For agents
isitdns over MCP: six read-only DNS tools, measured from the isitdns edge and probes. No key, no account.
endpoint https://isitdns.net/mcp
ChatGPT is it DNS? in Settings > Plugins > Install plugin > Connect
ChatGPT, by URL Plugins > + > Add custom MCP server > https://isitdns.net/mcp
Claude Customize > Connectors > + Add > Add custom connector > https://isitdns.net/mcp
ChatGPT by URL: Business and Enterprise/Edu, on the web (OpenAI). Claude: web, Desktop and mobile; a Free plan holds one custom connector (Anthropic).
$ claude mcp add --transport http isitdns https://isitdns.net/mcp
.mcp.json { "mcpServers": { "isitdns": { "type": "http", "url": "https://isitdns.net/mcp" } } }
.cursor/mcp.json { "mcpServers": { "isitdns": { "url": "https://isitdns.net/mcp" } } }
Cursor install link cursor://anysphere.cursor-deeplink/mcp/install?name=isitdns&config=eyJ1cmwiOiJodHRwczovL2lzaXRkbnMubmV0L21jcCJ9
.vscode/mcp.json { "servers": { "isitdns": { "type": "http", "url": "https://isitdns.net/mcp" } } }
~/.gemini/settings.json { "mcpServers": { "isitdns": { "httpUrl": "https://isitdns.net/mcp" } } }
~/.codex/config.toml
[mcp_servers.isitdns]
url = "https://isitdns.net/mcp"
| tool | what it answers |
|---|---|
| check_domain | Check a domain that is not working.Check a domain that is not working: whether the name resolves in public DNS, then the eleven-check audit of its zone, each row ok, warn, fail or skipped with why. DNS only, not HTTP or TLS, and not for one record: dig. Measured from the isitdns edge and its probes, never the caller's network. from moves the recursion, TTL and UDP truncation rows to that region's probe. |
| dig | Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all).Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all): records, flags, rcode, EDE, latency. Not for a whole domain: check_domain. Asked over DoH from the isitdns edge. from moves the question to that region's probe as Do53 over UDP, and follow: true adds the CNAME chain as separate reads with DNSSEC off. A resolver given as an address must be on the board. |
| trace | Trace a delegation from the root to the authority, like dig +trace.Trace a delegation from the root to the authority, likedig +trace: each referral and its glue, the one server that answered at each zone cut and any dial that failed, the final answer and its TTLs. Not for every server of a zone: sweep_domain. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers for it, and type (default A) is what it asks there. |
| dnssec_chain | Walk the DNSSEC chain from the root to one answer.Walk the DNSSEC chain from the root to one answer: DS and DNSKEY at each signed zone cut, key tags, signers, signature windows, the first link that breaks or goes insecure, and whether the zone where it goes insecure is itself signed (an island of security). Not for one signed record: dig. Read through Cloudflare's resolver over DoH with CD=1 from the isitdns edge, and a key set a break would rest on again through Google's. Signature bytes are not verified, so a clean walk does not prove the answer validates.type (default A) is the record checked at the end, not OPT, RRSIG or a meta type such as ANY, and anchor (a DS or DNSKEY record, with anchor_zone) starts the walk at that zone instead of the root. |
| sweep_domain | Sweep a zone's nameservers.Sweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with why, and an answer past 22,000 bytes is trimmed with counts, the whole sweep at itsapi: URL. names are labels under domain (@ for domain itself), 16 at most, and types 8 at most. |
| registration | Read a domain's registration from its registry's RDAP server.Read a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to the registered domain, and each HTTP read is listed with its URL, status and time. |
No tool reads your own path: every reading is from the isitdns edge or a named probe. From your own machine:
$ dig @192.0.2.1 example.com A
$ dig @1.1.1.1 example.com A
The first must not answer: 192.0.2.1 is no resolver (RFC 5737). If it answers, your network answers port 53 itself. Step by step: test your own path.
is_it_dns: are Cloudflare, Google, Quad9 and AdGuard answering right now?after_change_check: I changed a record: is it live, and where is it still old?mail_check: is this domain's DNS set up for mail?dnssec_servfail: is this SERVFAIL a DNSSEC failure?
Every answer that is not an error carries its readings: what was asked, of whom, from where, when, and what came back. Then api, the request behind it. check_domain, dig and trace also add ask again: the page that reruns it, unless from is set or a dig flag other than follow is off its default.
Over MCP, refused before any query: names inside a network, special-use names (RFC 6761), resolvers not on the board.
HTTP: the same six as GET routes under /api, in JSON; /api/query also as text (Accept: text/plain). Spec: /api/openapi.json.
Rate limit: 100 a minute per address.
Support: security@isitdns.net