Idig Dns

net.softricks由 softricks.net 發布官方發布者v1.0.0更新於 Oct 24, 2026

Professional DNS diagnostics: 14 tools for DNS, DNSSEC, email security, SSL, and propagation.

已驗證SSE可網頁執行網頁搜尋與抓取雲端與基礎設施安全與監控

概覽

AI 產生的概覽

遠端 MCP 伺服器，提供 19 個 DNS 診斷工具，讓助理查詢記錄、稽核郵件安全、驗證 DNSSEC 並檢查 SSL 憑證。

可以做什麼
查詢任意類型的 DNS 記錄並做解析診斷，包括用於故障排查的組合診斷工具、跨 16 個全球解析器的傳播檢查，以及 TTL 建議、權威伺服器一致性比對和 AXFR 區域傳送漏洞檢測。稽核郵件安全，給出 SPF、DKIM、DMARC、BIMI 評級，檢查 MX 健康與郵件服務商識別，並做 IP 黑名單查詢。驗證 DNSSEC 信任鏈結果、金鑰與簽章健康狀況，並將 DANE/TLSA 記錄與即時憑證交叉驗證。檢視網域與主機代管資訊：WHOIS 資料、註冊商鎖定與 EPP 狀態、地理位置、ISP、ASN 與 CDN 識別、子網域探索、SSL 憑證詳情以及 HTTP/HTTPS 可達性。
適用情境
適合排查 DNS 或郵件投遞問題、確認 DNS 變更是否已傳播、稽核網域的郵件安全與 DNSSEC 狀況，或在遷移與安全審查前檢查憑證、子網域與黑名單狀態。
執行需求
遠端 SSE 端點；README 建議透過 npx 的 mcp-remote 橋接連線，此方式需要 Node.js。所有工具都要求 token 參數，需從提供方的 API 文件網站取得。需要能存取提供方端點的網路。
安裝前請注意
所有工具都要求 token 參數，README 的範例提示中把它與網域一起直接寫在對話裡；應視為機密，避免貼到共用對話中。關於網域的查詢（包括子網域探索和黑名單檢查）會傳送到提供方 API，並進一步送往即時 DNS 基礎設施及第三方解析器與黑名單服務。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Idig Dns，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 SSE。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/net.softricks%2Fidig-dns/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "idig-dns": {
      "type": "sse",
      "url": "https://mcp.softricks.net/sse"
    }
  }
}

README

iDig DNS MCP Server

A remote MCP server exposing 19 professional DNS diagnostic tools from the iDig API — built by Kedar Bhave ( Softricks ).

Connect any MCP-compatible AI client (Claude Desktop, Cursor, Windsurf, and more) to real DNS infrastructure. Diagnose outages, audit email security, validate DNSSEC, check SSL certificates, trace propagation across 16 global resolvers, and more — all in plain English.

Live endpoint: https://mcp.softricks.net/sse

Quickstart

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "idig-dns": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.softricks.net/sse"      ]    }  }}

Restart Claude Desktop. You'll see idig-dns appear under Connectors.

Cursor / Windsurf

Add to your MCP settings:

json
{  "mcpServers": {    "idig-dns": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.softricks.net/sse"      ]    }  }}

Authentication

All tools require a token parameter. Get your token at api.softricks.net/idig/docs.

Tools

ToolDescription
dns_lookupLook up any DNS record type: A, AAAA, MX, NS, TXT, SOA, CAA, SRV, CNAME, DS, TLSA, HTTPS, SVCB
resolve_checkResolution diagnostics — returns ok / nxdomain / servfail / timeout / degraded
diagnoseFull diagnosis combining resolution + DNSSEC — start here when something is broken
email_security_auditSPF, DKIM, DMARC, and BIMI audit with A–F grade and prioritized fix recommendations
mx_checkMX health + provider detection (Google Workspace, M365, Proofpoint, 35+ providers)
dnssec_validateDNSSEC chain of trust — returns secure / insecure / bogus / indeterminate
dnssec_healthKey inventory, signature expiry, algorithm assessment, rollover readiness
propagation_checkCheck propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia
ssl_checkCertificate validity, expiry countdown, domain match, issuer, chain completeness
ttl_checkTTL advisory with step-by-step migration lowering plan
zone_consistencyCompare all authoritative nameservers — catches lame delegation and SOA mismatches
subdomain_discoverProbe 75 common subdomains + crt.sh Certificate Transparency logs — surfaces exposed dev/staging environments
geo_lookupGeolocation, ISP, ASN, CDN detection, hosting flag
domain_statusEPP registrar lock status — transfer-ready, delete lock, serverHold, pendingDelete
blacklist_checkIP blacklist / DNSBL check — Spamhaus, Barracuda, SpamCop, SORBS, and more
whois_lookupParsed WHOIS data — registrar, expiry, domain age, nameservers, EPP status
http_checkHTTP/HTTPS reachability — status codes, redirect chain, HSTS, HTTP→HTTPS redirect
zone_axfrAXFR zone transfer vulnerability check — tests if any NS allows public zone transfers
dane_validateDANE/TLSA validation — cross-validates TLSA records against live TLS certificate

Example prompts

My emails are going to spam for example.com — token is YOUR_TOKEN
Did my DNS changes propagate yet for example.com? token: YOUR_TOKEN
Run a full security audit on example.com, token YOUR_TOKEN
Is the SSL cert for example.com about to expire? token YOUR_TOKEN
We're migrating example.com to a new host next week — are the TTLs safe? token YOUR_TOKEN
What subdomains does example.com have exposed? token YOUR_TOKEN
Are any of example.com's IPs on a blacklist? token YOUR_TOKEN
Get WHOIS info for example.com — token YOUR_TOKEN
Is example.com reachable over HTTPS? token YOUR_TOKEN
Check if example.com is vulnerable to zone transfers — token YOUR_TOKEN
Validate DANE/TLSA records for example.com — token YOUR_TOKEN

Architecture

Claude Desktop / Cursor / Windsurf        │        │  MCP over SSE        ▼mcp.softricks.net          ← Railway (always-on Python/FastMCP server)        │        │  HTTPS        ▼api.softricks.net/idig     ← AWS Lambda (iDig REST API)        │        │  DNS queries        ▼Live DNS infrastructure

Self-hosting

Clone this repo and deploy your own instance:

bash
git clone https://github.com/kbhave/MCP-Service-iDigcd MCP-Service-iDigpip install -r requirements.txtpython mcp_server.py

Or deploy to Railway in one click — connect your GitHub repo and Railway handles the rest.

Requirements:

  • Python 3.11+
  • mcp==1.26.0
  • httpx

Related

License

MIT

來源：README.md，提交 1c2cd4f

工具

19

dns_lookup

Look up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.

輸入參數rrtoken必填domain必填

email_security_audit

Full SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.

輸入參數token必填domain必填

dnssec_validate

Validate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.

輸入參數token必填domain必填

dnssec_health

DNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.

輸入參數token必填domain必填

resolve_check

DNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.

輸入參數token必填domain必填

diagnose

Full diagnosis combining resolution + DNSSEC. Use first when something is broken.

輸入參數token必填domain必填

propagation_check

Check DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.

輸入參數token必填domain必填record_type

mx_check

MX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.

輸入參數token必填domain必填

domain_status

Registrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.

輸入參數token必填domain必填

geo_lookup

Geolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.

輸入參數token必填domain必填

ttl_check

TTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.

輸入參數token必填domain必填

zone_consistency

Check all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.

輸入參數token必填domain必填

ssl_check

SSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.

輸入參數token必填domain必填

subdomain_discover

Discover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.

輸入參數token必填domain必填

blacklist_check

IP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.

輸入參數token必填domain必填

whois_lookup

Parsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.

輸入參數token必填domain必填

http_check

HTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.

輸入參數token必填domain必填

zone_axfr

AXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).

輸入參數token必填domain必填

dane_validate

DANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.

輸入參數porttoken必填domain必填

版本歷史

1
  1. v1.0.0最新Sep 16, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。