TamingDNS

TamingDNS checks the DNS records that decide whether a domain's mail is delivered and trusted. Each check returns a status and findings with stable codes, so Claude can tell you what's wrong and what to change.

There are nineteen tools. Nine check one standard for a domain: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, DANE and DNSSEC. One finds a domain's DKIM keys when you don't know the selector, by trying the 500-plus selectors TamingDNS knows. On a Mimecast domain the dated selectors are scanned in the background, and the result says when to ask again. Two audit a domain's whole mail setup against what Microsoft 365 or Google Workspace expects. They're built from the same checks, so they never disagree with them. One asks 14 public resolvers for a record, to see whether a DNS change has spread. One lists every TXT record at a domain and labels each by vendor. One checks a website's certificate, security headers and redirects. One reads the MCP Registry signing keys a domain publishes. Three read what you paste: email headers, flagged for signs of spoofing and phishing; a bounce or SMTP error, decoded with its fix; and a DMARC aggregate report. The pasted headers aren't returned in the result.

Every tool is read-only. They look up public DNS records, and fetch what a domain publishes for MTA-STS, BIMI, mail-client autoconfiguration and its website: the policy file, the logo, the certificates, the autoconfig XML and the site's HTTPS response. They change nothing.