Skip to main content
Glama

dns_ttl_analysis

Identifies DNS TTL anomalies across record types (fast-flux, stale cache, inconsistency) to expose security and operational risks.

Instructions

Analyze DNS TTL (Time-To-Live) values across all record types for a domain. Flags potential security and operational issues: TTL < 60s (fast-flux indicator, common in malware C2), TTL > 86400s (stale cache risk during incident response), and inconsistent TTLs across record types.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainYesThe domain to analyze TTL values for (e.g. 'example.com')
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the specific thresholds (<60s, >86400s) and their security/operational implications, which goes beyond a vague 'analyze' statement. It does not mention side effects (e.g., network queries) or return format, but it does reveal the analytical criteria and outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, with the first stating the core purpose and the second listing the specific flags and rationale. Every sentence contributes meaningful information without redundancy or excess length, making it highly efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description adequately explains what the tool analyzes and what it flags, which is sufficient for an agent to select and invoke it. It does not describe the exact output structure, but the absence of an output schema and the clear criteria make this a minor gap rather than a critical omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description covers the single parameter 'domain' fully, providing an example and type, so the baseline is 3. The description adds no additional semantic value beyond reiterating 'for a domain', so it neither enhances nor detracts from what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes DNS TTL values across all record types for a domain, using a specific verb ('Analyze') and identifying the resource and scope. It also distinguishes itself by focusing specifically on TTL security and operational issues, which separates it from other DNS-related sibling tools like dns_lookup or dns_cache_snoop.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use this tool—to identify fast-flux indicators, stale cache risks, and inconsistent TTLs—making the intended use case evident. It does not explicitly name alternative tools or state when not to use it, but the context is strong enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/badchars/dns-security-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server