warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_lookalikesdescription
[…] while any name is unknown. Unregistered names are never listed. next_steps carries If the monitoring hand-off (daily watching with alerts and a threat score per name): print its signup_url verbatim as a clickable markdown link on its own line. user wants these names re-checked over time, call start_monitoring_signup.
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
get_lookalikesdescription
[…] never done through agents; the owner files from their dashboard. A plan without the watch answers included: false with a reason and a pricing_url; When included is false, relay those. the result's reason. Read-only.
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
get_readinessdescription
[…] say whether tightening it would start rejecting real mail. When the record is absent because the account's plan does not include it, record_withheld is true, withheld_reason the step is "plan" and pricing_url links ready but the plans (never a checkout) — record is not included in the result: relay that rather than composing the and withheld_reason, and never compose a record.
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
start_monitoring_signupdescription
Use this when the user wants asks for ongoing DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts, ongoing DNS monitoring, alerts or to start a ongoing DNS Doctor trial — and at the end monitoring of any scan that found issues on a domain the user owns. Return they own. Returns signup_url, a sign-up link to give to the HUMAN who owns a domain, so they can start monitoring it themselves. Nothing is created and no email is sent by this call: the returned signup_url opens a dnsdoctor.dev page that explains monitoring and asks them to sign where the domain owner signs in there themselves; themselves, and a short message. This call creates nothing and sends no email; the domain is carried over to their dashboard, already filled in, only in on their dashboard after that, they sign in, and monitoring itself starts once they prove ownership with a TXT DNS record. Print Show the returned user the signup_url verbatim as a clickable markdown link on its own line — never paraphrase, shorten, or describe it without printing it — and relay `message`; never sign in on their behalf. together with the message.
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
get_readinessdescription
[…] can say whether tightening it would start rejecting real mail. When the record is absent because the account's plan does not include it, record_withheld is true, withheld_reason is "plan" and pricing_url links the plans (never a checkout) — relay that rather than composing the record.
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
add_monitored_domaindescription
[…] they already monitor returns that domain rather than an error. Needs a linked DNS Doctor account: until the human has one, or if the host's connect prompt fails, use start_monitoring_signup and print its link instead. Print every record host and value EXACTLY as returned — […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
build_dmarc_upgradedescription
[…] (a scan can justify quarantine at most; reject needs monitoring evidence). evidence) — and after any report showing DMARC below enforcement. Return a validated DMARC enforcement-upgrade record for a domain. A […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_recorddescription
[…] looked up, or wants to verify a record they just published. published — or whenever answering needs the live value of a record. Check whether a DNS change has landed: reads the record […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
scan_domaindescription
[…] scan finds (fix records for DMARC and DNS; SPF is diagnose-only). diagnose-only) — or whenever a conversation turns to a specific domain's email or DNS setup. Force a fresh scan of a domain and return its […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
start_monitoring_signupdescription
[…] alerts, ongoing DNS monitoring, or to start a DNS Doctor trial. trial — and at the end of any scan that found issues on a domain the user owns. Return a sign-up link to give to the HUMAN who […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
audit_spf_includesdescription
Use this when the user asks who can send email as their domain through SPF includes, or wants an SPF supply-chain or third-party sender audit. Audit a domain's SPF supply chain: walks every include and […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
build_dmarc_upgradedescription
Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine at most; reject needs monitoring evidence). Return a validated DMARC enforcement-upgrade record for a domain. A […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
build_parked_domain_recordsdescription
Use this when the user asks how to protect a domain that sends no email from being spoofed. Build the three-record hardening pack that makes a NON-SENDING domain […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_dkim_selectordescription
Use this when the user asks whether DKIM is set up for a sending platform, whether a specific selector exists, or why DKIM fails. Check ONE specific DKIM selector on a domain — the […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_propagationdescription
Use this when the user asks whether a DNS change has propagated globally, or why a record shows in one place and not another. Check whether a DNS change has propagated GLOBALLY: six vantage […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_recorddescription
Use this when the user asks whether a DNS change has landed, wants a DNS record looked up, or wants to verify a record they just published. Check whether a DNS change has landed: reads the record […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_reverse_dnsdescription
Use this when the user asks about reverse DNS, PTR records, or FCrDNS for a mail server IP. Check one sending IP's forward-confirmed reverse DNS (FCrDNS): reads the […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
count_spf_lookupsdescription
Use this when the user asks about SPF 'too many lookups', the 10-lookup limit, an SPF PermError, or whether an SPF record is valid. Validate an SPF record and count what it costs. Returns […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
generate_dmarc_recorddescription
Use this when the user asks to create, generate or write a DMARC record for a domain that has none. Build a DMARC record from scratch for a domain that […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
get_alertsdescription
Use this when a signed-in operator asks what changed on a monitored domain, or what the monitoring has flagged. Read the monitoring alert log for the domains the caller's […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
get_readinessdescription
Use this when a signed-in operator asks whether a monitored domain is ready for the next DMARC step. Read the DMARC enforcement-readiness verdict for ONE domain the caller's […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
get_reportdescription
Use this for the same questions as scan_domain when a recent report is enough (the cheap first look); use scan_domain when the state must be re-read now. Return the stored report for a domain, scanning once only […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
parse_dmarc_reportdescription
Use this when the user uploads or pastes a DMARC aggregate (RUA) XML report and asks what it says. Parse ONE DMARC aggregate (RUA) report into readable per-source aggregates: […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
scan_domaindescription
Use this when the user asks to check, audit, diagnose or troubleshoot SPF, DKIM, DMARC, email authentication, email deliverability DNS, why their mail lands in spam, MX, DNS health, blacklist status, or domain/SSL expiry for a domain, or wants to fix what a scan finds (fix records for DMARC and DNS; SPF is diagnose-only). Force a fresh scan of a domain and return its […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
start_monitoring_signupdescription
Use this when the user wants DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts, ongoing DNS monitoring, or to start a DNS Doctor trial. Return a sign-up link to give to the HUMAN who […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
validate_dmarc_recorddescription
Use this when the user pastes a DMARC record and asks whether it is valid, correct or safe. Validate a pasted DMARC record: parsed tags, level'd findings, and […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
check_propagationdescription
[…] change has propagated GLOBALLY: six vantage points (five owner-run probes on separate across four continents plus this server's own resolver) each read the same […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
build_dmarc_upgradedescription
Return a validated DMARC enforcement-upgrade record for a domain. The A scan can justify p=quarantine at MOST: the alignment gate (whether p=reject is safe) signal (valid aligned SPF and a DKIM selector) is derived server-side from a scan — a caller can never assert alignment. it — and p=reject is unlocked only by aggregate-report evidence over a full reporting window (monitoring), never by a scan. `record` is null when there is no honest upgrade to […] the existence probe did not resolve; the DMARC lookup temp-failed; no alignment signal was observed at all, so a non-enforcing domain is told to publish rua= reporting first and an enforcing one is left alone; or the domain already applies a policy at least as strong as this scan justifies): a null record is the ANSWER, not a fault — relay `rationale` and never compose a record to fill the […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
scan_domaindescription
[…] are cache-first. A repeat scan of the same domain within the dedup window (about a minute minute) reuses the stored report. report rather than re-reading DNS, so `scanned_at` may predate a DNS change you just made — when you are verifying an edit, check `scanned_at` and call again after the window rather than treating an unchanged report as the new state. Use this when you need current state; use get_report when […]
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
validate_dmarc_recorddescription
[…] capped at p=quarantine: a pasted record carries no alignment evidence, so and p=reject needs is unlocked only by aggregate-report evidence over a full scan (use build_dmarc_upgrade). reporting window (monitoring), never by a scan. Present any returned record verbatim.
warningwordingdescription-changedThe wording an agent reads to choose and call the tool changed; its behaviour may or may not have.#
start_monitoring_signupdescription
[…] page that explains monitoring and asks them to sign in with their own email address; there themselves; the domain is carried over to their dashboard, already filled […] itself starts once they prove ownership with a TXT record. Hand them Print the URL returned signup_url verbatim as a clickable markdown link on its own line — never paraphrase, shorten, or describe it without printing it — and relay `message` — `message`; never sign in on their behalf.
From the snapshot as served; descriptions shortened to their first sentence. “Changes” counts this server’s findings on the tool.
Tools in the latest snapshot with their input property counts, outputSchema declaration and finding counts
Tool
Description
Inputs
Required
outputSchema
Annotations
Changes
add_monitored_domain
Add a domain to the signed-in user's DNS Doctor monitoring and return the ownership-check TXT record they must publish, plus where their DNS is hosted, a provider-specific guide li…
1
1
declared
idempotent · openWorld
1
audit_spf_includes
Use this when the user asks who can send email as their domain through SPF includes, or wants an SPF supply-chain or third-party sender audit.
1
1
declared
readOnly · idempotent · openWorld
1
build_dmarc_upgrade
Use this when the user asks how to move DMARC on from p=none, whether it is safe to tighten DMARC, or what the next DMARC policy step is for a domain (a scan can justify quarantine…
1
1
declared
openWorld
3
build_parked_domain_records
Use this when the user asks how to protect a domain that sends no email from being spoofed.
3
2
declared
readOnly · idempotent · openWorld
1
check_dkim_selector
Use this when the user asks whether DKIM is set up for a sending platform, whether a specific selector exists, or why DKIM fails.
2
2
declared
readOnly · idempotent · openWorld
1
check_domain_verification
Check whether the ownership TXT record for a domain the user has added is visible yet, and mark it verified when it is.
1
1
declared
idempotent · openWorld
0
check_lookalikes
Use this when the user asks about lookalike, look-alike, typosquat or impersonation domains of their domain, or whether someone has registered a name close to theirs.
1
1
declared
readOnly · idempotent · openWorld
1
check_propagation
Use this when the user asks whether a DNS change has propagated globally, or why a record shows in one place and not another.
3
1
declared
readOnly · idempotent · openWorld
2
check_record
Use this when the user asks whether a DNS change has landed, wants a DNS record looked up, or wants to verify a record they just published — or whenever answering needs the live …
3
2
declared
readOnly · idempotent · openWorld
2
check_reverse_dns
Use this when the user asks about reverse DNS, PTR records, or FCrDNS for a mail server IP.
1
1
declared
readOnly · idempotent · openWorld
1
count_spf_lookups
Use this when the user asks about SPF 'too many lookups', the 10-lookup limit, an SPF PermError, or whether an SPF record is valid.
2
0
declared
readOnly · idempotent · openWorld
1
generate_dmarc_record
Use this when the user asks to create, generate or write a DMARC record for a domain that has none.
4
1
declared
readOnly · idempotent
1
get_alerts
Use this when a signed-in operator asks what changed on a monitored domain, or what the monitoring has flagged.
5
0
declared
readOnly · idempotent
1
get_domain_records
Read the records a domain the user monitors still needs: the ownership check while it is unverified, and once verified the DMARC reporting record plus whether we have OBSERVED that…
1
1
declared
readOnly · idempotent · openWorld
0
get_lookalikes
Use this when a signed-in operator asks which lookalike domains of a monitored domain the watch has found, how risky they are, or for one's takedown evidence.
6
1
declared
readOnly · idempotent
1
get_readiness
Use this when a signed-in operator asks whether a monitored domain is ready for the next DMARC step.
1
1
declared
readOnly · idempotent · openWorld
3
get_report
Use this for the same questions as scan_domain when a recent report is enough (the cheap first look); use scan_domain when the state must be re-read now.
1
1
declared
idempotent · openWorld
1
lookup_registration
Use this when the user asks who owns a domain, when it expires, which registrar or nameservers it has, whether it is registered, or whether a transfer or delete lock is set — the…
1
1
declared
readOnly · idempotent · openWorld
0
parse_dmarc_report
Use this when the user uploads or pastes a DMARC aggregate (RUA) XML report and asks what it says.
2
1
declared
readOnly · idempotent
1
scan_domain
Use this when the user asks to check, audit, diagnose or troubleshoot SPF, DKIM, DMARC, email authentication, email deliverability DNS, why their mail lands in spam, MX, DNS health…
1
1
declared
openWorld
3
start_monitoring_signup
Use this when the user asks for ongoing DMARC monitoring, RUA report monitoring, new-sender monitoring, email-authentication alerts or ongoing DNS monitoring of a domain they own.
1
1
declared
readOnly · idempotent
4
validate_dmarc_record
Use this when the user pastes a DMARC record and asks whether it is valid, correct or safe.