Skip to main content
Glama

build_dmarc_upgrade

Determine the next safe DMARC policy step for a domain and return a validated upgrade record, with p=quarantine from scan evidence and p=reject only from monitoring data.

Instructions

Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine at most; reject needs monitoring evidence) — and after any report showing DMARC below enforcement. Return a validated DMARC enforcement-upgrade record for a domain. A scan can justify p=quarantine at MOST: the alignment signal (valid aligned SPF and a DKIM selector) is derived server-side — a caller can never assert it — and p=reject is unlocked only by aggregate-report evidence over a full reporting window (monitoring), never by a scan. record is null when there is no honest upgrade to offer (the domain does not exist; the DMARC lookup itself hit NXDOMAIN while the existence probe did not resolve; the DMARC lookup temp-failed; no alignment signal was observed at all, so a non-enforcing domain is told to publish rua= reporting first and an enforcing one is left alone; or the domain already applies a policy at least as strong as this scan justifies): a null record is the ANSWER, not a fault — relay rationale and never compose a record to fill the gap. A returned record also carries np=reject (the DMARCbis tag covering non-existent subdomains, which can have no legitimate aligned mail) unless the domain already publishes an np tag, which is preserved as-is. Present a returned record verbatim; a human must approve before publishing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainYesThe domain to check, e.g. example.com. Bare registrable names and subdomains both work; scheme, path or port do not belong here. Unicode names are accepted and normalized to punycode.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.2.1
    • addedInput schema / properties / domain / description
      Added value: +"The domain to check, e.g. example.com. Bare registrable names and subdomains both work; scheme, path or port do not belong here. Unicode names are accepted and normalized to punycode."
  2. First observedv0.1.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false (so it may write) and destructiveHint=false (no destruction), but the description goes further by explaining that the alignment signal is derived server-side and cannot be asserted by the caller, and that p=reject requires aggregate-report evidence over a full window. It also explains the trait of returning null as a valid answer, and that np=reject is included unless already present. This adds significant behavioral context beyond annotations, though some details (like the exact validation process) are not covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is quite lengthy (a single long paragraph) and front-loads usage context, but it is dense and discusses multiple conditions and nuanced behaviors. While it is structured with clear cause-effect statements, it could be broken into shorter sentences or bullet points for readability. It earns its length because of the complexity, but it is not concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (conditional behavior, null return, server-side derivation, np tag handling), the description covers the essential trigger conditions, output semantics (including null as a valid answer), and constraints (e.g., reject requires monitoring). It also tells the agent to present records verbatim and get human approval. Although there's no output schema, the description fully explains what the return value represents and when it is null, so the agent has enough context to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the parameter 'domain' is fully described in the schema (including examples and normalization). The description does not add parameter-specific semantics beyond restating that it takes a domain, so a baseline 3 is appropriate since the schema carries the burden and the description adds little extra meaning for this single param.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: it builds a DMARC enforcement-upgrade record when a user asks about moving from p=none, tightening DMARC, or next DMARC steps. It distinguishes from siblings like generate_dmarc_record (which likely generates a fresh record) by emphasizing the 'upgrade' and enforcement context, and by listing specific trigger conditions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use ('when the user asks how to move DMARC on from p=none...' and 'after any report showing DMARC below enforcement') and when not to (e.g., when a scan can only justify quarantine at most, and reject requires monitoring evidence). It also states that a null record is the answer when no upgrade is honest, so agents know to relay rationale rather than fabricate a record.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.