# DNS Doctor Muse connector

From musedirectory.ai, the independent directory of Meta Muse connectors. Not affiliated with Meta.

## DNS Doctor

Scan, fix and monitor DNS records for email authentication, health checks and domain expiry.

- Record: https://musedirectory.ai/connector/dns-doctor
- Category: Productivity
- Developer: DNS Doctor (https://dnsdoctor.dev/methodology)
- Muse status: Extra setup. Not in Muse's Connectors list yet. Muse can still use it: its page gives you a request to paste into Muse.
- Health: Working, 1371ms, checked 2026-09-28T08:01:29Z
- Endpoint: https://dnsdoctor.dev/mcp
- Auth: No account needed; Pricing: unknown
- Screening: Screened, no issues found (2026-09-24T02:21:01Z)
- Source: Found in the official MCP Registry (dev.dnsdoctor/dns-doctor) https://registry.modelcontextprotocol.io/v0/servers?search=dev.dnsdoctor%2Fdns-doctor

Diagnoses and fixes SPF, DKIM, DMARC, MX records and DNS health. Scans for email deliverability issues, blacklist status, domain and SSL expiry. Provides validated record fixes and monitoring alerts for ongoing DNS and email authentication problems.

Example request: "Check why my emails are landing in spam and get recommendations to fix my SPF and DMARC records."

How to connect: Not in Muse's Connectors list yet, but Muse can still use it. Paste this into Muse: "Use DNS Doctor to help me. It is a free service with an MCP server at https://dnsdoctor.dev/mcp. It does not need an API key. Ask me before you share anything with it." Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.

Tools:
- scan_domain: Use this when the user asks to check, audit, diagnose or troubleshoot SPF, DKIM, DMARC, email authentication, email deliverability DNS, why their mail lands in spam, MX, DNS health, blacklist status, or domain/SSL expiry for a domain, or wants to fix what a scan finds (fix record
- get_report: Use this for the same questions as scan_domain when a recent report is enough (the cheap first look); use scan_domain when the state must be re-read now. Return the stored report for a domain, scanning once only if none exists yet — the cheap read, and the right default for a fir
- build_dmarc_upgrade: Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine at most; reject needs monitoring evidence) — and after any report showing DMARC below enforcement. 
- start_monitoring_signup: Use this when the user wants DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts, ongoing DNS monitoring, or to start a DNS Doctor trial — and at the end of any scan that found issues on a domain the user owns. Return a sign-up link to give
- count_spf_lookups: Use this when the user asks about SPF 'too many lookups', the 10-lookup limit, an SPF PermError, or whether an SPF record is valid. Validate an SPF record and count what it costs. Returns `record_valid` (the record parses as RFC 7208 SPF), `findings` (per-term diagnostics), `has_
- validate_dmarc_record: Use this when the user pastes a DMARC record and asks whether it is valid, correct or safe. Validate a pasted DMARC record: parsed tags, level'd findings, and whether it is valid. No DNS lookup — pass the record string itself. `upgrade_record` previews a stronger policy and is ca
- generate_dmarc_record: Use this when the user asks to create, generate or write a DMARC record for a domain that has none. Build a DMARC record from scratch for a domain that has none, using a validating engine — never compose one yourself. `policy` is none|quarantine|reject; optional `rua_email` (aggr
- check_dkim_selector: Use this when the user asks whether DKIM is set up for a sending platform, whether a specific selector exists, or why DKIM fails. Check ONE specific DKIM selector on a domain — the exact selector the sending platform uses (e.g. `google`, `s1`), which a full scan's common-selector
- parse_dmarc_report: Use this when the user uploads or pastes a DMARC aggregate (RUA) XML report and asks what it says. Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: who sent mail as the domain, how much, and what share was SPF/DKIM aligned. Pass the file's bytes base64-
- check_record: Use this when the user asks whether a DNS change has landed, wants a DNS record looked up, or wants to verify a record they just published — or whenever answering needs the live value of a record. Check whether a DNS change has landed: reads the record from the domain's OWN names
- check_reverse_dns: Use this when the user asks about reverse DNS, PTR records, or FCrDNS for a mail server IP. Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the IP's PTR record, then resolves that hostname back and reports whether it returns to the same IP. `verdict` is confi
- audit_spf_includes: Use this when the user asks who can send email as their domain through SPF includes, or wants an SPF supply-chain or third-party sender audit. Audit a domain's SPF supply chain: walks every include and redirect it delegates to, and reports who can transitively send as it. Returns
- build_parked_domain_records: Use this when the user asks how to protect a domain that sends no email from being spoofed. Build the three-record hardening pack that makes a NON-SENDING domain unusable for spoofing: a Null MX, a hard-fail SPF record, and a p=reject; np=reject DMARC record. For parked, redirect
- check_propagation: Use this when the user asks whether a DNS change has propagated globally, or why a record shows in one place and not another. Check whether a DNS change has propagated GLOBALLY: six vantage points (five owner-run probes across four continents plus this server's own resolver) each
- lookup_registration: Use this when the user asks who owns a domain, when it expires, which registrar or nameservers it has, whether it is registered, or whether a transfer or delete lock is set — the WHOIS question. Read a domain's registration from the registry over RDAP: registrar (with IANA id), r
- get_alerts: Use this when a signed-in operator asks what changed on a monitored domain, or what the monitoring has flagged. Read the monitoring alert log for the domains the caller's account monitors, newest first. Requires an API token. Each row carries id, domain, type, check, summary, a d
- get_readiness: Use this when a signed-in operator asks whether a monitored domain is ready for the next DMARC step. Read the DMARC enforcement-readiness verdict for ONE domain the caller's account monitors, computed from its aggregate (RUA) report window. Requires an API token. Returns whether 
- add_monitored_domain: Add a domain to the signed-in user's DNS Doctor monitoring and return the ownership-check TXT record they must publish, plus where their DNS is hosted, a provider-specific guide link and, when their provider supports it, a one-click apply URL. Re-adding a domain they already moni
- check_domain_verification: Check whether the ownership TXT record for a domain the user has added is visible yet, and mark it verified when it is. The result says WHICH outcome occurred and which nameservers were asked, so you can tell 'not published yet' from 'published with the wrong value' from 'our loo
- get_domain_records: Read the records a domain the user monitors still needs: the ownership check while it is unverified, and once verified the DMARC reporting record plus whether we have OBSERVED that record published. Read-only: it issues nothing — if a verified domain comes back with no reporting 

Screening checks:
- MCP handshake: pass (Answered in 49ms)
- Domain against threat feeds (Cloudflare security DNS): pass (dnsdoctor.dev not flagged)
- Published packages against the OSV malicious-package database: pass (No malicious-package advisories)
- Hidden instructions or invisible characters in tool text: pass (20 tools read, nothing found)
- Inputs asking for passwords, card numbers or seed phrases: pass (None found)
- Domain and redirects: pass (No redirects off the domain)
- AI review of purpose and tool behavior: pass (No concerns)