Best DMARC MCP servers
Five DMARC platforms publish an MCP server today: Palisade, PowerDMARC, DMARC Examiner, DmarcDkim.com and DMARKOFF, alongside the self-hostable DMARCguard. They split on one thing, and it is not tool counts: whether the assistant can only read your data, or can also change something. An MCP server is what lets an assistant work with your real DMARC data instead of reasoning from general knowledge. This roundup records what each vendor publishes on its own pages, covering what the assistant may do, transport, authentication, and what it costs to connect.
By Samuel Chenard, CEO & Co-Founder, PalisadePublished 18 Aug 2026
ChatGPT
Claude
Gemini
Perplexity
Grok
At a glance
| Platform | Assistant may | Transport | Auth | Cost to connect |
|---|---|---|---|---|
 Palisade | Yes: Read + enable | Yes: Remote + stdio | Yes: API key | Yes: Free plan |
 PowerDMARC | Yes: Read + write | Yes: Remote | Yes: API token | Partial: Not stated |
 DMARC Examiner | Partial: Read + dismiss | Yes: Remote + stdio | Yes: OAuth, 5 scopes | Yes: Free tier |
 DmarcDkim.com | Partial: Read only | Yes: Remote | Yes: OAuth + keys | Partial: Free lookups |
 DMARKOFF | Partial: Read only | Yes: Remote | Yes: OAuth 2.1 | Yes: In paid plans |
 DMARCguard (formerly parse-dmarc) | Partial: Read | Yes: Remote + stdio | Yes: OAuth | Yes: Free tier |
Strong / published Partial / quote No / not published
How we compared
Each server was read on its own product or documentation pages on 18 August 2026, plus the official MCP registry where a vendor publishes there. Directory listings and review sites were not treated as vendor claims.
The meysam81/parse-dmarc repository now redirects to dmarcguardhq/dmarcguard, so that entry is recorded under the DMARCguard name and read on both the repository and dmarcguard.io.
Where a vendor does not publish something, this page says so rather than inferring it.
Tool counts are quoted only where the vendor publishes a list. A count is not a capability measure, so nothing is ranked on it.
No server was benchmarked. Response quality depends on the assistant asking, not on the server alone, and cannot be measured from a product page.
- What the assistant may do. Whether the server is read-only, or can also create, change, or enable something.
- Transport. Whether the server is remote, local over stdio, or both, which decides the clients that can reach it.
- Authentication. What credential the connection uses, and what it scopes access to.
- Cost to connect. Whether MCP access needs a paid plan, a trial, or works on a free tier.
The best DMARC MCP servers, ranked
Palisade
Our platformFree planBest for: Teams that want the assistant to fix, not just reportThe pick when the assistant should carry a domain from problem to published fix, with a human approving each change.
Palisade publishes a remote MCP server with 21 tools across six groups: domains, DNS and policy, groups, webhooks, the authentication work queue, and account. The assistant retrieves the exact SPF, DKIM and DMARC records to publish, verifies them once they resolve, and works the task list Palisade generates. MCP access is available on any plan, including the free one.
Key features
- 21 tools across 6 groups
- Remote Streamable HTTP, plus an npm bridge for stdio-only clients
- Returns the exact records to publish, with per-record status
- Can switch on Palisade-hosted DMARC and MTA-STS
- Listed in the official MCP registry
Assistant may
Reads your domains and tasks, returns the exact records for you to publish, and can switch on Palisade-hosted DMARC and MTA-STS
Transport
Streamable HTTP, plus a published npm bridge for stdio-only clients
Auth
Palisade API key as a bearer token, scoped to the calling organization
Cost to connect
Included on every plan, including the free one
Choose Palisade if You want the assistant to find the authentication problem, show you the evidence, hand you the exact record, and verify it after you publish, rather than only describing what is wrong.
PowerDMARC
Trial; MCP plan not statedBest for: Multi-account resellers wanting the widest tool surfaceThe broadest published tool list, extending past DMARC data into sub-account and member administration.
PowerDMARC hosts an MCP server whose published tool list covers aggregate and forensic report queries, domain health, DNS lookups, record generators, hosted records, audit logs and sub-account administration. Its own page shows the assistant creating a domain and adding a member, so the surface reaches account management rather than reporting alone.
Key features
- Published tools across reports, domains, lookups and generators
- Sub-account and member administration, listed as partner features
- Vendor-hosted, connected with an API token
- Documents Claude, Cursor and ChatGPT
Assistant may
Creates and deletes domains, generates records, and adds or removes sub-account members
Verified 2026-08-18 ↗Transport
Remote Streamable HTTP at mcp-dmarc.com/mcp, per its official registry entry; the vendor's MCP page gives a config snippet per client without naming the transport
Verified 2026-08-18 ↗Auth
API token generated in the PowerDMARC dashboard, scoped to that token's permissions
Verified 2026-08-18 ↗Choose PowerDMARC if You administer many sub-accounts and want account and member management in the same MCP surface as the report data.
DMARC Examiner
Free tier; paid from $2.99/moBest for: A registry-published server with a free tierPublished in the official MCP registry with both a remote endpoint and an stdio bridge, and an enumerated tool list.
DMARC Examiner publishes an MCP server at mcp.dmarc-examiner.com/mcp with eight tools across five OAuth scopes, covering domains, reports, CSV export and alerts. Seven of the eight read; dismiss_alert is the one that changes state. It ships a remote Streamable HTTP endpoint and an npm stdio bridge.
Key features
- Published in the official MCP registry, active since August 2026
- Eight tools enumerated across five OAuth scopes
- Remote Streamable HTTP plus an npm stdio bridge
- Free tier of one domain and 1,000 emails per month
Assistant may
Seven of the eight published tools read domains, reports and alerts; dismiss_alert is the only one that changes state
Verified 2026-08-18 ↗Transport
Streamable HTTP at mcp.dmarc-examiner.com/mcp, plus the @dmarc-examiner/mcp npm stdio bridge
Verified 2026-08-18 ↗Cost to connect
Free tier available; paid plans from $2.99/month, each with a 14-day trial and no card required
Verified 2026-08-18 ↗Choose DMARC Examiner if You want a registry-published server you can connect on a free tier, and reading reports, sources and alerts is the job.
DmarcDkim.com
Free lookup toolsBest for: DNS and record diagnosisA read-oriented server whose lookup tools run against any domain, not only your own.
DmarcDkim.com publishes an MCP server split into free lookup tools and account tools. The lookups cover DNS record types, DMARC validation, DKIM selector checks and SPF syntax against RFC 7208. The account tools read stored aggregate reports, failing senders, DNS history and TLS-RPT data, and need a paid subscription.
Key features
- Free lookup tools that run against any domain
- SPF syntax validation and record merging
- Stored report and DNS history on paid plans
- OAuth for interactive clients, API keys for scripts
Assistant may
Retrieves and analyses existing records and reports; it does not modify DNS records
Verified 2026-08-18 ↗Cost to connect
Free lookup tools after sign-in; stored account data needs a paid subscription
Verified 2026-08-18 ↗Choose DmarcDkim.com if You want an assistant that is strong at diagnosing records and reading reports, and you do not need it to change anything.
DMARKOFF
Paid plan; 14-day trialBest for: Monitoring where the assistant must not change anythingRead-only by published design, which is the point if an assistant touching configuration is off the table.
DMARKOFF publishes an MCP server that exposes domain health, authentication results, policy status and alert data to an AI assistant. Its page states the server is read-only by default and cannot modify DNS records or account configuration, and that access is scoped to what the account authorizes.
Key features
- Read-only by default, stated on the vendor's page
- OAuth 2.1 with account permission scoping
- Documents Claude, ChatGPT, Cursor, Windsurf and Continue.dev
- Included on paid plans at no extra cost
Assistant may
Read-only by default; the page states it cannot modify DNS records or account configuration
Verified 2026-08-18 ↗Transport
Remote Streamable HTTP at mcp.dmarkoff.com/mcp, per its official registry entry; the vendor's MCP page does not name the transport
Verified 2026-08-18 ↗Choose DMARKOFF if Your policy is that an assistant may read email authentication data and nothing else, and you want that boundary set by the server rather than by prompt discipline.
DMARCguard (formerly parse-dmarc)
Apache-2.0 to self-hostBest for: Self-hosting on your own infrastructureThe open-source option, Apache-2.0 and self-hostable, with an MCP server that speaks both stdio and Streamable HTTP.
DMARCguard, which the meysam81/parse-dmarc repository now redirects to, fetches DMARC aggregate reports from a mailbox over IMAP, parses them and shows them in a dashboard. Its repository implements MCP under internal/mcp, registering tools alongside an OAuth package and both a stdio transport and a Streamable HTTP handler. The product site advertises 17 MCP tools for AI stacks. It is a different project from the Python parsedmarc by domainaware, despite the similar name.
Key features
- Apache-2.0 and self-hostable via Docker or a binary
- MCP over both stdio and Streamable HTTP
- OAuth included in the repository
- 17 MCP tools advertised on the product site; nine registered in the repository
Transport
Both — the repository ships a stdio transport and a Streamable HTTP handler
Verified 2026-08-18 ↗Cost to connect
Free to self-host under Apache-2.0; the hosted free plan includes 5 AI queries a day, unlimited from Pro
Verified 2026-08-18 ↗Choose DMARCguard (formerly parse-dmarc) if You want DMARC report parsing on infrastructure you control at no licence cost, and you are comfortable running and updating it yourself.
See where your domains stand
Run a free Email Security Score, or connect Palisade to the assistant you already use.
1 domain free up to 1,000 emails/month