DNS Doctor

OpenClaw plugin for DNS Doctor — diagnoses SPF, DMARC, DKIM, MX, DNS, blacklist and expiry over the public DNS Doctor REST API.

DNS Doctor@dnsdoctor

Install

openclaw plugins install clawhub:@dnsdoctor/openclaw-plugin

DNS Doctor — OpenClaw plugin

Wraps the hosted DNS Doctor MCP server as an OpenClaw plugin so your agent can diagnose and fix a domain's email authentication (SPF, DMARC, DKIM, MX, blacklist, domain/SSL expiry). Every fix record is generated and validated by a deterministic engine — RFC grammar plus the SPF 10-lookup counter — never an LLM guess.

What's inside

text

openclaw-plugin/
├── plugin.json              # manifest wrapping the MCP endpoint
├── GUIDANCE.md              # the scan → diagnose → fix workflow + the verbatim-record rule
├── skills/dns-doctor/       # the ClawHub-publishable skill (REST-first, curl-only)
│   └── SKILL.md
├── LICENSE                  # Apache-2.0
└── README.md

Schema note: OpenClaw's manifest format evolves. Validate plugin.json against the current OpenClaw plugin docs before publishing and correct any field names if they've changed — the MCP endpoint (https://dnsdoctor.dev/mcp, HTTP transport) is the part that must survive.

Tools

Tool	Does
`scan_domain`	Fresh scan of a domain; full report.
`get_report`	Persisted report (scans once if none exists).
`build_dmarc_upgrade`	A validated DMARC enforcement record — `p=reject` only when the server-derived alignment gate passes.
`count_spf_lookups`	The SPF DNS-lookup count against the RFC limit of 10.
`validate_dmarc_record`	Parse and validate a DMARC record, tag by tag.
`generate_dmarc_record`	Build a DMARC record from a policy + reporting address.
`check_dkim_selector`	Look up one DKIM selector and check the key.
`parse_dmarc_report`	Parse an aggregate (RUA) report file into rows.
`check_record`	Read any DNS record type for a name.
`check_reverse_dns`	PTR / forward-confirmed reverse DNS for an IP.
`audit_spf_includes`	The SPF include/redirect tree — who can transitively send as the domain, with typed findings (broken include, confirmed-unregistered include, expiring registration, nested `+all`). Analysis only; no SPF fix record.
`build_parked_domain_records`	The Null MX + `v=spf1 -all` + `p=reject; np=reject` hardening pack for a domain that sends no mail. The server re-checks DNS itself and refuses when it finds evidence of mail.
`start_monitoring_signup`	A sign-up link to hand to the human who owns the domain. Sends no email and creates nothing — they open it, sign in on our page themselves (a social provider or an emailed link, whichever that deployment offers), and the domain is carried over to their dashboard already filled in; monitoring starts once they verify it with a TXT record.
`get_alerts`	Token required. The account's monitoring alert log, newest first. Read-only — no acknowledge, no delete. Page down with `before` until `next_before` is `null` before advancing `since`.
`get_readiness`	Token required. Whether one monitored domain's aggregate-report evidence justifies a stronger DMARC policy yet: `ready`, the `blockers`, and `next_record` (validated, or `null` while blocked — which is an answer, not a gap).

The two monitoring reads are listed for everyone and callable with a token: they appear in the tool list, and without a valid token the call is refused with the page the account owner mints one on. The dnsdoctor://domains resource (your monitored domains) is likewise always listed and refused without a token. Anonymous access covers all thirteen diagnosis tools, which is enough for a one-off diagnosis.

Install

Copy this openclaw-plugin/ directory into your OpenClaw plugins location (or install it from the OpenClaw plugin index once listed).
Enable the dns-doctor plugin. It connects to https://dnsdoctor.dev/mcp over streamable HTTP.
The agent guidance in GUIDANCE.md loads with the plugin.

Optional: API token for monitored domains

Anonymous access covers scanning and fixes. A per-account API token unlocks the account's own monitoring data: the get_alerts and get_readiness tools, and the dnsdoctor://domains resource:

Add an Authorization header to the server in plugin.json:

json

"mcp": {
  "servers": {
    "dns-doctor": {
      "transport": "http",
      "url": "https://dnsdoctor.dev/mcp",
      "headers": { "Authorization": "Bearer dnsd_YOUR_TOKEN" }
    }
  }
}

Prefer an environment variable over a committed literal; never commit the token.

Worked example

User: My newsletter keeps getting spoofed. Domain example.com.

Agent (scan_domain): DMARC is p=none — no enforcement, so spoofed mail isn't rejected. SPF is aligned (6/10 lookups). DKIM selector found and valid. Not blacklisted.

Agent (build_dmarc_upgrade): Alignment holds, so p=reject is safe. Publish this exact TXT record at _dmarc.example.com — paste it verbatim:
text
v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=r; aspf=r
Apply it in DNS once approved, then re-scan to confirm.

Learn more

Methodology: https://dnsdoctor.dev/methodology
REST API / OpenAPI schema: https://dnsdoctor.dev/api/v1/openapi.json

License

Apache-2.0. (The skills/dns-doctor SKILL.md is additionally published on ClawHub, which force-licenses skills MIT-0 — accepted for that file's text only.)