A remote MCP server that lets an assistant run domain health checks on email authentication, SSL/TLS, security headers and registration records.
What you can do
Check email authentication: MX, SPF with includes and lookup limits, DMARC policy and alignment, DKIM selectors, plus BIMI and MTA-STS, explained in plain words as inbox delivery and forgery risk. Check SSL/TLS on port 443: issuer, expiry, chain trust, name match, key type and size, accepted TLS versions and CAA records. Read and grade HTTP security headers the homepage sends, such as HSTS, CSP, clickjacking protection and Referrer-Policy. Read public registration data over RDAP: registrar, dates, status locks, danger states and nameservers, compared with DNSSEC. Run all checks at once with a full report scoring each area and listing top fixes.
When to use it
Useful when you want an assistant to audit a domain before launch, diagnose why email lands in spam or can be forged, review certificate and TLS configuration, or get a quick overall health score for a domain you own or are evaluating.
Requirements
A remote streamable HTTP endpoint; no local runtime, package, account, API key or environment variable is declared. The assistant needs network access to the endpoint, and the server itself must be able to reach the target domain's DNS, HTTPS and RDAP services.
Before you install
Checks are read-only lookups against public DNS, HTTPS and RDAP data for whatever domain you name, so the queried domain is disclosed to the remote service and to those third parties. No credentials are requested. Results are point-in-time observations and may not reflect later DNS or certificate changes.
Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.modernmustardseed%2Fdomain-health/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.
Explain in plain words whether email from a domain will reach the inbox and whether others can forge it. Checks MX, SPF with every include expanded and counted against the 10-lookup limit, DMARC policy, alignment and report permissions, DKIM keys at about 40 common selectors plus any you name (with key size), BIMI, MTA-STS and TLS-RPT, and the DNS rules Google, Yahoo and Microsoft set for bulk senders. Every finding has a severity, a one-sentence fix and the RFC or provider document behind it. Reads public DNS only.
Parametersdetaildomainrequireddkim_selectors
check_ssl
Check SSL certificate
Check the HTTPS certificate and TLS setup of a domain on port 443: issuer, expiry date and days left, whether the chain is complete and trusted, whether the certificate matches the name, key type and size, which TLS versions (1.0 to 1.3) the server accepts, and the CAA record that limits who may issue certificates. Checks www as well when given a bare domain. Every finding has a severity, a fix and a citation.
Parametersdetaildomainrequiredinclude_www
check_security_headers
Check security headers
Read the HTTP security headers a domain's homepage sends, as a browser receives them, and grade each: Strict-Transport-Security, Content-Security-Policy, clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy, plus whether http:// redirects to https://, cookie flags, and software version disclosure. Only public web servers on ports 80 and 443 are contacted.
Parametersdetaildomainrequired
check_domain_registration
Check domain registration
Read a domain's public registration record from its registry over RDAP (no WHOIS scraping): registrar, creation, expiry and last-change dates, status locks such as clientTransferProhibited, danger states such as redemption period or hold, and nameservers. Also compares the registry's nameservers with the live zone and checks DNSSEC. Subdomains are checked as their registered domain. Some country-code registries do not publish RDAP; the tool says so.
Parametersdetaildomainrequired
full_domain_report
Full domain report
Run every Domain Health check on one domain at once (email authentication, SSL and TLS, security headers, registration and DNSSEC) and answer three questions in plain words: will its email land, is its website safe, and is the domain owned well. Returns a score and grade per area, the top fixes across all areas, and every finding with its severity, fix and citation. Takes 5 to 20 seconds.
Parametersdetaildomainrequireddkim_selectors
Version history
1
v1.0.0LatestOct 11, 2026
Score
83%
83% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
LicenseNot applicable
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.
