Best for
- Security auditors
- DevOps engineers
- Site owners needing DNS/email security assessments
- Compliance teams
B
BlackVeil DNS & Email Security Scanner
Community
DNS & email security scanner with 80 MCP tools, zero install
GitHub source repository ↗
45FMRS · D
BlackVeil DNS provides comprehensive DNS and email security audits via MCP, suitable for authorized security testing. Interface is straightforward and outputs are detailed, but advanced features require a paid plan and responsible use must be followed.
BlackVeil DNS is an open-source DNS and email security scanner hosted on Cloudflare Workers. It exposes 80 MCP tools covering 19 scoring categories including SPF, DMARC, DKIM, DNSSEC, SSL/TLS. Supports Streamable HTTP, stdio, and legacy HTTP+SSE transport. Free tier requires no API key and includes 25 scans/day. Paid tiers provide higher quotas and advanced tools like subdomain discovery and attack path simulation.
Tools
check_mx
Checks the MX records of a domain.
check_spf
Inspects SPF record and validates syntax.
check_dmarc
Evaluates DMARC policy and grading.
check_dkim
Checks DKIM signing configuration.
check_mta_sts
Checks MTA-STS policy presence and validity.
check_subdomain_takeover
Detects potential subdomain takeover vulnerabilities.
scan_domain
Performs a comprehensive security audit of a domain, including scoring and grading.
generate
Generates fix plans or ready-to-publish DNS records like SPF, DMARC.
validate_fix
Confirms whether a fix was applied successfully.
map_supply_chain
Builds a third-party dependency graph with trust levels.
simulate_attack_paths
Enumerates attack paths such as spoofing, takeover, and hijacking.
map_compliance
Maps scan findings to compliance frameworks like NIST, PCI DSS, SOC 2.
compare_domains
Side-by-side comparison of email security postures of multiple domains.
discover_brand_domains
Discovers domains related to a brand (paid plan).
Setup
Hosted endpoint: https://dns-mcp.blackveilsecurity.com/mcp (Streamable HTTP). For Claude Code: claude mcp add --transport http blackveil-dns https://dns-mcp.blackveilsecurity.com/mcp. Also available via Smithery: smithery mcp add MadaBurns/bv-mcp. No API key needed for free tier.
Fit and risk
Not for
- Unauthorized domain reconnaissance
- Users needing non-DNS features
- Scenarios requiring local deployment without Cloudflare support
Required permissions
- Queries public DNS via Cloudflare DoH
- Accesses CT logs and RDAP data
- Some tools require a paid API key
- No authorization required from the target domain
Risks and side effects
- Scan results may reveal sensitive information and should only be used for authorized testing
- Misuse for unauthorized reconnaissance may violate laws
- Free tier has limited quota; advanced features require payment
- Data handling is subject to BlackVeil's privacy policy
Use cases
Performing security and compliance scans on domains you own
Generating DNS records to remediate issues
Assessing third-party supply chain risks
Simulating attack paths to understand potential vulnerabilities
Supported clients
Claude DesktopFull support
Claude CodeFull support
CursorFull support
VS CodeFull support