Audit DNS and email security: SPF, DMARC, DKIM, DNSSEC, SSL, and brand protection for your domain.
Scans a domain's DNS and email authentication records to detect security gaps, spoofing risk, and misconfigurations. Checks SPF, DMARC, DKIM, DNSSEC, SSL/TLS, MTA-STS, CAA, BIMI, and more. Generates remediation plans and compliance reports.
Try asking Muse: "Check if my company domain is vulnerable to email spoofing and get a security score."
Source: Found in the official MCP Registry (com.blackveilsecurity/dns) · First listed September 24, 2026
Each bar is one check, every 15 minutes. Green means it answered. Last checked 4 h ago.
What Muse can see: It does not ask you to sign in, so it cannot see your accounts. It only sees what Muse sends it from your request.
Before it acts: Read what Muse plans to do before you approve it, and remove the app from Muse when you stop using it.
musedirectory.ai is not part of Meta. More about how Muse handles your information
Not in Muse's Connectors list yet, but Muse can still use it. Copy the request below and paste it into Muse. Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.
https://dns-mcp.blackveilsecurity.com/mcpNot in Muse's Connectors list yet. Muse can still use it: its page gives you a request to paste into Muse.
BlackVeil DNS & Email Security Scanner is a remote MCP server, so any assistant that can add a custom connector by link can use it. Same link, same tools.
In ChatGPT, open Settings, then Connectors (called Apps & Connectors on some accounts).
Under Advanced settings, switch on Developer mode. That is what lets you add a connector by link.
Choose Create, give it a name, paste the link as the MCP server URL, and save. If it needs a sign-in, ChatGPT asks for it here.
Start a chat, open the tools menu, pick the connector, and ask. ChatGPT asks before it runs a tool the first time.
Custom connectors need a paid ChatGPT plan, and on Team, Enterprise and Edu accounts only an admin can add them. Our "Working" label means the server answered us; it cannot tell whether your plan lets you add it. All connectors that work in ChatGPT
In Claude, open Settings, then Connectors.
Choose Add custom connector, give it a name, and paste the link.
If it needs a sign-in, Claude sends you to it. Then turn the connector on in a chat from the tools menu and ask.
Custom connectors are available on paid Claude plans; on Team and Enterprise accounts an admin may need to add them. Our "Working" label means the server answered us; it cannot tell whether your plan lets you add it. All connectors that work in Claude
https://dns-mcp.blackveilsecurity.com/mcpResponse time at the last check: 1541ms. Worked in 100% of checks over 30 days.
Screened, no issues found
Screening looks for known threats and hidden instructions at the time of the check, and runs again weekly and whenever the tool list changes. It cannot see the server's code, so only connect what you need and review what Muse asks to do. How screening works.
get_access_contextRead the effective authentication context for this request: tier, owner-IP-gate disposition, a keyed pseudonymous principal reference, server version and observation time. Performs no target checks or quota/session/cache/job writes. An unavailable result is not anonymous/free falcheck_mxLook up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, Microsoft 365, Proofpoint, etc.). Use when asked which email provider hosts inbound mail for a domain, or to see MX recocheck_spfLook up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax errors, and shows the trust surface (which mail servers are whitelisted). Use when you need to know who is permitted to check_dmarcLook up and validate a domain's DMARC record: enforcement level (none/quarantine/reject), alignment mode, and aggregate/forensic reporting destinations. Use to find a domain's DMARC enforcement, whether it sends aggregate reports, or whether it is protected against email impersoncheck_dkimLook up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key strength. Use to verify that outbound email signatures are cryptographically sound. Part of the scan_domain audit.check_dnssecCheck DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and DS records. Reports whether DNSSEC is enabled and validating. Part of the scan_domain audit.check_sslCheck HTTPS/TLS posture: reachability, HSTS, HTTP-to-HTTPS redirect, and certificate issuer, expiry, days remaining and SAN count from public CT logs (the latest LOGGED certificate, which may differ from the one served). TLS protocol versions and cipher suites are not assessed. Ucheck_mta_stsCheck whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy file, reports mode (enforce/testing/none) and MX coverage. Use to verify whether inbound SMTP is protected against TLS dowcheck_nsAudit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares parent and child NS sets, verifies authoritative AA responses, and checks required glue addresses. Use to detect stale regcheck_caaLook up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit.check_bimiCheck the BIMI record at default._bimi.<domain>: validates the logo URL (l=), the presence of mark-certificate authority evidence (a=; a bare URL, so VMC vs CMC is not determined), and the DMARC enforcement prerequisite (p=quarantine/reject) mail clients require. Use to assess brcheck_tlsrptCheck whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its reporting destination (rua= mailto:/https:), flagging a missing record, duplicate records, or an invalid/absent reporting URI. Complements Mcheck_http_securityAudit browser-facing HTTP security headers over HTTPS: Content-Security-Policy (unsafe-inline/unsafe-eval/wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/COEP/CORP; also detects CDN/WAF interception. Returns per-header findings focheck_daneCheck DANE/TLSA pinning for SMTP: looks up TLSA records at _25._tcp.<mx-host> for each MX and validates their fields and DNSSEC backing. Records are reported present but UNVERIFIED: there is no port-25 certificate probe, so a pin is never compared to the certificate actually servcheck_ptrVerify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit.check_dane_httpsVerify DANE/TLSA pinning for HTTPS (port 443): looks up TLSA records at _443._tcp.<domain> and validates fields and DNSSEC backing. Reported present but UNVERIFIED in every deployment: comparison with the served certificate is withdrawn (the probe cannot observe the origin certifcheck_svcb_httpsValidate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit.check_lookalikesDetect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual-confusion domains registered by attackers. Distinct from check_shadow_domains (TLD variants with auth gaps) and discovercheck_subdomailingDetect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you want to know if an SPF include chain can be hijacked through a dangling domain, or to detect subdomain mailing risk hidscan_domainRun a full DNS and email security audit for one domain across every scan-included check (SPF, DKIM, DMARC, DNSSEC and more); returns an overall score, NIST-aligned letter grade (A+ to F), maturity stage and prioritized findings. Use for a comprehensive audit, overall grade or emabatch_scanBulk-scan up to 10 domains in parallel with a full security audit each; returns score, NIST-aligned letter grade (A+ to F) and finding counts per domain. Use to audit several domains at once; use compare_domains for a side-by-side comparison of 2-5 domains. scoringModelVersion (pbatch_scan_startStart a durable asynchronous scan of 1–10 domains. Returns a stable job ID; replaying the same idempotency key with the same principal, normalized inputs, and scoring versions returns the same job.batch_scan_statusRead the owner-scoped status of an asynchronous batch scan.batch_scan_findingsFetch owner-scoped findings for a completed asynchronous batch scan.compare_domainsSide-by-side security comparison of 2–5 domains. Shows relative scores, category gaps, and unique weaknesses for each domain. Use when comparing your security posture against a competitor, or doing a head-to-head comparison between multiple domains.compare_baselineCompare a domain's current security configuration against a fixed policy baseline to determine compliance. Use to check whether a domain meets a policy requirement — not for tracking improvement/regression over time (use analyze_drift) and not for comparing multiple domains (use check_shadow_domainsFind alternate TLD variants of a domain (e.g. example.net, example.co) that have weak or missing email authentication and could be used to spoof email. Use when asked about TLD variants with email auth gaps — distinct from check_lookalikes which detects typosquat/homoglyph imperscheck_txt_hygieneAudit TXT records for stale entries and SaaS exposure.check_mx_reputationCheck whether the mail server (MX) IP addresses are listed on spam blocklists (Spamhaus, Barracuda, SORBS, and other RBLs). Also verifies reverse DNS for MX hosts. Use when you want to know if your mail server IP is blacklisted, or if your MX is on any blocklist — distinct from ccheck_srvMap a domain's DNS-visible service footprint by probing 19 common SRV prefixes (email, calendar, messaging, directory, web) in parallel; returns discovered services and flags insecure advertisements such as plaintext IMAP/POP3/LDAP with no encrypted variant. No match among probedcheck_zone_hygieneAudit DNS zone hygiene: identifies sensitive or forgotten subdomains exposed in DNS, stale SOA records, and zone propagation issues. Use to find any sensitive subdomains that should not be publicly visible, or to audit overall DNS zone cleanliness.generateGenerate a DNS/email security remediation artifact. Artifact types: spf_record (build a new SPF record), dmarc_record (create a DMARC policy), dkim_config (DKIM key setup), mta_sts_policy (generate an MTA-STS policy file), fix_plan (prioritized remediation plan for all findings),get_domain_rankRank a domain against its country or global cohort using the GSI benchmark corpus. Accepts a domain score (from scan_domain) and optional country/sector; returns a percentile: "scores better than X% of peers". Owner-gate exempt — public cohort data only.get_benchmarkGet industry benchmark data: shows what percentile a domain's security score ranks at within its sector or country cohort, the mean score, and the most common DNS security failures across the industry. Use when asked how a score compares to the industry average, what percentile aget_provider_insightsGet security benchmarks and common configuration issues for a specific email or DNS service-provider cohort (e.g. Google Workspace customers, Microsoft 365 customers). Use when asked how an email service provider compares to competitors on security posture, or to see typical miscassess_spoofabilityCompute a composite email spoofability risk score (0-100, higher = more spoofable) from SPF trust surface, DMARC enforcement and DKIM coverage. Returns a risk level (minimal to critical), per-control sub-scores and a plain-language summary. Use when asked how easy it is to spoof check_resolver_consistencyCheck DNS consistency across 4 public resolvers.explain_findingExplain a finding with impact and remediation.map_supply_chainMap DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to reveal which third-party vendors can send email as the domain, control DNS, or access integrated services. Use when asked to map third-party or sanalyze_driftMeasure whether a domain's DNS security posture improved or regressed versus a prior scan snapshot; returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements and regressions. Use for "did our score improve or regress since last timhttps://dns-mcp.blackveilsecurity.com/mcpNot in Muse's Connectors list yet, but Muse can still use it. Paste this into Muse: "Use BlackVeil DNS & Email Security Scanner to help me. It is a free service with an MCP server at https://dns-mcp.blackveilsecurity.com/mcp. It does not need an API key. Ask me before you share anything with it." Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.
At the last check (November 13, 2026, 12:46 UTC) the endpoint was working, answering in 1541ms. Over the last 7 days it answered 100% of health checks. It is checked every 15 minutes.
It was screened on September 24, 2026 with the result "screened, no issues found". Screening checks the domain against threat feeds and reads the tools for hidden instructions and requests for passwords or card numbers. It cannot see the server's code, so grant only the access you need.
It exposes 40 tools, including get_access_context, check_mx, check_spf, check_dmarc. For example, you could ask Muse: "Check if my company domain is vulnerable to email spoofing and get a security score."
This listing was added from public sources (Found in the official MCP Registry (com.blackveilsecurity/dns)). If you build BlackVeil DNS & Email Security Scanner, claim it to correct the details and get your badge.
Paste this on your site or README. It always shows the latest check.
<a href="https://musedirectory.ai/connector/blackveil-dns-email-security-scanner"><img src="https://musedirectory.ai/badge/blackveil-dns-email-security-scanner.svg" alt="BlackVeil DNS & Email Security Scanner on musedirectory.ai" width="236" height="40"></a>