DomainRef - domain and email security check

dev.domainrefPublished by domainref.devOfficial publisherv1.0.0Updated Oct 27, 2026

Pay-per-call domain and email security check: SPF, DKIM, DMARC, TLS, DNSSEC, BIMI, with exact fixes.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that runs paid, per-call domain and email security checks (SPF, DKIM, DMARC, TLS, DNSSEC) and domain age lookups.

What you can do
  • Grade a domain's email and DNS security posture: SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, plus BIMI and blocklist information, each with the exact fix record.
  • Look up a domain's registrar name and IANA ID and how old it is, to spot risky newly registered domains.
  • Return the payment requirement for the HTTP endpoint when no API key is supplied.
When to use it
Useful when mail is landing in spam, before an email campaign, for vendor due diligence, or to confirm which tenant or registrar a domain belongs to. It suits occasional checks where a small per-call fee is acceptable rather than a subscription.
Requirements
A remote streamable HTTP endpoint; nothing to install locally. An optional X-API-Key header enables card-based access; without it, each call returns an x402 payment requirement for the HTTP endpoint. Network access to the endpoint is required.
Before you install
Both tools are paid per call (about $0.01 for domain_check and $0.005 for domain_age), so repeated use spends money. Without the X-API-Key header, calls return an x402 payment requirement rather than results. domain_age refuses registries without RDAP, such as .za, .co.za, .me, .de, .io and .eu, returning a 422.

Installation

In SourceWeft

  1. Open DomainRef - domain and email security check in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.domainref%2Fdomainref/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "domainref-domain-and-email-security-chec": {
      "type": "http",
      "url": "https://domainref.dev/mcp"
    }
  }
}

Tools

2

domain_check

Domain and Email Security Check

PAID ($0.01). Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, plus BIMI and blocklist info, each with the exact fix record. Non-intrusive. $0.01 per domain. Returns a 0-100 score and, per check (spf, dkim, dmarc, mx, tls = website certificate, m365, registration, mta_sts, tls_rpt, dnssec, caa, bimi, dnsbl = UCEPROTECT blocklist), a pass/warn/fail/info grade, the finding and the exact record or step that fixes it. Info checks do not move the score. Invalid, nonexistent or private-only domains are refused free. MCP: pass api_key (an Afriref key, card credit at https://afriref.dev/pricing); per-call x402/MPP payment is HTTP only, so without a key the result is an api_key_required error naming the HTTP endpoint.

Parametersdomainrequiredapi_key

domain_age

Domain Age and Registrar

PAID ($0.005). Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005. From the registry's RDAP: registrar name and IANA ID (no registrant or contact data), created, expires, last changed, status flags, DNSSEC delegation, nameservers; fail under 30 days old or expired, warn under 180 days, expiring within 30 days or on hold. A registry without RDAP is refused free. MCP: pass api_key (an Afriref key, card credit at https://afriref.dev/pricing); per-call x402/MPP payment is HTTP only, so without a key the result is an api_key_required error naming the HTTP endpoint.

Parametersdomainrequiredapi_key

Version history

1
  1. v1.0.0LatestOct 20, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.