D
dns
20 endpointsliveDNS & email security scanner — 51 tools for SPF, DMARC, DKIM, DNSSEC, SSL, and more. (MCP server com.blackveilsecurity/dns, aggregated from the official registry)
$Set up https://cracked-ai-pearl.vercel.app/SKILL.md, and then use Cracked to show me what I can do for dns.
| Endpoint | What it does | Price | Health |
|---|---|---|---|
| check mx /check_mx | Look up MX records for a domain. Identifies which mail servers receive inbound email for the domain and which email hosting provider is used (Google Workspace, | $0.0020 per call | unknown |
| check spf /check_spf | Look up and validate the SPF record for a domain. Lists all IP addresses and third-party senders authorised to send email on behalf of the domain, flags syntax | $0.0020 per call | unknown |
| check dmarc /check_dmarc | Look up and validate the DMARC record for a domain. Shows the enforcement level (none/quarantine/reject), alignment mode (strict/relaxed), and aggregate/forensi | $0.0020 per call | unknown |
| check dkim /check_dkim | Look up DKIM records for a domain. Probes common selectors, validates the signing algorithm used for outgoing email (RSA-1024/2048, Ed25519), and reports key st | $0.0020 per call | unknown |
| check dnssec /check_dnssec | Check DNSSEC status for a domain. Verifies whether DNS is tamper-proof and protected against cache poisoning and DNS spoofing attacks by validating DNSKEY and D | $0.0020 per call | unknown |
| check ssl /check_ssl | Check the HTTPS/TLS posture of a domain: HTTPS reachability, HSTS policy, and HTTP-to-HTTPS redirect. Also returns certificate metadata (issuer, expiry date, da | $0.0020 per call | unknown |
| check mta sts /check_mta_sts | Check whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks. Queries _mta-sts.<domain> and fetches the policy fi | $0.0020 per call | unknown |
| check ns /check_ns | Audit a domain’s nameserver delegation and redundancy. Identifies the DNS hosting provider and, when the infrastructure probe is available, directly compares pa | $0.0020 per call | unknown |
| check caa /check_caa | Look up CAA records for a domain. Shows which Certificate Authorities are authorized to issue certificates. Part of the scan_domain audit. | $0.0020 per call | unknown |
| check bimi /check_bimi | Check the BIMI brand-logo record at default._bimi.<domain>. Validates the logo URL (l=) and the presence of mark-certificate authority evidence (a=) — the a= ta | $0.0020 per call | unknown |
| check tlsrpt /check_tlsrpt | Check whether a domain has SMTP TLS Reporting (TLS-RPT) configured. Queries _smtp._tls.<domain> for the v=TLSRPTv1 record and validates its reporting destinatio | $0.0020 per call | unknown |
| check http security /check_http_security | Audit a domain's browser-facing HTTP security headers over HTTPS. Inspects Content-Security-Policy (flagging unsafe-inline/unsafe-eval/wildcards), X-Frame-Optio | $0.0020 per call | unknown |
| check dane /check_dane | Check DANE/TLSA certificate pinning for SMTP at port 25. Resolves the domain's MX hosts and looks up TLSA records at _25._tcp.<mx-host>, verifying whether SMTP | $0.0020 per call | unknown |
| check ptr /check_ptr | Verify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers. Part of the scan_domain audit. | $0.0020 per call | unknown |
| check dane https /check_dane_https | Verify DANE certificate pinning for HTTPS connections. Looks up TLSA records at _443._tcp.{domain} (port 443) to confirm the web certificate is pinned in DNS. D | $0.0020 per call | unknown |
| check svcb https /check_svcb_https | Validate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement. Part of the scan_domain audit. | $0.0020 per call | unknown |
| check lookalikes /check_lookalikes | Detect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing. Identifies character-substitution and visual- | $0.0020 per call | unknown |
| check subdomailing /check_subdomailing | Detect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain. Use when you | $0.0020 per call | unknown |
| scan domain /scan_domain | Run a full DNS and email security audit for a single domain. Aggregates every scan-included check in parallel (SPF, DKIM, DMARC, DNSSEC, TLS/SSL, MTA-STS, CAA, | $0.0020 per call | unknown |
| batch scan /batch_scan | Bulk-scan up to 10 domains in parallel. Runs a full security audit on each domain in the list and returns score, NIST-aligned letter grade (6-band A+/A/B/C/D/F) | $0.0020 per call | unknown |