langchain-dnsdoctor

LangChain tools for DNS Doctor: scan, diagnose and fix a domain's email authentication (SPF, DMARC, DKIM), check a DNS change from six locations on four continents, audit an SPF include chain, and read monitoring alerts. Every verdict is deterministic and every record comes from a validating engine, never from a language model.

Twenty-two tools, the same set the hosted MCP server exposes. Tool names, descriptions and input schemas are generated from that server and shipped in tools.json; this package restates none of them.

Install

pip install langchain-dnsdoctor

Python 3.10+, langchain-core 1.x. No API key is needed for the sixteen anonymous tools.

Use

from langchain.agents import create_agent
from langchain_dnsdoctor import DnsDoctorToolkit

toolkit = DnsDoctorToolkit()
agent = create_agent(
    model="claude-sonnet-4-6",
    tools=toolkit.get_tools(),
    system_prompt=toolkit.instructions,
)
agent.invoke({"messages": [{"role": "user", "content": "Is example.com spoofable? Fix it."}]})

toolkit.instructions is the hosted server's own guidance and belongs in the system prompt: present records verbatim, a temperror status is transient and not a failure, not_registered: true is not health, SPF is diagnose-only, a human approves every DNS change. Two tool descriptions are longer than OpenAI's 1024-character limit for function descriptions; those are cut at a sentence boundary on the tool and carried in full in the instructions.

A subset, or a single tool:

from langchain_dnsdoctor import dnsdoctor_tools

scan, upgrade = dnsdoctor_tools(["scan_domain", "build_dmarc_upgrade"])
print(scan.invoke({"domain": "example.com"}))

Tools

Environment

Past the free per-caller allowance the API answers 402 with an x402 offer (USDC on Base). This package does not pay; the tool returns the offer text so an agent with an x402 client can retry with payment, or wait.

Rules the tools follow

• A transport failure (rate limit, 402, 503, 5xx, network) is returned as text that says it is not a verdict about the domain. It never raises.
• Responses are relayed byte-for-byte. The package composes no record and no URL.
• SPF is diagnose-only. The one SPF record the API ever emits is the constant -all inside the parked-domain pack, for a domain the server verified sends no mail.

Development

pip install -e ".[test]"
pytest                      # unit tests, offline
pytest tests/integration_tests -m integration   # one live call against dnsdoctor.dev

Apache-2.0.