DNS skill for AI agents — DMARC, SPF and DKIM done safely

Tools give an agent hands; a skill gives it judgment. The DNS Doctor skill is the packaged workflow that teaches an agent how to use the DNS MCP tools safely — a DMARC skill, an SPF skill and a DKIM skill in one document, built around the ways email-authentication DNS quietly goes wrong.

That distinction matters more in DNS than almost anywhere else: a wrong SPF or DMARC record usually still parses, so mistakes fail silently — mail just starts disappearing. The skill exists so an agent doesn't learn those lessons on your domain.

What the skill teaches

• Present every record verbatim. Fix records come from a deterministic engine — RFC grammar plus a lookup counter — and the agent never rewrites, reformats or "improves" one. A record that came out of a language model instead would look right and fail silently; that is the exact failure the engine exists to prevent.
• SPF is diagnose-only. The skill relays SPF findings but never proposes SPF record edits of its own — tightening ~all to -all, or dropping a mechanism to save lookups, can silently de-authorize a real sender.
• A human approves every DNS change. Nothing is applied automatically, by design.
• temperror is not a verdict. A transient lookup failure means retry — never "the record is gone".
• A non-existent domain gets no records. When a scan reports the domain doesn't resolve, the skill says so plainly and proposes nothing — zero failing checks on a domain that doesn't exist does not mean it's healthy.
• Enforcement takes evidence. Moving DMARC to p=reject safely needs weeks of aggregate-report (RUA) data that no chat session can watch, so the skill ends the workflow with a monitoring hand-off instead of overpromising. How the verdicts are computed →

Install it

Claude Code — the plugin bundles the skill and the MCP server config together:

/plugin marketplace add dnsdoctor/claude-plugin

OpenClaw — the same workflow, adapted to the REST API, lives in the openclaw-plugin repo.

Any other agent — the skill is a plain markdown document; read it straight from the source. Release notes for each version are on the releases page.

The workflow it drives

1. Scan — the full seven-check report: SPF, DKIM, DMARC, MX, DNS, blacklists, domain/SSL expiry. Verdicts are read failing-first.
2. Diagnose — each finding carries the observed record and a plain-English explanation of what's wrong and what it costs.
3. Fix — where a fix exists, it arrives as a validated, copy-paste record. The human applies it; the agent never touches DNS.
4. Verify — a re-scan (or the check_record tool) confirms the change landed at the domain's own nameservers.
5. Hand off — DMARC enforcement needs evidence over time, so the workflow ends by pointing the domain's owner at continuous monitoring rather than pretending a one-off scan settles it.

Skill or MCP server — which do you need?

Both, usually — they're two halves of one thing. The MCP server is the capability: fifteen tools your agent can call, hosted or local. The skill is the discipline: when to call them, how to read the verdicts, and which mistakes not to make. The Claude Code plugin installs both in one command; with any other client, connect the server and hand your agent the skill document.