Dns Intelligence

@guardbee/mcp-dns-intelligence

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP server that enumerates DNS records, detects SPF / DMARC / DKIM misconfigurations, and finds subdomains (Certificate Transparency + wordlist) that can be taken over. Uses Node.js's built-in dns/promises — no external dependencies.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Features

• Full DNS Enumeration — A, AAAA, MX, NS, TXT, CNAME, SOA records
• SPF Analysis — +all, ?all, duplicate records, and the RFC 7208 limits counted the way receivers do: DNS lookups across nested include/redirect (max 10), void lookups (max 2), include loops and missing includes
• DMARC Analysis — policy (none/quarantine/reject), pct, missing rua address
• DKIM Check — probes 9 common selectors (default, google, selector1, mail, etc.)
• Subdomain Discovery — names from Certificate Transparency logs (crt.sh and Cert Spotter, queried in parallel; only the domain name is sent) plus a 75-name wordlist, with wildcard DNS filtered out; every live name is checked for subdomain takeover
• Email Security Summary — combined SPF + DMARC + DKIM analysis with copy-pasteable fix recommendations
• 23 Unit Tests — pure logic tests, no network connection required

Quick Start

npm install -g @guardbee/mcp-dns-intelligence

Add to claude_desktop_config.json:

{  "mcpServers": {    "guardbee-dns-intelligence": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-dns-intelligence"]    }  }}

MCP Tools

Example Usage

You can ask Claude:

"Is there a problem with example.com's DNS configuration?"

"Audit example.com's email security — SPF, DMARC, and DKIM"

"List example.com's subdomains, flag any dangling ones"

"What are example.com's MX records?"

Example Output

Email Security Check: example.com──────────────────────────────────────────────────
── SPF ─────────────────────────────────────────✓ v=spf1 include:_spf.google.com -all
── DMARC ───────────────────────────────────────✗ No DMARC record found at _dmarc.example.com  Add:  v=DMARC1; p=quarantine; rua=mailto:[email protected]
── DKIM ────────────────────────────────────────✓ Found DKIM selectors: google

SPF Findings

DMARC Findings

Subdomains without their own DMARC record inherit the parent domain's (sp= policy), as receivers do. Subdomain enumeration detects wildcard DNS and leaves out names answered only by the wildcard.

DKIM, MX and Transport Findings

SPF_MISSING is 🟠 High when the domain has MX records (with a starting record, e.g. v=spf1 include:_spf.google.com ~all for Google Workspace) and 🟡 Medium otherwise (suggests v=spf1 -all).

Nameserver Findings

Each nameserver of a zone is queried directly over DNS (UDP/TCP 53): an SOA query without recursion, an AXFR request (only the first messages are read — the zone is never downloaded), and a recursive query for a name it does not host. Skip with --no-ns-probe / nameserverProbe: false.

DNSSEC and CAA Findings

DNSSEC is read through DNS-over-HTTPS (dns.google), comparing a validating query with a cd=1 (checking disabled) one, because Node's resolver cannot see DS/DNSKEY records or the AD flag. CAA follows RFC 8659 (nearest ancestor), and the issuer of the certificate served on :443 is compared against it. Both checks are skipped with http: false.

Subdomain Takeover Detection

Each live subdomain with a CNAME is checked, following the CNAME chain (up to 5 hops). The wildcard record is checked too: a dangling *.domain makes every unlisted name claimable.

Each page fingerprint was checked against a random unclaimed name on the provider. Providers whose "not found" page no longer carries a stable marker are not listed. HTTP checks send one GET / to the subdomain (HTTPS, then HTTP); turn them off with --no-http / httpProbe: false. Use check_takeover / takeover <host…> for hostnames you already know.

CLI — CI/CD Integration

In addition to MCP server mode, this can also be used directly as a CLI:

# Full DNS + email security checknpx @guardbee/mcp-dns-intelligence check example.com
# Fail only on high and abovenpx @guardbee/mcp-dns-intelligence check example.com --fail-on=high
# Subdomain scan — exits 1 if a dangling CNAME is foundnpx @guardbee/mcp-dns-intelligence subdomains example.com
# Subdomain scan with higher concurrencynpx @guardbee/mcp-dns-intelligence subdomains example.com --concurrency=50
# JSON outputnpx @guardbee/mcp-dns-intelligence check example.com --format=json
# Several domains with an A–F grade each and a summary table (or every domain in guardbee.yml when none is given)npx @guardbee/mcp-dns-intelligence check example.com example.de example.co.uknpx @guardbee/mcp-dns-intelligence check --format=sarif > dns.sarif

Grades: each finding deducts points (critical 40, high 20, medium 8, low 2) and the worst finding caps the grade — any critical is F, any high at most C, any medium at most B.

Exit codes: 0 = no issues · 1 = findings above threshold / dangling subdomain · 2 = error

Configuration via guardbee.yml

Create a guardbee.yml at your project root to persist CLI flags. CLI flags always override file settings.

dns-intelligence:  fail-on: high          # critical | high | medium | low  concurrency: 20        # parallel subdomain probes  domains:               # used when no domain is given on the CLI    - example.com    - staging.example.com

See guardbee.example.yml for a sample file.

GitHub Actions — DNS Security Audit

name: DNS Security Checkon:  schedule:    - cron: "0 6 * * *"  # Every day at 06:00  workflow_dispatch:
jobs:  dns-check:    runs-on: ubuntu-latest    steps:      - name: Check DNS configuration        run: npx @guardbee/mcp-dns-intelligence check ${{ vars.DOMAIN }} --fail-on=high
      - name: Scan for dangling subdomains        run: npx @guardbee/mcp-dns-intelligence subdomains ${{ vars.DOMAIN }}

GitLab CI

dns-security:  image: node:20  script:    - npx @guardbee/mcp-dns-intelligence check $DOMAIN --fail-on=high    - npx @guardbee/mcp-dns-intelligence subdomains $DOMAIN  only:    - schedules

Pre-Deployment Email Security Check

- name: Verify email security records  run: |    npx @guardbee/mcp-dns-intelligence check ${{ vars.DOMAIN }} \      --fail-on=high \      --format=json | tee dns-report.json
- name: Upload DNS report  uses: actions/upload-artifact@v4  with:    name: dns-security-report    path: dns-report.json

Development

npm installnpm test          # 23 unit testsnpm run build     # TypeScript compile

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.