idig-dns
mcpotherProfessional DNS diagnostics: 14 tools for DNS, DNSSEC, email security, SSL, and propagation.
run it
on your own machines, one way per deploy method# once, as root:
docker build -t mcp-local/idig-dns:latest https://github.com/kbhave/mcp-service-idig.git
#!/usr/bin/env bash
# idig-dns (net.softricks/idig-dns), recipe docker (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-idig-dns.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec docker run --rm --name mcp-my-agent-idig-dns -p 127.0.0.1:${PORT}:8000 --env-file /etc/mcp/my-agent.env mcp-local/idig-dns:latest
[Unit]
Description=MCP server idig-dns (toolset my-agent), generated by Hub
After=network-online.target docker.service
Wants=network-online.target
[Service]
Type=simple
User=mcp
Group=mcp
SupplementaryGroups=docker
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/idig-dns
WorkingDirectory=/var/lib/mcp/idig-dns
ExecStart=/opt/mcp/my-agent/bin/idig-dns.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/idig-dns
[Install]
WantedBy=multi-user.target
docker build -t idig-dns https://github.com/kbhave/mcp-service-idig.git docker run --rm -p 127.0.0.1:8101:8000 idig-dns
# Generated by Hub for toolset "my-agent" (2026-10-18T08:45:15+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
# cp .env.example .env # fill the ${VAR}s
# docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
idig-dns:
build:
context: https://github.com/kbhave/mcp-service-idig.git
ports:
- 127.0.0.1:8101:8000
restart: unless-stopped
x-note: 'CHANGE_ME: built from the repository''s Dockerfile, assuming it serves streamable HTTP at
:8000/mcp. Nothing has run this yet; the worker replaces it with a tested recipe.'
volumes:
npm-cache: {}
uv-cache: {}
# Generated by Hub for toolset "my-agent" (2026-10-18T08:45:15+00:00).
# kubectl create namespace mcp
# kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
# kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: idig-dns
namespace: mcp
labels: &id001
app: idig-dns
spec:
replicas: 1
selector:
matchLabels: *id001
template:
metadata:
labels: *id001
spec:
containers:
- name: idig-dns
image: CHANGE_ME
ports:
- containerPort: 8000
name: http
env: []
---
apiVersion: v1
kind: Service
metadata:
name: idig-dns
namespace: mcp
spec:
selector:
app: idig-dns
ports:
- port: 8000
targetPort: http
name: http
# Generated by Hub for toolset "my-agent" (2026-10-18T08:45:15+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
idig-dns:
enabled: true
replicas: 1
port: 8000
path: /mcp
container:
name: idig-dns
image: CHANGE_ME
ports:
- containerPort: 8000
name: http
env: []
# helm install my-agent helm/my-agent -n mcp
in the cloud
one click: the provider's deploy form opens filled in, in your own account- koyeb
-
Koyeb builds the repository's Dockerfile from branch main; change the branch in the form if the default one has another name.
Clients connect to the service's https://…koyeb.app address plus /mcp.
- cloud run
-
Cloud Shell clones the repository, builds its Dockerfile and deploys it to Cloud Run.
Cloud Run sends requests to $PORT (8080); the recipe expects :8000, so the server has to read PORT, or set the container port on the service afterwards.
connect to it
copy what your client needs{
"mcpServers": {
"idig-dns": {
"command": "CHANGE_ME",
"args": []
}
}
}
#!/usr/bin/env bash # Registers every server with Claude Code (run once; `claude mcp list` to check). set -euo pipefail set -a; [ -f .env ] && source .env; set +a claude mcp add idig-dns -- CHANGE_ME
{
"mcpServers": {
"idig-dns": {
"command": "CHANGE_ME",
"args": []
}
}
}
{
"servers": {
"idig-dns": {
"type": "stdio",
"command": "CHANGE_ME",
"args": []
}
}
}
name: my-agent target: local servers: - hub: net.softricks/idig-dns
- no recipe for target 'local': fill the files by hand
tools · 19
blacklist_checkIP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.IP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.
pin 470c8592c989691710c44d5406e6dcfd5da0390cfa61d2e2bb5a5cfb573d5ca4dane_validateDANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.DANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.
pin 952a7e22cecbb8701f9ca182d051704c72190ec3e9c5bb2c5dbe488ed0f8267ediagnoseFull diagnosis combining resolution + DNSSEC. Use first when something is broken.Full diagnosis combining resolution + DNSSEC. Use first when something is broken.
pin 8f78e4191e359093308e02ecd752c24b18c781fa39431c3fe38955e479f8f7a8dns_lookupLook up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.Look up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.
pin 88cf2397024f4a1690451c78f18e8a503cafc7dee248e8356ef78171c3136444dnssec_healthDNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.DNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.
pin c97f1a927521ef3f5c6319859a5317f2604b98cc76559696f246b22fa35c226fdnssec_validateValidate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.Validate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.
pin 34e3660e53432e11c5b558f93b3dac690853f1c0e184972325f2c1033a984e74domain_statusRegistrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.Registrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.
pin 118be008b12ec4e06859f479ecf4ffc6ec521f42f2074102bfc3db58fda064b3email_security_auditFull SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.Full SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.
pin c6546d6937d8fba54d6d179b8697b45eee7cc4b710b4120661886c25864cc90bgeo_lookupGeolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.Geolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.
pin 3de6738008e940c58b372edc27deac04e3fafab39c254276cf5c7fd65b6c6daahttp_checkHTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.HTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.
pin c73d09bac8af0361d08769a74fc65468183d838941247e7b93b8096daa27799bmx_checkMX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.MX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.
pin 4d582492258fbcd604bf8014f13e786a5bb701d22eb9349a9a2b5d4e5dff17ebpropagation_checkCheck DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.Check DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.
pin 3f25757a563a616d20f7eb89fd101005073c1688a3604e49183702927ff6a760resolve_checkDNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.DNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.
pin 2213d9f1bbe53e7c7fc156f7c7d249f3096863d8fc0256de1451a0354652a964ssl_checkSSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.SSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.
pin 874d016266510a6db210160ea753ac61b5a896a0f8b95bbf2e3b83dcbf269339subdomain_discoverDiscover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.Discover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.
pin de6dc8bdded81785fbcbb912b3a432a7979acf8fd1e280fdd9dd56648cc17784ttl_checkTTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.TTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.
pin e0336a8971038fdf4b2c335c72909cb6f72c9a3cd10e490a35d3cf2309c8713cwhois_lookupParsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.Parsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.
pin 2f059fdd4cf73515edfefae6abf8871d489bf7046a6e112e63068440bfb4dcc9zone_axfrAXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).AXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).
pin 6169532b7054b5aea62488cd2dfcc2549c6f2e9cbae6b499285962d33403a09czone_consistencyCheck all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.Check all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.
pin 8958c950110dea3ef98346c3265ecf4b234ef3d7de64d5d643f799dc92cc3b32
runs · 1
the latest tests of this entry by the hub and its workers, newest first| date | worker | method | status | sandbox | reason |
|---|---|---|---|---|---|
| 2026-10-16 09:50 | local-mac | remotemcp 2025-11-25 | ok19 tools | none | — |