MCP Server

Domain security checks for AI assistants

An assistant can explain what DMARC is perfectly well. What it can't do is tell you whether your domain has it — that needs a live DNS lookup. This closes that gap.

Add to Claude Desktop, Cursor, Cline or any MCP client
{
  "mcpServers": {
    "posturecheck": {
      "command": "npx",
      "args": ["-y", "posturecheck-mcp"]
    }
  }
}

No install, no account, no API key. On macOS, Claude Desktop's config lives at ~/Library/Application Support/Claude/claude_desktop_config.json. Restart the client afterwards.

What it looks like

> Can anyone spoof email from acme.com?

  [PASS] SPF: SPF record found
  [FAIL] SPF policy: ~all (softfail — consider -all)
  [PASS] DKIM: found (selector: google), 2048-bit
  [PASS] DMARC: DMARC record found
  DMARC policy: p=none (monitoring only — provides
  no protection against spoofing)

  Yes. Their DMARC policy is set to p=none, which
  collects reports but doesn't ask receiving servers
  to block anything.

Tools

scan_domain

Full posture check in one call — SPF, DKIM, DMARC, MTA-STS, TLS certificate and protocol support, and HTTP security headers, with an overall score.

ASKED AS
“Is acme.com configured securely?”
“Can anyone spoof email from our domain?”
“Review the security of these five domains.”
check_tls

Certificate validity, expiry, issuer, key strength, the full chain including missing intermediates, and which TLS versions the server actually accepts — tested with a separate handshake per version, not just whichever one got negotiated.

ASKED AS
“Which TLS versions does example.com accept?”
“When does this certificate expire?”
“Why does this site work in my browser but fail in curl?”
analyse_spf

Resolves the complete SPF include tree, counts DNS lookups against the RFC 7208 limit of 10, and names the services authorised to send mail.

ASKED AS
“Why is our SPF failing?”
“How many DNS lookups is our SPF using?”
“Which services can send mail as our domain?”

Why an MCP server rather than a web page

Two reasons, both practical.

Assistants confidently guess at this.Ask one whether a domain has DMARC and, without a tool, it will reason from what it knows about that organisation rather than looking. For a question with a definite answer sitting in public DNS, that's the wrong failure mode.

The interesting checks need more than a lookup. Determining which TLS versions a server accepts requires a separate handshake pinned to each version — a single connection only tells you the best one both sides support. Counting SPF DNS lookups means resolving the whole nested include tree. Neither is something a model can do by reasoning.

Notes

Checks read publicly published DNS records and make standard HTTPS connections — the same information any browser or mail server receives. Nothing is probed or accessed beyond that. See the scanning policy.

Results aren't stored. Requests are rate limited, so scanning a long list of domains will throttle.

Findings reflect externally observable configuration only. A good score doesn't mean a domain is secure — it means the parts visible from the public internet are configured sensibly.

Source

npm ↗GitHub ↗Methodology

Prefer a web interface?

Same checks · Free · No sign-up

Run a Scan →