Dmarc Examiner

io.github.dmarc-examiner由 GitHub 账号 dmarc-examiner 发布v1.1.0更新于 Nov 2, 2026

Read your own DMARC aggregate and forensic reports: sources, alignment, alerts, CSV export.

已验证Streamable HTTP可网页运行沟通与协作安全与监控数据与分析

概览

AI 生成的概览

DMARC Examiner 官方 MCP 服务器，让助手查询你的 DMARC 汇总与取证报告、域名、告警和 Webhook。

可以做什么
  • 列出、查看、添加、验证和移除受监控域名，并检查任意域名的公开 DMARC 记录
  • 列出并读取汇总（RUA）报告，查看按国家和 ASN 的统计，并导出 CSV
  • 列出并读取取证（RUF）报告、其统计以及近 7 天摘要
  • 列出并忽略安全告警
  • 列出、创建、更新、删除和测试 HTTPS Webhook 端点
适用场景
适合已使用 DMARC Examiner 监控域名的用户，希望在 AI 客户端中直接询问发信来源、SPF/DKIM 对齐、告警或取证失败情况，而不必打开仪表盘或手动解析 XML 报告。
运行要求
需要 DMARC Examiner 账户（基础使用免费版即可；取证报告和 Webhook 需 Pro 及以上）。可连接 mcp.dmarc-examiner.com 远程端点，或不支持远程 HTTP 的客户端用 npx 运行 npm 包。首次调用数据类工具时需在浏览器中完成 OAuth 授权；npx 包会在本地保存令牌。可选环境变量 DMARC_EXAMINER_MCP_URL 可覆盖端点。
安装前请注意
该服务器会修改数据：可添加、验证和软删除域名，忽略告警，以及创建、更新、删除和测试 Webhook，建议只授予所需权限范围。npx 包会在本地凭据文件中保存 OAuth 令牌（含刷新令牌）。取证报告包含原始失败邮件信封，可能含敏感邮件元数据。部分工具会因套餐限制返回 402 或 403。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Dmarc Examiner，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.dmarc-examiner%2Fmcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "dmarc-examiner": {
      "type": "http",
      "url": "https://mcp.dmarc-examiner.com/mcp"
    }
  }
}

README

@dmarc-examiner/mcp

[MCP] [License: MIT] [Tools]

Official MCP (Model Context Protocol) server for DMARC Examiner. Query your DMARC monitoring data from AI assistants like Claude Desktop, Claude Code, and Cursor.

Why

DMARC aggregate reports arrive as compressed XML, one file per receiver per day. Reading them means either opening a dashboard or parsing XML by hand.

This server puts that data behind an MCP connection, so you can ask questions instead:

Which sending sources failed DMARC alignment last week?

Show me the domains where SPF passes but DKIM does not.

Export the report for example.com as CSV.

DMARC Examiner is a DMARC monitoring service with a free tier — you need an account to use this server, but not a paid one.

Quick Setup

Option 1: Remote URL (Recommended)

Most MCP clients support remote HTTP servers directly. Add this to your MCP configuration:

json
{  "mcpServers": {    "dmarc-examiner": {      "url": "https://mcp.dmarc-examiner.com/mcp"    }  }}

Option 2: npx (for clients without remote HTTP support)

json
{  "mcpServers": {    "dmarc-examiner": {      "command": "npx",      "args": ["-y", "@dmarc-examiner/mcp"]    }  }}

Configuration by Client

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "dmarc-examiner": {      "url": "https://mcp.dmarc-examiner.com/mcp"    }  }}

Claude Code

bash
claude mcp add dmarc-examiner --transport http https://mcp.dmarc-examiner.com/mcp

Cursor

Add to your Cursor MCP settings:

json
{  "mcpServers": {    "dmarc-examiner": {      "url": "https://mcp.dmarc-examiner.com/mcp"    }  }}

Authorization

Adding the server does not require authorizing. It starts immediately and answers initialize, tools/list and ping without credentials, so your client can list all 21 tools straight away.

A browser opens the first time you call a tool that touches your data. You'll need to:

  1. Log in to your DMARC Examiner account
  2. Select which organization to connect
  3. Approve the requested permissions (scopes)

The call you made is then replayed automatically, so it completes rather than failing.

With Option 1 the MCP client runs this flow itself. With Option 2 the package does it: it registers as an OAuth client, opens your browser, and stores the resulting tokens in ~/.dmarc-examiner/mcp-credentials.json with 0600 permissions. The refresh token is reused on later runs, so the browser step happens once.

Why it works this way. Authorizing on startup is the obvious design and it breaks every automated client: directory checks, scanners and CI have no browser to open, so the server appears to hang and the check times out. We wrote up the failure and the fix, with logs, in Your Remote MCP Server Will Fail Every Directory Check.

You can also drive it directly:

bash
npx -y @dmarc-examiner/mcp login    # authorize now, outside your MCP clientnpx -y @dmarc-examiner/mcp logout   # forget the stored credentials

Set DMARC_EXAMINER_MCP_URL to point the package at a different endpoint.

Available Tools

Domains

ToolDescriptionScope
list_domainsList all monitored domains in your organizationdomains:read
get_domainGet details of a specific domaindomains:read
check_dmarcInspect the public DMARC record at _dmarc.<domain>. Works on any domain, not only your owndomains:read
create_domainAdd a domain. Returns the reporting email and DMARC record to publish in DNSdomains:manage
verify_domainRe-check DNS to confirm the DMARC record carries your reporting addressdomains:manage
delete_domainRemove a domain from monitoring. Soft delete — historical reports remaindomains:manage

Aggregate reports (RUA)

ToolDescriptionScope
list_reportsList DMARC reports with filteringreports:read
get_reportGet a detailed report with recordsreports:read
get_report_statisticsReport statistics by country and ASNreports:read
export_report_csvExport a report as CSVreports:export

Forensic reports (RUF)

Requires the Pro plan or above; these return 403 otherwise.

ToolDescriptionScope
list_forensic_reportsList RUF reports with filtering and paginationforensic:read
get_forensic_reportFull detail of a forensic report, including the failed message envelopeforensic:read
get_forensic_reports_statisticsCounters by failure type, delivery result, source IP with geolocation, and domainforensic:read
get_forensic_reports_summaryForensic activity over the last 7 daysforensic:read

Alerts

ToolDescriptionScope
list_alertsList security alertsalerts:read
dismiss_alertDismiss an alertalerts:manage

Webhooks

Requires the Pro plan or above; these return 403 otherwise.

ToolDescriptionScope
list_webhooksList configured webhook endpointswebhooks:read
create_webhookCreate an endpoint. The URL must be HTTPSwebhooks:manage
update_webhookUpdate the URL, name or active state of an endpointwebhooks:manage
delete_webhookDelete an endpoint permanentlywebhooks:manage
test_webhookSend a webhook.test event and return the delivery statuswebhooks:manage

Scopes

ScopeDescription
domains:readView monitored domains
domains:manageAdd, verify and remove domains
reports:readView reports and statistics
reports:exportExport reports to CSV
forensic:readView forensic (RUF) reports
alerts:readView alerts
alerts:manageManage alerts (dismiss)
webhooks:readView webhook endpoints
webhooks:manageCreate, update, delete and test webhooks

Documentation

For detailed documentation, visit: https://dmarc-examiner.com/docs/settings/mcp-integration?utm_source=github&utm_medium=content&utm_campaign=mcp-repo

Support

License

MIT — see LICENSE.

来源：README.md，提交 6da6a70

工具

21

list_domains

List all monitored domains in your organization

输入参数pageper_page

get_domain

Get details of a specific domain

输入参数domain_id必填

check_dmarc

Inspect the public DMARC record at _dmarc.<domain>. The domain does not need to belong to your organization. Returns parsed policy and rua/ruf addresses.

输入参数domain必填

create_domain

Add a new domain to the organization. Response includes the reporting_email and dmarc_record values to publish in DNS. May return 402 if the plan domain limit has been reached.

输入参数name必填

verify_domain

Re-check a domain's DNS to confirm the DMARC record contains the organization's reporting email. Updates status to verified on success.

输入参数domain_id必填

delete_domain

Remove a domain from monitoring. Soft-deletes; historical reports remain accessible.

输入参数domain_id必填

list_reports

List DMARC reports for your organization

输入参数pagedomaindate_toper_pagedate_from

get_report

Get details of a specific DMARC report

输入参数report_id必填

get_report_statistics

Get statistics for a specific DMARC report

输入参数report_id必填

export_report_csv

Export a DMARC report as CSV

输入参数report_id必填

list_alerts

List alerts for your organization

输入参数pagestatusper_page

dismiss_alert

Dismiss a specific alert

输入参数alert_id必填

list_forensic_reports

List DMARC RUF (forensic) reports with optional filtering and pagination. Returns 403 if the plan does not include forensic reports (Pro plan and above).

输入参数pagedate_toper_pagedate_fromdomain_id

get_forensic_report

Get the full detail of a forensic (RUF) report by UUID, including the raw failed message envelope.

输入参数report_id必填

get_forensic_reports_statistics

Aggregated forensic-report counters grouped by auth failure type, delivery result, source IP (with geolocation) and reported domain.

无需输入参数。

get_forensic_reports_summary

Summary of forensic activity in the last 7 days — useful for daily digest views.

无需输入参数。

list_webhooks

List webhook endpoints configured for the organization. Returns 403 if the plan does not include advanced alerting (Pro and above).

无需输入参数。

create_webhook

Create a new webhook endpoint. URL must start with https://. Returns 422 if the organization has reached its webhook limit.

输入参数url必填name必填

update_webhook

Update a webhook. Any combination of url, name and is_active may be provided; URL must remain HTTPS.

输入参数urlnameis_activewebhook_id必填

delete_webhook

Delete a webhook endpoint permanently.

输入参数webhook_id必填

test_webhook

Send a synchronous webhook.test event to verify connectivity. Returns the delivery status. Test events do NOT update last_triggered_at, last_status or failure_count.

输入参数webhook_id必填

版本历史

1
  1. v1.1.0最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分