name	Required	Description	Default
`domains`	Yes	Domains, e.g. ['getacme.com','tryacme.com']. Max 100.
`dkim_selectors`	No	Custom DKIM selectors to check.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.3.0Nov 12, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes meaningfully beyond the annotations: 'on public DNS' discloses that no account context or private zone is consulted, and 'needs no Cloudflare token' discloses the authentication requirement — useful since readOnlyHint and openWorldHint alone don't say that. It does not describe failure behavior for unresolvable or missing records.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no filler, and the record types plus scope are front-loaded before the safety/auth note. Every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with no output schema, it covers what is checked, where it runs, and that no credentials are needed. It leaves the shape of results and the default DKIM selector behavior unstated, which are minor but real gaps for an agent interpreting the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters (domains, dkim_selectors) are documented in the schema with examples and a max of 100. The description adds only the implicit batch behavior ('for each domain'), so the schema does the heavy lifting and baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Check SPF, DKIM, DMARC and MX') with scope ('on public DNS for each domain'), which is clearly distinguishable from the sibling apply/plan/rollback/verify tools. It stops short of naming any sibling explicitly, so it lands just under the top mark.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The read-only framing and 'needs no Cloudflare token' imply this is the non-mutating inspection step, but there is no explicit statement of when to run it (e.g. before domain_apply) or when another sibling is the better choice. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server