dns-security-mcp

Check an IP address against multiple DNS-based blocklists (DNSBL/RBL). Reverses the IP and queries each blocklist in parallel. Returns per-list result with listing status and reason.

Check a domain against malware-specific blocklists: abuse.ch URLhaus, Spamhaus DBL, SURBL malware category. Returns whether malware association was found and the source.

Check a domain for phishing indicators by querying Spamhaus DBL, SURBL phishing list, and checking domain age via RDAP. Returns phishing indicators and confidence level (0-100).

Check a domain against domain-based blocklists (SURBL, Spamhaus DBL, URIBL, etc.). Returns listed/not listed per list with category.

Calculate an aggregated domain risk score (0-100) from multiple sources: DNSBL listings, domain age, DNSSEC presence, SPF/DMARC configuration. Returns score, contributing factors, and verdict.

Detect fast-flux DNS behavior by resolving a domain multiple times with intervals. Fast-flux indicators: rapidly changing IPs, very low TTL (<300), multiple IPs per query, IPs in different /16 subnets. Returns flux score 0-100.

Build a full certificate inventory from CT logs for a domain. Groups by active/expired, wildcard/specific, and CA. Returns total count, active count, unique subdomains, and CA distribution.

Check CAA (Certification Authority Authorization) DNS records for a domain and its parents. Analyzes issue, issuewild, and iodef tags. Flags missing CAA, unrestricted wildcards, and missing iodef.

Find certificates expiring within N days for a domain. Returns expiring certificates with subject, issuer, expiry date, and days remaining.

Monitor Certificate Transparency logs for recently issued certificates. Returns certificates issued within the last N days for a given domain.

Search Certificate Transparency logs via crt.sh for certificates issued for a domain. Returns issuer, validity dates, serial number, and common name.

Detect potentially unauthorized certificates by cross-referencing CT logs with CAA DNS records. Flags certificates issued by CAs not authorized in the domain's CAA record.

Audit Certificate Transparency logs for wildcard certificates (*.domain). Reports number of wildcards, issuing CAs, date ranges, and flags multiple wildcards from different CAs.

Perform DNS cache snooping by sending a non-recursive query (RD=0) to a nameserver. If the server returns an answer without performing recursion, the domain was previously cached, revealing that someone behind that resolver recently visited the domain.

Resolve all DNS record types for a domain in parallel. Returns A, AAAA, MX, TXT, NS, SOA, CNAME, SRV, and CAA records. Optionally specify record types or a custom resolver.

Attempt DNSSEC NSEC zone walking to enumerate domain names in a signed zone. NSEC records contain the 'next' domain name in the zone, allowing complete enumeration. NSEC3 uses hashed names to mitigate this, which is detected and reported.

Check DNS propagation by querying 20+ globally distributed public resolvers. Reports per-resolver results and a consistency check to detect incomplete propagation or geo-based DNS differences.

Test whether a DNS nameserver is an open recursive resolver by sending a recursive query (RD=1) for an external domain. Open recursive resolvers are a security risk — they can be abused for DNS amplification DDoS attacks and cache poisoning.

Perform PTR (reverse DNS) lookup on an IP address with Forward Confirmed rDNS (FCrDNS) validation. Resolves the PTR record, then forward-resolves the resulting hostname to confirm it maps back to the original IP.

Inventory all DNSSEC algorithms used in DS, DNSKEY, and RRSIG records. Maps algorithm numbers to names. Flags deprecated algorithms (RSA/MD5, DSA, RSASHA1) and recommends ECDSAP256SHA256 or ED25519.

List all DNSKEY records for a domain. Distinguishes KSK (flag 257) vs ZSK (flag 256), reports algorithm and protocol. Flags weak algorithms and identifies strong ones.

Check DS (Delegation Signer) records for a domain. Queries DS from parent zone and DNSKEY from child zone. Verifies DS existence and reports algorithm strength and digest type.

Check NSEC/NSEC3 records for a domain. Determines if the zone uses NSEC (enumerable via zone walking) or NSEC3 (hashed names). For NSEC3, reports hash algorithm, iterations, and salt. Flags NSEC as informational risk allowing zone walking.

Check RRSIG (Resource Record Signature) records for a domain. Extracts type covered, algorithm, labels, original TTL, signature expiry/inception, key tag, and signer. Reports days until expiry and flags signatures expiring within 7 days.

Comprehensive DNSSEC audit that runs all 7 DNSSEC checks: chain of trust validation, DS verification, DNSKEY analysis, RRSIG expiry check, NSEC/NSEC3 analysis, algorithm audit, and key rollover detection. Aggregates findings into a severity-scored report with remediation guidance.

Check for DNSSEC key rollover. Detects multiple DNSKEYs indicating rollover in progress. Reports pre-publish vs double-signature rollover method. Flags if both old and new KSK present without matching DS.

Full DNSSEC chain of trust validation from root to TLD to domain. Queries DNSKEY, DS, and RRSIG records at each level. Reports whether the chain is valid, broken, or the domain is not signed.

Fingerprint a DNS server by querying CHAOS class TXT records (version.bind, version.server, hostname.bind, id.server). These records can reveal the DNS software type and version (BIND, PowerDNS, Unbound, Knot, dnsmasq, Windows DNS).

Detect split-horizon (split-brain) DNS configurations by comparing responses from multiple external resolvers and an optional internal resolver. Split-horizon DNS returns different answers based on the source of the query, commonly used to serve internal IPs to corporate networks and external IPs to the internet.

Enumerate subdomains using passive CT (Certificate Transparency) log lookups via crt.sh and active DNS brute-force. Deduplicates results and resolves each discovered subdomain to get its IP addresses.

Analyze DNS TTL (Time-To-Live) values across all record types for a domain. Flags potential security and operational issues: TTL < 60s (fast-flux indicator, common in malware C2), TTL > 86400s (stale cache risk during incident response), and inconsistent TTLs across record types.

Detect wildcard DNS configurations by resolving multiple random non-existent subdomains. If all random names resolve to the same IP, a wildcard record (*.domain) is in place. Wildcard DNS can affect subdomain enumeration accuracy and security assessments.

Attempt an AXFR (full zone transfer) against a domain's nameserver via TCP. If the nameserver allows zone transfers, all DNS records in the zone are returned. An open zone transfer is a critical security misconfiguration.

Determine domain age via RDAP creation date. Classifies as suspicious (<30 days), young (<90 days), or established (>365 days).

Analyze domains for DGA (Domain Generation Algorithm) characteristics. Evaluates consonant ratio, bigram frequency, Shannon entropy, length, and pronounceability. Returns per-domain DGA probability score.

Assess domain expiry risk via RDAP. Checks expiration date and transfer lock status. Flags critical (<30 days), warning (<90 days), and missing transfer lock.

Retrieve domain event history from RDAP. Returns timeline of registration, expiration, last changed, and transfer events.

Get hosting infrastructure details for a domain. Resolves A record to IP, performs reverse DNS, and queries ASN information via Team Cymru DNS. Returns IP, ASN, AS name, prefix, and hosting provider.

Search CT logs for recently issued certificates matching a pattern to discover newly registered domains. Returns domains with certificate issuance dates.

Detect if a domain is a parked/for-sale page. Resolves A record, fetches the page, and fingerprints for known parking services (Sedoparking, GoDaddy, Sedo, ParkingCrew, Bodis, etc.).

Find domains related through shared infrastructure: same nameservers, same MX records, same IP via reverse DNS, and CT log co-occurrence. Returns infrastructure-linked domains.

Multi-source domain reputation check. Queries DNS blocklists (Spamhaus DBL, SURBL), checks CT log presence, and evaluates domain age. Returns a composite reputation score.

Query RDAP (Registration Data Access Protocol) for domain WHOIS information. Returns registrar, registration dates, nameservers, and status codes.

Check BIMI (Brand Indicators for Message Identification) record for a domain. Validates the presence of v=BIMI1, logo URL (l=), and VMC certificate URL (a=).

Check DANE/TLSA records for a domain's MX hosts. Resolves MX records, then queries TLSA records at _25._tcp. using raw DNS queries. Reports certificate usage, selector, and matching type fields. Flags missing TLSA records and DANE without DNSSEC.

Check DKIM (DomainKeys Identified Mail) records for a domain by probing common selectors. Parses key type, estimates RSA key size, and flags weak keys (<1024 bits), testing mode (t=y), and revoked keys (empty p=).

Check DMARC (Domain-based Message Authentication, Reporting & Conformance) record for a domain. Parses policy (p=), subdomain policy (sp=), percentage (pct=), reporting URIs (rua/ruf), and alignment modes (aspf/adkim). Flags p=none, missing reporting, and relaxed alignment.

Check MTA-STS (Mail Transfer Agent Strict Transport Security) for a domain. Queries the _mta-sts TXT record for the policy ID, then fetches the HTTPS policy file. Parses mode (enforce/testing/none), MX patterns, and max_age. Flags testing mode, short max_age, and missing policy files.

Check PTR (reverse DNS) and FCrDNS (Forward-Confirmed reverse DNS) for a domain's MX hosts. Resolves MX -> IP -> PTR -> forward A record and verifies the IP matches. Flags missing PTR records and FCrDNS mismatches that can cause mail delivery failures.

Check SPF (Sender Policy Framework) record for a domain. Parses mechanisms, qualifiers, follows include chains, counts DNS lookups (RFC 7208 max 10), and flags misconfigurations like ~all, +all, ptr, and excessive lookups.

Run a comprehensive email security audit for a domain. Checks SPF, DKIM, DMARC, BIMI, MTA-STS, DANE/TLSA, PTR/FCrDNS, and calculates spoofability score. Aggregates all findings into a single report grouped by severity (critical/high/medium/low/info).

Recursively walk the entire SPF include chain for a domain and extract all authorized IP addresses and CIDR ranges. Reveals mail infrastructure: cloud providers, hosting ranges, third-party senders. Useful for attack surface mapping and infrastructure reconnaissance.

Calculate an email spoofability score (0-100) for a domain based on SPF, DKIM, and DMARC configuration. Returns a score, verdict (easily spoofable / moderately protected / well protected), and per-check breakdown.

Assess BGP-level impact of domain hijacking by querying Team Cymru's DNS interface for ASN, prefix, and AS owner information. Reports on the network infrastructure behind a domain and notes about RPKI/ROA protection.

Monitor DNS record changes by comparing current records against a stored baseline. On first run (no baseline), returns the current state as a JSON baseline. On subsequent runs, diffs against the provided baseline to detect added, removed, or changed records.

Detect dangling CNAME records that could allow subdomain takeover. Resolves CNAME for each subdomain, checks if target returns NXDOMAIN/SERVFAIL, and matches against known service fingerprints with HTTP confirmation.

Detect dangling MX records that could allow email hijacking. If an MX hostname resolves to NXDOMAIN, an attacker can register it to intercept all email for the domain.

Detect dangling NS records that could allow full domain takeover. If an NS hostname resolves to NXDOMAIN, an attacker can register that domain and serve arbitrary DNS responses for the target zone — a critical vulnerability.

Detect DNS rebinding candidates by resolving a domain multiple times and checking for IP changes combined with very low TTL values. DNS rebinding attacks exploit short TTLs to switch from a public IP to a private/internal IP after initial browser security checks.

Walk the DNS delegation chain and verify consistency. Checks for lame delegation (NS doesn't have zone data), missing glue records, and NS mismatch between parent and child zones.

Check domain registrar security posture via RDAP. Verifies transfer locks, delete locks, registration expiry, and other EPP status codes that protect against unauthorized domain hijacking.

Full subdomain takeover scan. Optionally discovers subdomains via Certificate Transparency (crt.sh), then checks each for dangling CNAMEs, matches against known vulnerable service fingerprints, and reports takeover risk with HTTP confirmation.

Measure DNS amplification factor of a nameserver. Sends a small query (ANY for root) and measures the response size ratio. Amplification factor > 10x indicates significant DDoS risk.

Test if a DNS nameserver allows unauthorized AXFR (zone transfer) for a domain. Successful zone transfer is a critical misconfiguration that exposes all DNS records to attackers.

Test DNS Cookie support (RFC 7873) on a nameserver. DNS cookies protect against cache poisoning, off-path attacks, and amplification. Sends a query with a client cookie and checks if the server returns a server cookie.

Test EDNS0 compliance of a DNS nameserver. Checks EDNS version, UDP buffer size, DO (DNSSEC OK) flag, and NSID option. Flags issues like missing EDNS, small buffer size, or no DNSSEC support.

Analyze nameserver diversity for a domain. Checks if NS records resolve to IPs in different ASNs, different /24 subnets, and different providers. Single point of failure = high risk if one provider goes down.

Test if a DNS nameserver is an open resolver (accepts recursive queries from any source). Open resolvers can be abused for DDoS amplification attacks. Also checks EDNS0 buffer size from OPT record.

Test if a DNS nameserver has Response Rate Limiting (RRL) enabled. Sends a burst of identical queries and checks for REFUSED responses or dropped packets, indicating active rate limiting.

Fingerprint DNS server software via CHAOS class version.bind TXT query and map to known CVEs. Identifies BIND, PowerDNS, Unbound, NSD, and Knot DNS versions.

Test if a DNS nameserver supports TCP fallback for large responses. Checks the TC (truncated) flag on UDP responses and verifies TCP port 53 connectivity. DNS over TCP is required by RFC 7766.

Test DNS-over-HTTPS (DoH) endpoint connectivity and response. Sends a JSON API query and checks response format, status, and DNSSEC (AD bit) support. Supports Cloudflare, Google, Quad9 and custom servers.

Test DNS-over-QUIC (DoQ) support on a server. Since Node.js QUIC support is experimental, performs a connectivity probe by sending a DNS query to port 853/UDP and checking for any response. Reports availability status.

Test DNS-over-TLS (DoT) endpoint connectivity and security. Reports TLS version, cipher suite, certificate validity, and DNS response. Validates that encrypted DNS transport is properly configured.

Test EDNS Client Subnet (ECS) leak on a DNS resolver. Sends a query with an ECS option containing a /24 subnet to check if the resolver forwards client subnet information to authoritative servers, potentially exposing client location.

DNS leak test: determines which resolver(s) your system is actually using by querying services that reveal resolver IP addresses. Compares observed resolver IPs against an expected resolver to detect leaks or misconfigurations.

Comprehensive privacy audit of a DNS resolver. Tests DoH support, DoT support, DNSSEC validation, and DNS Cookie support. Returns a privacy score from 0-100 based on the combined results.

CIS DNS Benchmark-style best practice checks: DNSSEC signed, email auth (SPF+DKIM+DMARC), NS diversity (>1 NS, different /24), zone transfer restricted, version.bind hidden, recursive disabled on authoritative. Returns pass/fail per check and overall score 0-100.

Runs a current DNS security audit and compares it against a baseline (JSON string from a previous run). Returns new findings, resolved findings, and unchanged findings. Useful for tracking DNS security posture over time.

Runs a comprehensive DNS security audit across all categories: DNS resolution, DNSSEC validation, email security (SPF/DKIM/DMARC), subdomain hijack (dangling CNAME/NS), Certificate Transparency, blocklist checks, and infrastructure analysis. Returns executive summary and per-category findings.

Runs a full DNS security audit and outputs in the specified format: json (raw findings), markdown (formatted report with severity headers), or sarif (SARIF 2.1.0 structure for integration with code analysis tools). Default format is json.

Tests domain DNS compliance with key RFCs: RFC 1035 (valid labels, length), RFC 4034 (DNSSEC — DS/DNSKEY), RFC 6891 (EDNS — NS responds to EDNS), RFC 7208 (SPF — TXT has SPF), RFC 7489 (DMARC — _dmarc TXT). Returns per-RFC pass/fail status.

Maps domain infrastructure fingerprint: NS, MX, IP, ASN (via Team Cymru), registrar (RDAP). Cross-references shared infrastructure to discover related domains via shared nameservers, mail servers, and IPs.

Analyzes a batch of domains for Command & Control (C2) indicators: DGA score (entropy, consonant ratio), fast-flux detection (multiple resolves), very low TTL, and DNSBL listings. Returns per-domain C2 probability score (0-100).

Analyzes domain co-hosting by resolving the domain to its IP, performing reverse DNS (PTR) lookups, and searching CT logs for other domains on the same IP. Flags hosting with suspicious co-hosted domains.

Resolves an IP address to all known domains and subdomains via reverse DNS (PTR records) and Certificate Transparency log searches. Returns all domains/subdomains hosted on the given IP.

Checks a domain against free threat intelligence feeds: DNS-based blocklists (Spamhaus DBL, SURBL) via DNS lookups, and HTTP-based feeds (URLhaus abuse.ch). Returns feed hits and threat categories.

Query passive DNS data for a domain. Uses SecurityTrails API if SECURITYTRAILS_API_KEY is set, otherwise falls back to Certificate Transparency logs (crt.sh) for historical cert data plus current multi-resolver comparison. Returns historical IPs, first/last seen timestamps.

Resolves a domain and checks if its IP belongs to known sinkhole operators (Microsoft, Shadowserver, abuse.ch, FBI, Palo Alto, Kaspersky, CrowdStrike, etc.). Returns whether the domain is sinkholed and by which operator.

Detects covert DNS channels through timing analysis (beaconing detection when timestamps are provided) and label pattern analysis (incrementing counters, session IDs, sequential encoding).

Calculates Shannon entropy per subdomain label to detect DNS tunneling. Normal DNS labels have entropy ~3.0-3.5, while encoded/encrypted data used in tunneling has entropy >4.0.

Comprehensive DNS tunneling detection that runs all 6 individual tunnel checks (entropy, length, TXT payload, record anomaly, tool signatures, covert channel), aggregates findings, and returns an overall tunnel probability score (0-100).

Measures subdomain label lengths and total query length to detect DNS tunneling. Normal browsing rarely exceeds 3 labels or 60 total characters. Tunneling often uses labels >40 chars and totals >200 chars.

Analyzes DNS queries for record type abuse patterns commonly used in tunneling. Detects indicators of NULL, TXT, CNAME, and MX record abuse, plus anomalous query patterns consistent with data exfiltration.

Matches DNS query patterns against known tunneling tool signatures (iodine, dns2tcp, dnscat2, Cobalt Strike, Sliver C2, DNSStager, etc.). Returns matched tools with descriptions and indicators.

Resolves TXT records for a domain and optional subdomains, then detects encoded payloads commonly used in DNS tunneling: base64, hex-encoded data, binary markers, and high-entropy content.

Generate all single-bit-flip variants of each character in the domain name. Filters to valid domain characters [a-z0-9-] and checks DNS registration.

Generate brand+keyword combination domains (e.g. domain-login, domain-secure, my-domain). Uses default or custom keywords. Checks DNS registration.

Run all 7 typosquatting detection techniques (homoglyph, bitsquat, TLD variation, combosquat, soundsquat, IDN homograph, keyboard proximity). Deduplicates across techniques. Optionally resolves each variant to report only registered domains.

Generate visually similar (homoglyph) domain variants using confusable characters like o/0, l/1, rn/m, cl/d, vv/w plus Cyrillic lookalikes. Checks DNS registration for each variant.

Generate IDN homograph attack variants using Cyrillic, Greek, and Armenian characters that look identical to Latin. Reports visual rendering, punycode form, and DNS registration status.

Generate QWERTY keyboard proximity typosquat variants: adjacent key substitution, character omission, character doubling, and adjacent character swap. Checks DNS registration.

Generate phonetically similar domain variants using sound substitutions (e.g. ph/f, ck/k, ee/ea, oo/u). Checks DNS registration.

Test common TLD confusions for a domain (e.g. .com to .co, .cm, .om, .net, .org, .io, etc.). Resolves each and reports registered ones with IPs.