v1.4.0 — monitoring reads

Two read-only monitoring tools join the surface: get_alerts (the account alert log, with keyset paging) and get_readiness (the DMARC enforcement-readiness verdict). Both are token-gated: create an API token in the dashboard and the agent can watch a domain over the same transport it diagnoses one. 15 tools total. The skill adds the full operate workflow: enroll, verify, watch, propose, apply with human approval, re-check.

v1.3.0

Two new tools, taking the hosted MCP server from 11 to 13.

audit_spf_includes — walks a domain's full SPF include/redirect tree and reports the risks a lookup count alone cannot show: includes that are broken today, include targets whose registrable domain is confirmed unregistered (an SPF takeover — anyone could register it and become an authorized sender), targets expiring within 30 days, and a +all nested anywhere in the tree. It also reports how many IPv4 addresses the record transitively authorizes. Registration is only ever reported as absent on confirmed evidence; any lookup fault is reported as unverified, never as "available". SPF stays diagnose-only — no fix record is emitted.

build_parked_domain_records — the three-record hardening pack for a domain that sends no mail (Null MX, v=spf1 -all, p=reject; np=reject). The caller's confirmation unlocks the question, not the answer: the server independently verifies non-sending from DNS (existence, MX, pass-capable SPF mechanisms, a DKIM selector sweep) and refuses with an explanation if it finds evidence of mail. Any transient lookup failure refuses too, because the output ends in -all.

np=reject on every generated DMARC record. Both builders now emit the DMARCbis (RFC 9989) non-existent-subdomain policy when the input carries no explicit np; an existing np is preserved untouched. A subdomain that does not exist can have no aligned legitimate mail, so this is safe at any organizational policy and closes the subdomain-spoofing gap while p is still climbing the ladder.

External RUA authorization reporting. The DMARC check now detects when aggregate reports are being sent to a third-party domain that has not published the RFC 7489 §7.1 authorization record — a case where reports are silently discarded. Reported as detail only; the check's status never changes.

Four consultant playbooks in the skill — pre-migration audit, deliverability triage, getting to enforcement, and a parked-domain sweep for MSPs.

The npm client @dnsdoctor/mcp@1.3.0 ships the same 13 tools over stdio.

v1.2.1

Parameter descriptions on all 11 tools: every tool input (domain, record, selector, ip, kind, host, content_base64, ...) now carries a description in its inputSchema, so agents can compose calls without guessing at formats. No tool added or removed.

v1.2.0

Adds @dnsdoctor/mcp — a runnable stdio MCP client in this repo (npx -y @dnsdoctor/mcp): the same 11 tools as the hosted https://dnsdoctor.dev/mcp endpoint, backed by the public REST API, tool definitions pinned to the live server. Skill guidance now covers where API tokens come from. Two new public REST endpoints back the client: POST /api/v1/dmarc-upgrade and POST /api/v1/signup-url.

v1.1.0

11 MCP tools over the hosted server at https://dnsdoctor.dev/mcp: full domain scans (SPF, DKIM, DMARC, MX, DNS, blacklist, domain/TLS expiry), DMARC enforcement upgrades, and seven focused checks — SPF lookup counting and validation, DMARC record validation and generation, DKIM selector checks, DMARC aggregate report parsing, live DNS record verification, and reverse DNS. start_monitoring_signup replaces enroll_monitoring_trial: the agent hands the domain owner a signup link instead of us sending email.