v1.3.0
Two new tools, taking the hosted MCP server from 11 to 13.
audit_spf_includes — walks a domain's full SPF include/redirect tree and reports the risks a lookup count alone cannot show: includes that are broken today, include targets whose registrable domain is confirmed unregistered (an SPF takeover — anyone could register it and become an authorized sender), targets expiring within 30 days, and a +all nested anywhere in the tree. It also reports how many IPv4 addresses the record transitively authorizes. Registration is only ever reported as absent on confirmed evidence; any lookup fault is reported as unverified, never as "available". SPF stays diagnose-only — no fix record is emitted.
build_parked_domain_records — the three-record hardening pack for a domain that sends no mail (Null MX, v=spf1 -all, p=reject; np=reject). The caller's confirmation unlocks the question, not the answer: the server independently verifies non-sending from DNS (existence, MX, pass-capable SPF mechanisms, a DKIM selector sweep) and refuses with an explanation if it finds evidence of mail. Any transient lookup failure refuses too, because the output ends in -all.
np=reject on every generated DMARC record. Both builders now emit the DMARCbis (RFC 9989) non-existent-subdomain policy when the input carries no explicit np; an existing np is preserved untouched. A subdomain that does not exist can have no aligned legitimate mail, so this is safe at any organizational policy and closes the subdomain-spoofing gap while p is still climbing the ladder.
External RUA authorization reporting. The DMARC check now detects when aggregate reports are being sent to a third-party domain that has not published the RFC 7489 §7.1 authorization record — a case where reports are silently discarded. Reported as detail only; the check's status never changes.
Four consultant playbooks in the skill — pre-migration audit, deliverability triage, getting to enforcement, and a parked-domain sweep for MSPs.
The npm client @dnsdoctor/mcp@1.3.0 ships the same 13 tools over stdio.