Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions
Directory / BlackVeil DNS & Email Security Scanner
BlackVeil DNS & Email Security Scanner
by blackveilsecurity.com · https://dns-mcp.blackveilsecurity.com/mcp
DNS and email security scanner with 81 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
12 of 12 checks · 29 Oct 2026
Is BlackVeil DNS & Email Security Scanner MCP server safe?
- No hidden instructions were found in its tool descriptions.
- Its error messages showed no secrets or internal details.
- 59 of its 60 tools are labeled read-only; the others may change or send things.
- Overall it scored 84/100 on 29 Oct 2026.
A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.
What it can do
60 tools, in the server's own words.
check_mxread-onlyLook up MX records for a domain.
check_spfread-onlyLook up and validate the SPF record for a domain.
check_dmarcread-onlyLook up and validate the DMARC record for a domain.
check_dkimread-onlyLook up DKIM records for a domain.
check_dnssecread-onlyCheck DNSSEC status for a domain.
check_sslread-onlyCheck the HTTPS/TLS posture of a domain: HTTPS reachability, HSTS policy, and HTTP-to-HTTPS redirect.
check_mta_stsread-onlyCheck whether a domain enforces SMTP TLS for inbound mail via MTA-STS, protecting against downgrade attacks.
check_nsread-onlyAudit a domain’s nameserver delegation and redundancy.
check_caaread-onlyLook up CAA records for a domain.
check_bimiread-onlyCheck the BIMI brand-logo record at default._bimi.
check_tlsrptread-onlyCheck whether a domain has SMTP TLS Reporting (TLS-RPT) configured.
check_http_securityread-onlyAudit a domain's browser-facing HTTP security headers over HTTPS.
check_daneread-onlyCheck DANE/TLSA certificate pinning for SMTP at port 25.
check_ptrread-onlyVerify forward-confirmed reverse DNS (PTR/FCrDNS) for mail servers.
check_dane_httpsread-onlyVerify DANE certificate pinning for HTTPS connections.
check_svcb_httpsread-onlyValidate HTTPS/SVCB records (RFC 9460) for modern transport capability advertisement.
check_lookalikesread-onlyDetect active typosquat and lookalike/homoglyph domains that impersonate your brand and could be used in phishing.
check_subdomailingread-onlyDetect SubdoMailing risk: analyzes the SPF include chain for dangling or hijackable subdomains that could let an attacker send email as the domain.
scan_domainread-onlyRun a full DNS and email security audit for a single domain.
batch_scanread-onlyBulk-scan up to 10 domains in parallel.
batch_scan_startStart a durable asynchronous scan of 1–10 domains.
batch_scan_statusread-onlyRead the owner-scoped status of an asynchronous batch scan.
batch_scan_findingsread-onlyFetch owner-scoped findings for a completed asynchronous batch scan.
compare_domainsread-onlySide-by-side security comparison of 2–5 domains.
and 36 more
Test results
Safe mode: only tools labeled read-only were run. How the test works
- !Ready for the newest MCP versionnote
1 warning
- !Uses an older MCP version (2025-06-18). It works today, but it isn't on the July 2026 version (2026-07-28) yet.
- !Every tool is describednote
6 warnings
- !osint_investigate_infrastructure_start and osint_investigate_supply_chain_start have nearly the same description (78% of their words are shared; the only difference: "infrastructure", "deep", "domain" vs "supply", "chain"), so an AI may not
- !osint_investigate_domain_start and osint_investigate_infrastructure_start have nearly the same description (75% of their words are shared; the only difference: "retrieve", "result", "report" vs "infrastructure", "deep", "query"), so an AI m
- !osint_investigate_username_start and osint_investigate_email_start have nearly the same description (74% of their words are shared; the only difference: "username", "cross", "platform" vs "email", "address", "exposure"), so an AI may not kn
- !osint_investigate_domain_start and osint_investigate_supply_chain_start have nearly the same description (74% of their words are shared; the only difference: "domain", "retrieve", "result" vs "supply", "chain", "query"), so an AI may not kn
- !scan_buckets_status and osint_investigation_status have nearly the same description (68% of their words are shared; the only difference: "bucket", "scan", "cloud" vs "osint", "investigation", "investigationid"), so an AI may not know which
- !scan_buckets_start and osint_investigate_domain_start have nearly the same description (65% of their words are shared; the only difference: "bucket", "scan", "cloud" vs "osint", "investigation", "investigationid"), so an AI may not know whi
- !Follows MCP best practices (not scored yet)note
1 tip (not scored)
- !The tool list is about 108 KB (roughly 27k tokens). AI apps send it with every message, so it takes that much of the AI's memory before any work starts.
- !Resources and prompts worknote
7 warnings (6 resources, 7 prompts)
- !full-security-audit: Leaving out a required input gets an internal error instead of an "invalid input" error: server error (HTTP 500)
- !email-auth-check: Leaving out a required input gets an internal error instead of an "invalid input" error: server error (HTTP 500)
- !policy-compliance-check: Our sample inputs get an internal error instead of an "invalid input" error: server error (HTTP 500)
- !remediation-workflow: Leaving out a required input gets an internal error instead of an "invalid input" error: server error (HTTP 500)
- !email-hardening-guide: Leaving out a required input gets an internal error instead of an "invalid input" error: server error (HTTP 500)
- !provider-benchmark: Leaving out a required input gets an internal error instead of an "invalid input" error: server error (HTTP 500)
- !attack-surface-assessment: Leaving out a required input gets an internal error instead of an "invalid input" error: server error (HTTP 500)
- and 3 more
- ✓ConnectsConnected in 2.2 spass
- ✓Lists its toolsFound 81 toolspass
- ✓Tools are labeled safe or dangerousEvery tool has a safety labelpass
- ✓No hidden instructionsNo hidden instructions found in tool descriptionspass
- ✓Tools work with good inputspass
All good
- ✓check_mx: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_spf: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_dmarc: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_dkim: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_dnssec: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_ssl: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_mta_sts: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- ✓check_ns: Answered with an error, probably because of our sample input: Error: Domain validation failed: Domain "test" is not allowed: reserved TLD ".test"
- and 32 more
- ✓Bad inputs give a clean errorpass
All good
- ✓check_mx: Refused missing required input "domain" with a clear error
- ✓check_mx: Refused wrong type for "domain" with a clear error
- ✓check_spf: Refused missing required input "domain" with a clear error
- ✓check_spf: Refused wrong type for "domain" with a clear error
- ✓check_dmarc: Refused missing required input "domain" with a clear error
- ✓check_dmarc: Refused wrong type for "domain" with a clear error
- ✓check_dkim: Refused missing required input "domain" with a clear error
- ✓check_dkim: Refused wrong type for "domain" with a clear error
- and 32 more
- ✓Fast enoughpass
All good
- ✓Connecting took 2.2 s
- ✓Listing tools took 334 ms
- ✓Average tool answer: 1.1 s
- ✓get_benchmark: Slowest tool: get_benchmark (1.6 s)
- ✓No secrets leakedChecked 173 error messages: no secrets or internal detailspass
- –Tools work togetherNo tool's answer could be fed into another tool, so there were no chains to test (not counted either way)not tested
Test it yourself
Free and open source. Same checks, same score.
npx qamcp-cli https://dns-mcp.blackveilsecurity.com/mcpShow this score on GitHub
Free for every server in the directory. Paste this into your README: the badge shows the score from our latest test.
[](https://qamcp.dev/s/com-blackveilsecurity-dns.html)Score over time
- 29 Oct 202684
One test so far. New tests will show here.
Reviews
Coming soon: reviews from people who use BlackVeil DNS & Email Security Scanner, signed in with GitHub, one per person. Reviews never change the score.
QAmcp Monitor (coming soon) tests it every hour and emails you when it goes down, the score drops, a tool changes or a secret leaks. You'll also be able to claim this page and get a verified owner mark. Founding price: $19/month for life for the first 50 teams.
Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works