Idig Dns

net.softricks由 softricks.net 发布官方发布者v1.0.0更新于 Oct 24, 2026

Professional DNS diagnostics: 14 tools for DNS, DNSSEC, email security, SSL, and propagation.

已验证SSE可网页运行网页搜索与抓取云端与基础设施安全与监控

概览

AI 生成的概览

远程 MCP 服务器，提供 19 个 DNS 诊断工具，让助手查询记录、审计邮件安全、验证 DNSSEC 并检查 SSL 证书。

可以做什么
查询任意类型的 DNS 记录并做解析诊断，包括用于故障排查的组合诊断工具、跨 16 个全球解析器的传播检查，以及 TTL 建议、权威服务器一致性比对和 AXFR 区域传送漏洞检测。审计邮件安全，给出 SPF、DKIM、DMARC、BIMI 评级，检查 MX 健康与邮件服务商识别，并做 IP 黑名单查询。验证 DNSSEC 信任链结果、密钥与签名健康状况，并将 DANE/TLSA 记录与实时证书交叉校验。查看域名与托管信息：WHOIS 数据、注册商锁定与 EPP 状态、地理位置、ISP、ASN 与 CDN 识别、子域名发现、SSL 证书详情以及 HTTP/HTTPS 可达性。
适用场景
适合排查 DNS 或邮件投递问题、确认 DNS 变更是否已传播、审计域名的邮件安全与 DNSSEC 状况，或在迁移和安全审查前检查证书、子域名与黑名单状态。
运行要求
远程 SSE 端点；README 建议通过 npx 的 mcp-remote 桥接连接，该方式需要 Node.js。所有工具都要求 token 参数，需从提供方的 API 文档站点获取。需要能访问提供方端点的网络。
安装前请注意
所有工具都要求 token 参数，README 的示例提示中把它与域名一起直接写在对话里；应将其视为机密，避免粘贴到共享对话中。关于域名的查询（包括子域名发现和黑名单检查）会发送到提供方 API，并进一步发往实时 DNS 基础设施及第三方解析器和黑名单服务。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Idig Dns，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 SSE。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/net.softricks%2Fidig-dns/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "idig-dns": {
      "type": "sse",
      "url": "https://mcp.softricks.net/sse"
    }
  }
}

README

iDig DNS MCP Server

A remote MCP server exposing 19 professional DNS diagnostic tools from the iDig API — built by Kedar Bhave ( Softricks ).

Connect any MCP-compatible AI client (Claude Desktop, Cursor, Windsurf, and more) to real DNS infrastructure. Diagnose outages, audit email security, validate DNSSEC, check SSL certificates, trace propagation across 16 global resolvers, and more — all in plain English.

Live endpoint: https://mcp.softricks.net/sse

Quickstart

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "idig-dns": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.softricks.net/sse"      ]    }  }}

Restart Claude Desktop. You'll see idig-dns appear under Connectors.

Cursor / Windsurf

Add to your MCP settings:

json
{  "mcpServers": {    "idig-dns": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.softricks.net/sse"      ]    }  }}

Authentication

All tools require a token parameter. Get your token at api.softricks.net/idig/docs.

Tools

ToolDescription
dns_lookupLook up any DNS record type: A, AAAA, MX, NS, TXT, SOA, CAA, SRV, CNAME, DS, TLSA, HTTPS, SVCB
resolve_checkResolution diagnostics — returns ok / nxdomain / servfail / timeout / degraded
diagnoseFull diagnosis combining resolution + DNSSEC — start here when something is broken
email_security_auditSPF, DKIM, DMARC, and BIMI audit with A–F grade and prioritized fix recommendations
mx_checkMX health + provider detection (Google Workspace, M365, Proofpoint, 35+ providers)
dnssec_validateDNSSEC chain of trust — returns secure / insecure / bogus / indeterminate
dnssec_healthKey inventory, signature expiry, algorithm assessment, rollover readiness
propagation_checkCheck propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia
ssl_checkCertificate validity, expiry countdown, domain match, issuer, chain completeness
ttl_checkTTL advisory with step-by-step migration lowering plan
zone_consistencyCompare all authoritative nameservers — catches lame delegation and SOA mismatches
subdomain_discoverProbe 75 common subdomains + crt.sh Certificate Transparency logs — surfaces exposed dev/staging environments
geo_lookupGeolocation, ISP, ASN, CDN detection, hosting flag
domain_statusEPP registrar lock status — transfer-ready, delete lock, serverHold, pendingDelete
blacklist_checkIP blacklist / DNSBL check — Spamhaus, Barracuda, SpamCop, SORBS, and more
whois_lookupParsed WHOIS data — registrar, expiry, domain age, nameservers, EPP status
http_checkHTTP/HTTPS reachability — status codes, redirect chain, HSTS, HTTP→HTTPS redirect
zone_axfrAXFR zone transfer vulnerability check — tests if any NS allows public zone transfers
dane_validateDANE/TLSA validation — cross-validates TLSA records against live TLS certificate

Example prompts

My emails are going to spam for example.com — token is YOUR_TOKEN
Did my DNS changes propagate yet for example.com? token: YOUR_TOKEN
Run a full security audit on example.com, token YOUR_TOKEN
Is the SSL cert for example.com about to expire? token YOUR_TOKEN
We're migrating example.com to a new host next week — are the TTLs safe? token YOUR_TOKEN
What subdomains does example.com have exposed? token YOUR_TOKEN
Are any of example.com's IPs on a blacklist? token YOUR_TOKEN
Get WHOIS info for example.com — token YOUR_TOKEN
Is example.com reachable over HTTPS? token YOUR_TOKEN
Check if example.com is vulnerable to zone transfers — token YOUR_TOKEN
Validate DANE/TLSA records for example.com — token YOUR_TOKEN

Architecture

Claude Desktop / Cursor / Windsurf        │        │  MCP over SSE        ▼mcp.softricks.net          ← Railway (always-on Python/FastMCP server)        │        │  HTTPS        ▼api.softricks.net/idig     ← AWS Lambda (iDig REST API)        │        │  DNS queries        ▼Live DNS infrastructure

Self-hosting

Clone this repo and deploy your own instance:

bash
git clone https://github.com/kbhave/MCP-Service-iDigcd MCP-Service-iDigpip install -r requirements.txtpython mcp_server.py

Or deploy to Railway in one click — connect your GitHub repo and Railway handles the rest.

Requirements:

  • Python 3.11+
  • mcp==1.26.0
  • httpx

Related

License

MIT

来源：README.md，提交 1c2cd4f

工具

19

dns_lookup

Look up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.

输入参数rrtoken必填domain必填

email_security_audit

Full SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.

输入参数token必填domain必填

dnssec_validate

Validate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.

输入参数token必填domain必填

dnssec_health

DNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.

输入参数token必填domain必填

resolve_check

DNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.

输入参数token必填domain必填

diagnose

Full diagnosis combining resolution + DNSSEC. Use first when something is broken.

输入参数token必填domain必填

propagation_check

Check DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.

输入参数token必填domain必填record_type

mx_check

MX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.

输入参数token必填domain必填

domain_status

Registrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.

输入参数token必填domain必填

geo_lookup

Geolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.

输入参数token必填domain必填

ttl_check

TTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.

输入参数token必填domain必填

zone_consistency

Check all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.

输入参数token必填domain必填

ssl_check

SSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.

输入参数token必填domain必填

subdomain_discover

Discover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.

输入参数token必填domain必填

blacklist_check

IP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.

输入参数token必填domain必填

whois_lookup

Parsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.

输入参数token必填domain必填

http_check

HTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.

输入参数token必填domain必填

zone_axfr

AXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).

输入参数token必填domain必填

dane_validate

DANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.

输入参数porttoken必填domain必填

版本历史

1
  1. v1.0.0最新Sep 16, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。