DMARC MCP Server
for AI Assistants
DMARC Intelligence for AI Agents
Works with Claude, ChatGPT, Cursor, Windsurf, and any MCP-compatible AI host
The DMARKOFF MCP server gives your AI agents your DMARC data: domain health, authentication results, policy status and security alerts, what holds a domain back from quarantine or reject, and live SPF, DKIM, DMARC and TXT checks for any domain.
25 tools · OAuth 2.1 or API key · 2 tools write, none touches DNS · Included in paid plans
How It Works
Your AI assistant asks DMARKOFF and answers from your own data.
When you ask a question, your assistant picks the DMARKOFF tools it needs and calls them over MCP with your API key. It sees only the projects that key can reach. Report data comes from the DMARC aggregate reports DMARKOFF collects for your domains; receivers send them a day or two after the mail. DNS checks run live, at the moment you ask. The assistant combines both in one answer, for example the senders in your reports next to the SPF record that should cover them, and tells you what to change.
Built for Security-Conscious AI Workflows
Giving an AI agent access to security data is a decision that deserves care.
The DMARKOFF MCP server only reads, apart from two actions taken at your request: adding domains to a project you own and recording your decision on a sending source. It is scoped to your account's permission model and requires explicit authentication before it exposes anything. Your agent gets the DMARC context it needs to be useful. It cannot touch your DNS records, delete domains or report data, or access data outside what your account explicitly permits. Every query is authenticated and scoped. That is not an afterthought. It is how the server was built from the start.
What Your AI Agent Can Do with DMARKOFF
Give your AI assistant direct access to your DMARC monitoring data: domain health, authentication results, alerts, and AI-powered recommendations.
Domain health and authentication analysis
Ask about SPF, DKIM, and DMARC alignment across all your domains and get an answer from your DMARC reports, which arrive a day or two after the mail. DNS checks run live, at the moment you ask.
Works across your entire AI stack
DMARKOFF connects to Claude, ChatGPT, Cursor, Windsurf, Continue.dev, and any host that speaks MCP. One server covers every tool you use.
Built for multi-client workflows
The MCP server respects DMARKOFF's full project and permissions model. Multi-tenant MSP setups work out of the box. Your agent sees only what your account authorizes.
Clear limits for automated workflows
Every tool reads, except two that act only at your request: adding domains to a project and recording your decision on a sender. No tool changes DNS or deletes data.
Questions to Ask Your AI Agent
Can example.com move to p=reject? What's holding it?
DMARKOFF's readiness plan: the senders that still need DKIM, the unknown sources to confirm, and the record to publish.
We publish p=reject. Why did some mail still get delivered?
Policy overrides from receivers' reports: forwarding, ARC, sampling and local policy.
Gmail is throttling us. What are they complaining about?
SMTP rejections from aggregate reports, with Gmail's 421 and 550 codes explained.
Our SPF record is at 10 lookups. Which includes can go?
Which mechanisms actually carry mail, and which cost lookups without any.
What an Answer Looks Like
Anonymized from a real DMARKOFF readiness plan: the domain name is changed, the numbers are not.
Can example.com move from p=none to p=quarantine?
Yes. DMARKOFF's readiness plan says example.com is ready for quarantine. Over the last 14 days all of its own mail was signed with aligned DKIM: 10,763 messages, all sent through Amazon SES. The domain has 193 days of reports, and the step needs 14. Nothing holds it.
What else showed up in the reports?
1,448 messages were your own mail passed on by forwarders and gateways, mostly Google, Microsoft 365 and Cloudflare. They do not hold the step. 2 messages were spoofing, which quarantine is meant to stop. To take the step, publish: v=DMARC1; p=quarantine; rua=mailto:…@reports.dmarkoff.com; adkim=r; aspf=r; fo=1
FAQ
It's an implementation of the Model Context Protocol (MCP) open standard that gives AI agents direct access to your DMARC monitoring data. Any MCP-compatible AI host (Claude, ChatGPT, Cursor, Windsurf) can query your domain health, authentication results, policy status, and security alerts from DMARKOFF.
MCP stands for Model Context Protocol. It's an open standard introduced by Anthropic in November 2024 and now adopted by OpenAI, Google, and Microsoft. The idea is simple: instead of building a custom integration for every AI tool, you connect once via MCP and any compatible host can access your data. Think of it as USB-C for AI. The protocol is governed by the Agentic AI Foundation under the Linux Foundation.
Claude (web, mobile, desktop, and CLI), ChatGPT, Cursor, Windsurf, and Continue.dev all work with DMARKOFF out of the box. Any other tool that implements the open MCP standard will work too.
It's included on all paid DMARKOFF plans at no extra cost. You can start with a 14-day free trial and no credit card is required.
Your agent can query domain health status, SPF/DKIM/DMARC authentication results, active policy settings, DMARC record configuration, and alerts and anomaly data. The server never changes your DNS. It writes in two cases only: adding domains to a project you own and recording your decision on a sending source.
Yes. The server authenticates via OAuth 2.1 and respects your account's full permission model. It never changes your DNS or deletes data, and it writes only when you ask it to add domains or record a decision on a sending source. Your data is only accessible to what your account explicitly authorizes.
Yes. The MCP server works with DMARKOFF's existing project model. If you're an MSP managing multiple clients, your agent can query across projects according to your account's access controls.
Full setup instructions for every supported client are on the setup page. Most connections take under two minutes.