Skip to content

DomainCanary

by domaincanary.com · remote · no sign-in to list tools · v1.0.0 · published by com.domaincanary

Check a domain's DMARC, SPF and DKIM, build SPF records, explain bounces, read DMARC reports.

Changes · 2
CompareRegistry entry

4 tools: 2 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http domaincanary https://domaincanary.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 2Claude Code: ask
  • build_spfUse this when someone lists the services that send their email and wants the SPF record to publish, or wants a sender added to the SPF record they already have.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when someone lists the services that send their email and wants the SPF record to publish, or wants a sender added to the SPF record they already have. Takes provider names such as Google Workspace or Mailchimp, include terms such as include:spf.example.com, or IP addresses, and returns one merged record with its count of DNS lookups against the limit of ten. Pass the domain when you know it, so the result includes the senders already in its published record.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: true
  • check_domainUse this when someone asks whether a domain's email authentication is set up correctly, why mail from a domain fails DMARC, SPF or DKIM, or which DNS records to publish for it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when someone asks whether a domain's email authentication is set up correctly, why mail from a domain fails DMARC, SPF or DKIM, or which DNS records to publish for it. Reads the domain's live DMARC, SPF and DKIM records and returns what is wrong with each, plus the records to add or change. Pass a DKIM selector when you know it. Without one, common selectors are tried. Takes a domain name only, not a mailbox address or an IP address.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: true
Only reads 2Claude Code: allow
  • analyze_reportUse this when someone has a DMARC aggregate report and wants to know which senders passed and which failed.No findings

    Why it is in this group

    • The name "analyze_report" says "analyze": a word for reading.
    Description, as the server wrote it
    Use this when someone has a DMARC aggregate report and wants to know which senders passed and which failed. The report is the XML, .gz or .zip file that receivers such as Google and Yahoo email to the address in a domain's rua tag. In ChatGPT, pass the uploaded file. Elsewhere, pass the report XML as text. Returns totals per report and each sending IP address with its SPF, DKIM and DMARC results. The result gives a next step for the report's domain and a link to a live check of that domain's DNS records. Nothing from the report is stored.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • explain_bounceUse this when someone pastes a bounce message, an SMTP reply such as 550 5.7.26, or an Authentication-Results header and asks what it means or how to fix it.No findings

    Why it is in this group

    • The name "explain_bounce" says "explain": a word for reading.
    Description, as the server wrote it
    Use this when someone pastes a bounce message, an SMTP reply such as 550 5.7.26, or an Authentication-Results header and asks what it means or how to fix it. Returns what the receiving server refused, what to change, when it clears, and the page that explains it. Works from the pasted text alone and reads no DNS records.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http domaincanary https://domaincanary.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__domaincanary__explain_bounce",
      "mcp__domaincanary__analyze_report"
    ],
    "ask": [
      "mcp__domaincanary__check_domain",
      "mcp__domaincanary__build_spf"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as domaincanary. Review it before you use it.