Domain Health

Why is mail from this domain going to spam, and is the domain about to lapse? Domain Health checks a domain the way receiving mail servers and registries see it, and says what to fix:

• SPF evaluated in full, as RFC 7208 defines it: the whole include tree, the count of DNS lookups against the limit of 10 (one more include silently breaks SPF for all your mail), void lookups, syntax, and for a sending IP the verdict a receiver would reach (pass, fail, softfail, neutral, permerror) with the mechanism that decided it.

• DMARC found by walking up the DNS tree, so a subdomain shows the policy it inherits; DKIM keys with their type and size (a 1024-bit key still works, 2048 is recommended); MTA-STS, TLS-RPT, BIMI and CAA.

• Gmail and Yahoo bulk-sender rules: whether SPF, DKIM and DMARC are in place. DKIM selectors cannot be listed from DNS, so a key not at common selectors is reported as not confirmed, never as missing.

• Registration from the registry's own RDAP server: registrar, creation and expiry dates, days left, status codes, DNSSEC; availability of names you are thinking of registering.

domain_report answers most questions in one call, with findings ranked error, warning, info, each with a fix. No account or key needed.

Built and maintained by Arhan Canli.

Install

Needs Node.js 20 or newer. No account or key.

Claude Code

claude mcp add domain-health -- npx -y domain-health-mcp

Claude Desktop: download domain-health-mcp-<version>.mcpb from the latest release and open it. The bundle is signed; verify it with gh attestation verify <file> --repo arhancanli/domain-health-mcp.

Any other client (Windsurf, Zed, Cline, Continue and others), in its MCP config file:

{
  "mcpServers": {
    "domain-health": {
      "command": "npx",
      "args": [
        "-y",
        "domain-health-mcp"
      ]
    }
  }
}

Docker

docker build -t domain-health-mcp https://github.com/arhancanli/domain-health-mcp.git && docker run -i --rm domain-health-mcp

Hosted (Streamable HTTP): node src/server.mjs --http serves stateless MCP at POST /mcp (port from PORT, default 3000).

Related MCP server: Domain Deliverability Checker MCP Server

Example

An agent calls domain_report with:

{
  "domain": "google.com"
}

and gets back (recorded from the live server on 2026-09-26):

{
  "domain": "google.com",
  "registration": {
    "registrar": "MarkMonitor Inc.",
    "created": "1997-09-15",
    "expires": "2028-09-14",
    "days_left": 718,
    "dnssec": false
  },
  "nameservers": [
    "ns4.google.com",
    "ns1.google.com",
    "ns2.google.com",
    "ns3.google.com"
  ],
  "mx": [
    "10 smtp.google.com"
  ],
  "spf": {
    "record": "v=spf1 include:_spf.google.com ~all",
    "lookups": 1,
    "all": "~all"
  },
  "dmarc": {
    "policy": "reject",
    "reports": 1
  },
  "mta_sts": true,
  "tls_rpt": true,
  "caa": [
    "pki.goog"
  ],
  "bulk_sender_dns": "SPF and DMARC meet the requirements; DKIM not confirmed (no key at common selectors)",
  "findings": [
    {
      "level": "info",
      "issue": "No DKIM key at 12 common selectors. Senders that sign use their own selector.",
      "fix": "Check with check_dkim and the selector from a sent message (DKIM-Signature s=)."
    }
  ]
}

Tools

How it behaves

• Read-only and passive: it asks public resolvers and registries, and never connects to the domain being checked (no mail server probes, no web requests to it).

• Network: HTTPS only. DNS goes to Cloudflare's and Google's DNS-over-HTTPS resolvers; RDAP goes only to the registry servers IANA's bootstrap file names (the RDAP client's allowlist is built from that file); the Public Suffix List comes from publicsuffix.org. Nothing else is contacted, and nothing is logged except unexpected failures (to stderr, without your inputs).

• DNS answers are cached for 30 seconds, since people check right after changing records.

• Results are compact JSON with a matching output schema. Long record lists say how many were left out.

Benchmark

Measured 2026-09-26 with gpt-5.4-mini, 13 fixed tasks graded by fixed checks (bench/tasks.json, raw results in bench/results/).

Performance

Measured 2026-09-26 from Dubai, home connection against the live upstream, Node 24.19.0 (bench/perf.json, scripts/perf.mjs in the factory).

First call: a fresh server process, including the TLS connection and the upstream's own time. Repeat: the same call again, answered from the in-process cache, so it shows this server's own overhead.

Tool definitions the model reads on every turn (name, description, input schema): 2,503 characters, against 254 for mcp-dns, the most-used DNS lookup server. The full tool list, with the output schemas and annotations clients use to validate results, is 4,239 characters (253 for the alternative).

Data sources

• DNS: Cloudflare and Google public DNS over HTTPS.

• Registration: each registry's RDAP server, found through IANA's RDAP bootstrap.

• Registrable domains: the Public Suffix List (ICANN section).

More MCP servers by Arhan Canli

• Actions Check: Checks GitHub Actions workflows: outdated actions, old Node runtimes, retired runners, injection.

• Config Check: Validates config files against their official schemas: tsconfig, compose, workflows, 1,400+ more.

• Cron Check: Explains cron expressions, lists next run times in any time zone, converts between cron dialects.

• Dockerfile Check: Checks Dockerfiles: build-breaking mistakes, base image tags that exist, digests, platforms, EOL.

• End of Life: Is this version still supported? EOL dates, latest patch and upgrade target for 470+ products.

• Internet Standards: RFC sections, status, obsoleted-by chains, errata and IANA registries for coding agents.

• Kube Check: Checks Kubernetes manifests for your version: removed APIs, unknown fields, Pod Security, risks.

• License Check: Open source license answers: SPDX ids, copyleft, and whether a dependency's license fits yours.

• The whole collection, 12 more

License

MIT, Copyright (c) 2026 Arhan Canli.