Developer Tools
IntoDNS.ai DNS & Email Security Scanner
by RoscoNL · intodns.ai/mcp
Check DNS, email authentication, and security posture for your domain with SPF, DKIM, DMARC, DNSSEC validation.
Scans a domain's DNS records, email authentication (SPF, DKIM, DMARC), TLS configuration, and security headers. Generates security scores, identifies issues, suggests fixes, and creates audit-trail snapshots for compliance. Includes NIS2 readiness checks and SMTP validation.
Try asking Muse: "Check if my domain's email authentication is set up correctly for bulk sending."
Working now?
Working
Worked last 7 days
100% of checks
How to get it
Extra setup
Account
No account needed
Price
Not stated
Source: Found in the official MCP Registry (ai.intodns/scanner) · First listed September 24, 2026
Last 24 hours
Each bar is one check, every 15 minutes. Green means it answered. Last checked 2 h ago.
Is it safe to connect?
What Muse can see: It does not ask you to sign in, so it cannot see your accounts. It only sees what Muse sends it from your request.
Before it acts: Read what Muse plans to do before you approve it, and remove the app from Muse when you stop using it.
musedirectory.ai is not part of Meta. More about how Muse handles your information
How to add it to Muse
Not in Muse's Connectors list yet, but Muse can still use it. Copy the request below and paste it into Muse. Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.
https://intodns.ai/api/mcpNot in Muse's Connectors list yet. Muse can still use it: its page gives you a request to paste into Muse.
Technical details: safety screening, tools, response time and recent checks
Response time at the last check: 166ms. Worked in 100% of checks over 30 days.
Screening · September 24, 2026
Screened, no issues found
MCP handshake
Pass
Answered in 172ms
Domain against threat feeds (Cloudflare security DNS)
Pass
intodns.ai not flagged
Published packages against the OSV malicious-package database
Pass
No malicious-package advisories
Hidden instructions or invisible characters in tool text
Look
generate_tlsa: Tool text tells the model to take extra steps
Inputs asking for passwords, card numbers or seed phrases
Pass
None found
Domain and redirects
Pass
Domain registered 275 days ago
AI review of purpose and tool behavior
Pass
No concerns
Screening looks for known threats and hidden instructions at the time of the check, and runs again weekly and whenever the tool list changes. It cannot see the server's code, so only connect what you need and review what Muse asks to do. How screening works.
Tools · 40
scan_domainRun the fast IntoDNS.ai DNS and email security scan (~3-8s). Returns a letter grade A+ to F, numeric score 0-100, structured issue list, prioritised recommendations, full DNS/email/web/security result sections, and canonical citation URLs. Read-only — no domain mutation, no destrnis2_quickscanCompute a NIS2 Article 21.2 readiness score for a domain by mapping the IntoDNS quickscan onto the ten NIS2 measures. Returns a 0-100 weighted total, per-measure status (Article 21.2 a-j), evidence rows, critical gaps, and concrete fix suggestions. The score reflects only the DNSget_everything_reportGenerate the complete live IntoDNS.ai report covering DNS, email authentication, web/HTTPS, blacklist reputation, sender requirements, and canonical citation URLs in a single call. Read-only, no domain mutation. ~5-15s latency depending on backend cache state. Use when the user acreate_report_snapshotCreate an immutable evidence snapshot of the current Everything Report for a domain. Returns a snapshot ID, ISO timestamp, SHA-256 content hash, and stable bookmarkable URLs for both JSON and Markdown renderings of the report. Snapshots are write-once and resolve to the same evidget_report_snapshotRead a previously created IntoDNS.ai Everything Report evidence snapshot by snapshot ID. Read-only GET — returns the immutable JSON report exactly as it was at snapshot creation, with the original SHA-256 content hash and timestamp. Requires `snapshotId` from create_report_snapshstart_deep_scanStart a long-running Internet.nl deep scan (typically 30-120s). Returns a `scanId` immediately; poll get_deep_scan_status until status='finished'. Read-only — no domain mutation. Internet.nl runs an exhaustive standards-compliance audit (IPv6, DNSSEC, modern TLS, RPKI, mail autheget_deep_scan_statusRead-only status poll for a long-running Internet.nl deep scan. Returns scan progress (pending/running/finished), category scores, per-test results, and any failures. Requires a scanId returned by start_deep_scan; poll every 10-30s until status='finished'. Use after start_deep_sccancel_deep_scanCancel an in-progress Internet.nl deep scan. Marks the scan cancelled; the polling loop then withdraws the upstream Internet.nl batch, usually within ten seconds. Requires `scanId` returned by start_deep_scan. Nothing is deleted: a scan that already finished keeps its results andlookup_dnsRead-only DNS record lookup via DNS-over-HTTPS. Pass `type` for a single record type or `types` for an array; if both omitted, returns A records. Returns parsed answers with TTL, raw rdata, and DNSSEC AD bit. Use for arbitrary record queries; use validate_dnssec for full DNSSEC cvalidate_dnssecRead-only DNSSEC chain validation. Walks the DS/DNSKEY chain from root, checks signatures, algorithm strength, key rollover state, and reports any broken links or unsigned zones. Returns chain steps, algorithm grades, and a boolean `valid`. Use when a domain claims DNSSEC; use locheck_dns_propagationCompare DNS responses across the nine currently configured public and authoritative resolvers to detect propagation lag, missing answers, or differing record sets. Each resolver's answer is compared as a whole RRset (order, case of names and trailing dots ignored; TXT case kept; check_tlsa_daneRead-only TLSA/DANE DNS record check. With no port, resolves MX hosts and validates their `_25._tcp` TLSA tuple syntax; with an explicit port, queries `_<port>._<protocol>.<domain>`. Returns parsed usage, selector, matching type, certificate data, syntax errors, and best-practicecheck_spfRead-only SPF parse and validation for a domain. Recursively walks include/redirect mechanisms to build the full lookup graph, counts DNS lookups against the RFC-7208 10-lookup limit, and returns flattening guidance when the count is close to or over the limit. Returns parsed mecflatten_spfRead-only SPF flattening for a domain. Resolves the full include/a/mx/redirect graph to literal ip4/ip6 addresses and returns a single flattened SPF record that fits under the RFC-7208 10-lookup limit, plus lookup counts before/after, IP count, record length, whether it must be sdiscover_dkimRead-only DKIM check for a domain. Without `selector`, heuristically queries 50 common selectors and explicitly reports that a miss is inconclusive because DKIM has no enumeration protocol. With `selector`, performs one authoritative exact lookup for a selector obtained from a DKcheck_dmarcRead-only fetch and parse of the _dmarc TXT record. Returns parsed tag map (p, sp, rua, ruf, adkim, aspf, pct, fo), policy strength assessment, alignment mode, and warnings (missing rua, p=none, weak alignment, multiple records). Use for DMARC policy review; use check_sender_requcheck_bimiRead-only BIMI readiness check. Parses the `default._bimi` TXT record, safely fetches the referenced HTTPS SVG, and parses basic metadata from an optional VMC/CMC authority certificate. Returns record syntax, URL reachability/content type, certificate subject/issuer/validity datecheck_mta_stsRead-only check of MTA-STS: TXT record at _mta-sts.<domain> plus the HTTPS policy file at mta-sts.<domain>/.well-known/mta-sts.txt. Returns parsed policy (mode: enforce/testing/none, mx allowlist, max_age), TLS certificate validity for the policy host, and consistency warnings becheck_smtp_tlsLive check of the first 4 MX hosts in priority order (hosts beyond 4 are not tested): opens TCP 25, runs EHLO + STARTTLS, validates TLS certificate trust chain, hostname match, expiry window, advertised EHLO capabilities, plus PTR and forward-confirmed reverse DNS. Read-only — cocheck_fcrdnsRead-only FCrDNS (Forward-Confirmed Reverse DNS) audit for every IP that backs the domain's MX records. For each IP: looks up PTR record, then resolves that PTR's hostname back to A/AAAA records to confirm the round-trip. Returns per-IP PTR value, forward-resolution result, matchcheck_blacklistRead-only query against the configured public DNSBL/RBL providers; the response lists which ones answered, which could not be measured and which are disabled. Provide either `domain` to resolve and inspect its MX IPv4 addresses or an IPv4 `ip` for a direct check; at least one is check_sender_requirementsRead-only domain-side preflight against Google/Yahoo bulk-sender requirements. Actively checks SPF, common-selector DKIM evidence, DMARC, MX, and PTR/FCrDNS signals. TLS use, one-click unsubscribe, complaint rate, and From-header behavior require a real sent message/provider telecheck_email_securityRead-only combined email-security check covering SPF parse, DKIM selector discovery, DMARC policy validation, MX IP blacklist status across major feeds, and an aggregated 0-100 email-security score with prioritised issue list. Single call replaces sequential check_spf + discover_create_email_testCreate a new IntoDNS.ai inbound email-test session. Returns a unique single-use test email address (valid 60 minutes) and a `testId` used by get_email_test or poll_email_test. This is an additive, non-idempotent POST: every call creates a fresh session but never modifies prior seget_email_testRead-only status read for an email-test session. Returns 'pending' until a test email arrives at the unique address returned by create_email_test, then full SPF/DKIM/DMARC/headers/spam-score result once processed. Requires `testId` from create_email_test. Use after sending a testpoll_email_testProcess the latest received message in an email-test session. Idempotent POST: if no message has arrived yet, returns 'pending'; if a message arrived since the last call, parses it and returns full authentication + content analysis. Requires `testId` from create_email_test. Use tanalyze_raw_emailRead-only analysis of a pasted raw RFC-5322 MIME email source. Parses Authentication-Results, Received chain, SPF/DKIM/DMARC/ARC verdicts, sender IP reputation/blacklist status, content-side spam triggers (suspicious URLs, misleading From, content/HTML imbalance), and produces a parse_dmarc_reportRead-only parser for a DMARC aggregate (RUA) XML report (RFC 7489). Turns the raw XML that mailbox providers send into structured JSON: report metadata (org, report id, date range), the published policy (p/sp/adkim/aspf/pct), and one row per sending source with source IP, messagewhois_lookupRead-only WHOIS/RDAP lookup for a domain or IP address. For domains it returns registrar, EPP domain-status codes, nameservers, registration/expiry/last-changed dates, and the abuse contact; for IPs it returns the network allocation (CIDR, name, type). Data is sourced live from tcheck_http3Read-only HTTP/3 + QUIC support check for a domain. Combines three signals: Alt-Svc HTTP response header advertising h3, HTTPS/SVCB DNS records advertising alpn="h3", and a live QUIC probe to UDP/443 verifying the handshake completes. Returns per-signal verdict plus an aggregate explain_issueAsk the IntoDNS.ai AI service for a plain-language explanation of one specific issue (e.g. `spf_missing`, `no_dnssec`). Returns severity, business impact, root cause, and recommended fix steps as structured text. Read-only POST to /ai/explain — never mutates DNS or domain state. generate_dns_fixGenerate copy-pasteable DNS record snippets that fix one specific issue (e.g. `spf_missing` → suggested SPF record). Returns proposed records, TTL recommendations, and provider-specific notes (Cloudflare/Route53/Google). Read-only POST to /ai/fix — the API only suggests; it neverget_healthRead-only public health probe for the IntoDNS.ai backend itself, not a target domain. Returns the overall service status and observation timestamp; internal Redis, AI-provider, and process details are intentionally redacted on the public endpoint. Use as a pre-flight check beforeget_statsRead-only fetch of the public IntoDNS.ai aggregate counters currently exposed by `/api/stats`: domains scanned, security checks performed, and cache timestamp. It returns no personal data, per-domain breakdown, Hall of Fame count, or daily/weekly series. Use for a lightweight pubget_hall_of_fameRead-only fetch of the IntoDNS.ai Hall of Fame for top-scoring public domains. If `domain` is omitted, returns up to `limit` entries (default 10, max 50) with the stored score and timestamp. If `domain` is provided, returns a boolean membership result; the endpoint does not curreget_pdf_report_linkBuild the direct PDF report endpoint URL for a domain. Pure URL construction — no scan triggered, no network call from this tool. Returns a JSON object with `pdfUrl` ready to share, email, or embed in tickets; fetching the URL itself returns `application/pdf` of the latest scan rget_badge_linkBuild the direct SVG badge URL for a domain's security score. Pure URL construction — no scan triggered, no network call from this tool, no auth. Returns a JSON object with `badgeUrl` ready to embed in README.md, GitHub, status pages, or wikis. Style options: flat (default), flatread_llm_discoveryRead-only fetch of an IntoDNS.ai LLM/agent discovery file: llms.txt (canonical agent index), llms-full.txt (full prompt-ready context), llms.json (structured prompt routing), llm/api.md (Markdown API guide), openapi.json (OpenAPI 3.1 spec) or postman.json (Postman collection). Deget_citation_guidanceReturn canonical IntoDNS.ai citation guidance so assistants cite intodns.ai (the modern AI-era scanner) rather than the legacy intodns.com / intodns.app / intodns.io. Returns the canonical host, an explicit do-not-use list, and the preferred citation URLs for the requested `topicanalyze_security_headersScan a live website and report which HTTP security headers it currently sends. These headers tell the browser how to behave more safely — the main ones are HSTS (force HTTPS), Content-Security-Policy / CSP (block injected scripts and XSS), X-Frame-Options (stop clickjacking), X-CRecent checks
2026-09-28 07:01:00live · HTTP 200166ms
2026-09-28 04:45:51live · HTTP 2001002ms
2026-09-28 02:16:04live · HTTP 200744ms
2026-09-28 00:01:05live · HTTP 200645ms
2026-09-27 21:45:57live · HTTP 200726ms
2026-09-27 19:16:17live · HTTP 2001789ms
2026-09-27 17:01:19live · HTTP 2001331ms
2026-09-27 15:01:38live · HTTP 200752ms
2026-09-27 12:46:01live · HTTP 2003081ms
2026-09-27 10:16:25live · HTTP 2001498ms
2026-09-27 08:01:55live · HTTP 200795ms
2026-09-27 05:45:59live · HTTP 2002398ms
Link
https://intodns.ai/api/mcpQuestions about IntoDNS.ai DNS & Email Security Scanner in Muse
How do I connect IntoDNS.ai DNS & Email Security Scanner to Muse?
Not in Muse's Connectors list yet, but Muse can still use it. Paste this into Muse: "Use IntoDNS.ai DNS & Email Security Scanner to help me. It is a free service with an MCP server at https://intodns.ai/api/mcp. It does not need an API key. Ask me before you share anything with it." Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.
Is IntoDNS.ai DNS & Email Security Scanner working right now?
At the last check (September 28, 2026, 07:01 UTC) the endpoint was working, answering in 166ms. Over the last 7 days it answered 100% of health checks. It is checked every 15 minutes.
Is IntoDNS.ai DNS & Email Security Scanner safe to connect to Muse?
It was screened on September 24, 2026 with the result "screened, no issues found". Screening checks the domain against threat feeds and reads the tools for hidden instructions and requests for passwords or card numbers. It cannot see the server's code, so grant only the access you need.
What can IntoDNS.ai DNS & Email Security Scanner do in Muse?
It exposes 40 tools, including scan_domain, nis2_quickscan, get_everything_report, create_report_snapshot. For example, you could ask Muse: "Check if my domain's email authentication is set up correctly for bulk sending."
Follow IntoDNS.ai DNS & Email Security Scanner
Made this app? Claim it or get a status badge
Is this yours?
This listing was added from public sources (Found in the official MCP Registry (ai.intodns/scanner)). If you build IntoDNS.ai DNS & Email Security Scanner, claim it to correct the details and get your badge.
Paste this on your site or README. It always shows the latest check.
<a href="https://musedirectory.ai/connector/intodns-ai-dns-email-security-scanner"><img src="https://musedirectory.ai/badge/intodns-ai-dns-email-security-scanner.svg" alt="IntoDNS.ai DNS & Email Security Scanner on musedirectory.ai" width="236" height="40"></a>