DNS Doctor

Official

by dnsdoctor

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

Check Lookalike Domains

check_lookalikes

Read-onlyIdempotent

Checks DNS for lookalike, typosquat, and impersonation variants of a domain and reports which resolve and accept mail as facts, not a verdict.

Instructions

Use this when the user asks about lookalike, look-alike, typosquat or impersonation domains of their domain, or whether someone has registered a name close to theirs. DNS-only: checks the closest variants of the name and returns facts — how many resolve and how many accept mail, with up to ten resolving names (each with the kind of variant, whether it accepts mail, and same_infra when it points at the domain's own nameservers or mail servers, which usually means the owner registered it defensively). Never a verdict: relay the names as facts and never call one malicious — resolving only means the name is registered and answers. A name that could not be checked counts as unknown, never as free, and complete is false while any name is unknown. Unregistered names are never listed. If the user wants these names re-checked over time, call start_monitoring_signup.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "check_lookalikes"
  }
}

Input Schema

Name	Required	Description	Default
`domain`	Yes	The domain to check, e.g. example.com. Bare registrable names and subdomains both work; scheme, path or port do not belong here. Unicode names are accepted and normalized to punycode.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.18.0Nov 4, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly/idempotent/non-destructive, and the description adds substantial context beyond them: the tool returns facts, never a verdict; maliciousness must never be asserted; unresolvable checks count as unknown, not free; 'complete' is false while any name is unknown; unregistered names are never listed; and same_infra signals defensive registration. That is exactly the kind of semantic color annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is dense but front-loaded: the usage trigger leads, then the DNS-only scope, then return semantics, then the never-a-verdict caveat. Every sentence carries information, though the run-on middle section could be tightened slightly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry the return contract — and it does: resolving vs mail-accepting counts, up to ten resolving names with variant kind, mail acceptance, and same_infra meaning. It also covers the failure mode (unknown vs free, complete flag). Nothing an agent needs to interpret results is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and there is only one parameter, whose schema text already explains the example.com format, registrable names vs subdomains, disallowed scheme/path/port, and punycode normalization. The description adds no additional parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource — it checks the closest DNS variants of a user's domain for lookalike/typosquat/impersonation purposes — and scopes it as 'DNS-only'. However, the sibling get_lookalikes is never named or differentiated, so an agent cannot tell from the description alone why it should pick this over get_lookalikes rather than just invoking either.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It opens with an explicit trigger ('Use this when the user asks about lookalike, look-alike, typosquat or impersonation domains... or whether someone has registered a name close to theirs') and routes the recurring-check case to a named alternative, start_monitoring_signup. Both the when and the off-ramp are stated rather than inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.