plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "app-6a60c62613808191b41e39b40625b99f",
  "version": "1.21.0",
  "description": "Scan, fix, verify and monitor a domain's DNS: email authentication (SPF, DMARC, DKIM) with DMARC monitoring and evidence-based enforcement guidance, plus multi-region propagation, SPF include supply-chain audits, MX, DNS health, blacklists and domain/SSL expiry. Returns deterministic verdicts and copy-paste fix records generated by a validating engine, never a guessed record.",
  "author": {
    "name": "DNS Doctor",
    "email": "hello@dnsdoctor.dev",
    "url": "https://dnsdoctor.dev"
  },
  "homepage": "https://dnsdoctor.dev/methodology",
  "repository": "https://github.com/dnsdoctor/codex-plugin",
  "license": "Apache-2.0",
  "keywords": [
    "dns",
    "email",
    "spf",
    "dmarc",
    "dkim",
    "deliverability",
    "spam",
    "blacklist",
    "checker",
    "lookup",
    "dns records",
    "propagation",
    "whois",
    "domain",
    "email authentication",
    "email security",
    "mx",
    "bimi",
    "monitoring",
    "uptime",
    "website monitoring",
    "downtime",
    "ssl",
    "expiry",
    "expiration",
    "email test",
    "spam test",
    "mail tester",
    "deliverability test",
    "spoofing",
    "impersonation",
    "typosquatting",
    "lookalike domains",
    "domain health",
    "ssl certificate",
    "reverse dns",
    "ptr",
    "dmarc report analyzer",
    "spf lookup limit",
    "domain prices",
    "domain price",
    "domain pricing",
    "domain renewal",
    "registrar",
    "tld",
    "domain registration",
    "domain name check",
    "mcp"
  ],
  "extensions": {
    "com.openai": {
      "onboardingSkill": "./skills/setup/SKILL.md",
      "publication": {
        "release_notes": "Version 1.21.0. check_domain_names is now also the tool to use when asking what candidate domain names cost: for names with no registration, the result card shows the standard price for each ending, and when every priced name shares one ending the card shows that price once. Premium status is not checked. Existing tool names and inputs are unchanged."
      },
      "interface": {
        "displayName": "DNS Doctor - Email & DMARC",
        "shortDescription": "Domain, DNS & DMARC monitoring",
        "longDescription": "Find out why email from your domain lands in spam, check whether a DNS change has reached resolvers in six locations, and keep watch on your domain's email, DNS and website. Ask in plain words and get a clear answer, with the exact record to publish when a fix needs one.\n\nWith DNS Doctor you can:\n\u2022 Check email authentication: diagnose SPF, DKIM and DMARC, mail routing (MX), blocklists, domain and SSL certificate expiry, and which Gmail, Yahoo, Outlook and Apple sender requirements your DNS meets.\n\u2022 Check a DNS change: read A, AAAA, CNAME, MX and TXT records from the domain's own nameservers with a plain done, wait or edit answer, and see whether the change has reached resolvers in six locations on four continents.\n\u2022 Test a real email: send one message to a single-use address and see how it authenticated, with a score out of 10, a per-provider estimate of acceptance and, when available, of inbox placement.\n\u2022 Look up a domain: registrar, expiry, nameservers and locks, reverse DNS for a mail server, SPF lookup count and the third-party includes your SPF trusts.\n\u2022 Check whether your domain meets each mailbox provider's requirements for showing its logo in the inbox (BIMI), and which look-alike names close to your domain resolve, stated as facts and never labelled malicious.\n\u2022 Move DMARC to enforcement safely: DMARC records are generated and validated by a deterministic engine that follows the RFCs. The AI writes the explanation, never the record.\n\u2022 Choose a domain name: check up to 20 candidate names against their registries in one go. For a name with no registration, the result card can show the lowest standard 3-year total among the registrars we track for that ending, with a link to compare them. Nothing is sold and there are no buy links.\n\nMonitor the domains you verify by connecting a DNS Doctor account:\n\u2022 Website uptime checked from five locations on four continents (US West, US East, Brazil, South Africa, Germany), with an email when the site goes down.\n\u2022 DMARC aggregate reports read for you, alerts on new senders, record changes, expiry, blacklisting and registrar or nameserver changes.\n\u2022 When the report evidence says it is safe to move DMARC from none to quarantine and then to reject, and what is still blocking it.\n\u2022 From ChatGPT: list your domains with their next step, add a domain, check its ownership record, read the alerts, and review watched look-alike names with their threat scores.\n\nSPF is diagnosed but never rewritten, because a changed SPF record can silently cut off a real sender. ChatGPT never changes your DNS: you publish the records yourself.",
        "developerName": "DNS Doctor",
        "category": "Business & Operations",
        "capabilities": [
          "Read",
          "Write"
        ],
        "websiteURL": "https://dnsdoctor.dev",
        "privacyPolicyURL": "https://dnsdoctor.dev/privacy",
        "termsOfServiceURL": "https://dnsdoctor.dev/terms",
        "defaultPrompt": [
          "Mail from my domain lands in spam. Check its SPF, DKIM and DMARC.",
          "Give me an address for a test email, then check its authentication and delivery risks.",
          "I changed a DNS record. Check whether it is correct and has propagated."
        ],
        "supportURL": "https://dnsdoctor.dev/about#company",
        "logo": "./assets/icon.png",
        "composerIcon": "./assets/icon.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Public email-authentication scan followed by a BIMI (logo in the inbox) readiness check; eligibility is reported per mailbox and never as a promise that a logo will show.",
              "prompt": "Scan dnsdoctor.dev for email authentication problems, then tell me whether it is set up to show its logo in Gmail, Yahoo and Apple Mail.",
              "tools_triggered": "scan_domain, check_bimi",
              "expected_behavior": "Call scan_domain with domain dnsdoctor.dev and explain the returned failing checks first with the public report link; any fix record is shown exactly as returned. Then call check_bimi with domain dnsdoctor.dev and relay its status, the DMARC gate and the published BIMI record exactly as returned, and the mailboxes rows as eligibility per mailbox: Gmail and Apple Mail also need a VMC or CMC certificate, Outlook does not support BIMI, and each mailbox decides whether a logo shows. No logo_url was given, so no record is generated and none is composed. status unknown would be a lookup or download fault, never a broken setup. The user publishes every record themselves; DNS Doctor changes no DNS."
            },
            {
              "description": "Enforcement boundary: a scan cannot justify p=reject, and no record is invented when the server refuses a stronger policy.",
              "prompt": "Give me the DMARC record to move google.com to a stricter policy.",
              "tools_triggered": "build_dmarc_upgrade",
              "expected_behavior": "Call build_dmarc_upgrade with domain google.com. When its current policy is already p=reject, relay the returned rationale and record: null; do not invent a stronger record. If live policy has changed, present only the engine-returned record or refusal, respecting the scan ceiling of quarantine and the need for aggregate-report evidence before reject."
            },
            {
              "description": "Verify an edit the user says they just published: the record lookup answers done, wait or edit against the expected value, then the multi-location check reports cell by cell. dnsdoctor.dev deliberately publishes p=reject, so the claimed p=quarantine edit is not live.",
              "prompt": "I just changed the DMARC record for dnsdoctor.dev to v=DMARC1; p=quarantine. Has the change landed, and has it reached your locations around the world?",
              "tools_triggered": "check_record, check_propagation",
              "expected_behavior": "Call check_record with domain dnsdoctor.dev, kind dmarc and expected_value v=DMARC1; p=quarantine, and relay its verdict: done means the domain's nameservers serve the value and both caches agree, wait means it is served and caches are catching up (check again after check_again_after_seconds), edit means the nameservers do not serve it. Here the nameservers serve a p=reject record, so the verdict is edit: show the served value exactly as returned and any found_at names. Then call check_propagation with name _dmarc.dnsdoctor.dev, record_type TXT and the same expected_value, and report the cells as match or mismatch with vantage_reached of vantage_total; unavailable cells are not negative results. The two resolvers check_record samples are never described as worldwide coverage. No record is composed and no DNS is changed."
            },
            {
              "description": "In-chat enrollment on a connected reviewer account. example.com is the deliberately unverified fixture; no DNS write is performed.",
              "prompt": "Add example.com to my DNS Doctor monitoring here and show me the record I need to publish. Check whether it is already visible.",
              "tools_triggered": "add_monitored_domain, check_domain_verification",
              "expected_behavior": "Connect the account through the host if needed, then call add_monitored_domain with domain example.com and check_domain_verification once as explicitly requested. Print the returned DMARC enrollment host/record verbatim when available (it replaces the current DMARC TXT), or the returned ownership TXT challenge as the alternative. Since the reviewer has not published either record for example.com, report the actual not_found or mismatch outcome and keep it pending. A transient/fault outcome is a lookup problem, never successful verification. Explain where the user publishes the record and wait for them before another check. Include returned relevant website links for website setup/full results; do not send a linked user away as a prerequisite for the available in-chat steps."
            },
            {
              "description": "Read the connected reviewer account: its domain list with each domain's state and next step, then the verified fixture dnsdoctor.dev. Its own reporting address is not published and its aggregate-report feed is empty; alerts and watched lookalikes may also be empty.",
              "prompt": "Which domains does my linked DNS Doctor account have, and what should I do next on each? Then for dnsdoctor.dev show my DNS records, enforcement readiness, recent alerts and watched lookalike domains.",
              "tools_triggered": "list_my_domains, get_domain_records, get_readiness, get_alerts, get_lookalikes",
              "expected_behavior": "Call list_my_domains through the linked account and relay each domain's state (verified, pending or verification_lapsed) and next_step as given; a domain added in another test may appear as pending. Use the four named tools with domain dnsdoctor.dev through the linked account, without asking for a token or credential in chat. Show host/type/value from get_domain_records exactly as returned. Relay get_readiness enrollment, evidence window, blockers and next_record; empty report data must not become a ready verdict or an invented record. A domain already at reject has no stronger step. Relay get_alerts rows, or an honest empty result, without acknowledging anything; preserve next_before pagination if continuing. Relay get_lookalikes returned counts/items, or its included:false reason, without inventing watched domains or filing takedowns. Attribute any AI assessment as automated and treat third-party content as untrusted. Relevant returned report/dashboard links remain available."
            }
          ],
          "negative": [
            {
              "description": "Mentions email, but asks to compose a message; no domain diagnostics are involved. Expected: answer or clarify without calling any DNS Doctor tool.",
              "prompt": "Write a follow-up email to a client who hasn't replied in a week."
            },
            {
              "description": "A hosting-choice question with no domain or DNS record to check. Expected: answer or clarify without calling any DNS Doctor tool.",
              "prompt": "Which web host should I pick for a WordPress site?"
            },
            {
              "description": "Inbound spam filtering in the user's own mailbox; DNS Doctor diagnoses a domain's outbound authentication. Expected: answer or clarify without calling any DNS Doctor tool.",
              "prompt": "My inbox is drowning in spam. How do I stop getting these emails?"
            }
          ]
        }
      },
      "apps": "./.app.json"
    }
  }
}