The DMARC MCP server for the AI assistant you already use
Connect a compatible MCP client to Palisade using Palisade's registered OAuth client. Your assistant gets 42 tools to add domains, retrieve the exact SPF, DKIM, and DMARC records to publish, verify them, and work through the authentication tasks Palisade finds.
What MCP Server helps you accomplish
Work where you already ask
Bring Palisade into the assistant or agent your team already uses. Domain setup and review can start in the same conversation as the rest of your work.
Exact records, not guesses
Your assistant retrieves the DNS records Palisade generated for the domain, including each record's current verification status.
You stay in control
Palisade returns the records and tasks. You publish changes at your DNS provider and decide what happens next.
Trusted by leading brands worldwide
Connect from the client you already use
MCP requires OAuth through Palisade's public connector client (ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV), using PKCE with no client secret. Sign in and select your organization. API keys and self-registered OAuth clients are not accepted on the MCP endpoint; API keys remain available for the REST API.
Streamable HTTP
https://api.palisade.email/mcp
Use Palisade's public OAuth client or the official stdio bridge. Sign in and select your organization; no API key is needed.
Works with
In claude.ai, open Settings, then Connectors, then Add custom connector.
Paste the endpoint below and choose Authentication: Always required.
Choose Use your own OAuth client, enter client ID ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV, and leave the secret blank.
Complete sign-in and select your Palisade organization.
https://api.palisade.email/mcpUse Palisade's public connector client. Automatic registration and hosted client metadata do not grant organization access.
From a DMARC problem to a deployed fix
Palisade's DMARC agent finds authentication problems, proposes a remediation, and lets you deploy supported fixes from the AI you already use.
Connect your AI
Point your client at Palisade's remote MCP server and sign in when it opens the browser. No key to create first.
Find the problems
Ask the agent to inspect a domain. Palisade surfaces SPF, DKIM, and DMARC problems as tasks with exact evidence.
Review the remediation
Open a task in your AI to see what is wrong, why it matters, and Palisade's recommended fix before anything changes.
Deploy from your AI
Approve supported Palisade-hosted fixes in the conversation, publish any returned DNS records, then ask the agent to verify the domain.
Find your DNS provider guide
The record is only half the job. Pick the DNS provider that answers for the domain to see the checks and publishing context that apply next.
Find the right publishing context
Choose the provider that answers for your domain. Each guide covers its authority checks, email-authentication record handling, and the current Palisade publishing workflow.
View all DNS providers
Logos provided by Logo.dev
Prompts to paste into a connected assistant
Examples for the full MCP endpoint. ChatGPT's read-only connection supports diagnosis; onboarding and changes require the full connection with the appropriate permissions.
Onboard a domain
Add acme-corp.com to Palisade, publish the DNS records it returns using my DNS connector, then verify the domain and list any tasks it finds.
Diagnose deliverability
Mail from acme-corp.com is landing in spam. Read the domain's state and its open tasks in Palisade, and walk me through what is failing and each recommended fix.
See who is failing authentication
Which senders are failing authentication on acme-corp.com? Open Palisade's tasks for the domain and show me the evidence behind each one.
Get ready for p=reject
I want acme-corp.com at p=reject. Check where the domain stands in Palisade and tell me what has to be resolved before tightening the policy is safe.
Check the SPF lookup budget
How close is acme-corp.com to SPF's 10-DNS-lookup limit? Read the live record from Palisade and show me which includes cost the most and any problems in the chain.
Weekly status summary
Give me a Monday summary: every domain in Palisade, its verification status, and any open authentication tasks, ordered by what to fix first.
Set up a new client
Create a group in Palisade for my new client Acme Corp, add their three domains to it, and give me the DNS records each one needs.
What you are connecting to
Every value here is either quoted from the developer guide or verified against the live endpoint. Nothing below is inferred.
| Endpoint | https://api.palisade.email/mcp |
|---|---|
| Transport | Streamable HTTP (remote) |
| Authentication | MCP requires OAuth through Palisade's public connector client (ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV), using PKCE with no client secret. Sign in and select your organization. API keys and self-registered OAuth clients are not accepted on the MCP endpoint; API keys remain available for the REST API. |
| Tools | 42 across 11 groups: Domains, DNS and policy, Groups, Webhooks, Work queue, DMARC reports, Account and billing, Public DNS checks, Prospecting reports, DNS connections, Activity log. |
| Clients | Palisade supports ChatGPT through a custom MCP connection to https://api.palisade.email/mcp/directory for read-only monitoring and diagnosis. This connection requires an account with exactly one active Palisade organization. Palisade is not yet listed in the OpenAI app directory; directory availability is separate from ChatGPT support. Claude and Claude Code use Palisade's public OAuth client. Codex CLI, Cursor and Windsurf use the official stdio bridge. |
| stdio bridge | @palisadeemail/mcp on npm. |
| Directories | Listed in the official MCP registry as email.palisade/palisade, and on Smithery as palisade/palisade-dmarc-agent. |
| Scope | Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data. |
| What it changes | Palisade returns the exact records, and in the Palisade app Smart DNS Deployment publishes the ones you approve into your own DNS across 64 providers. Palisade-hosted DMARC and MTA-STS can be switched on through MCP. No tool in this server writes a record at an external provider. |
| Plan required | Any plan, including the free one. |
What the server can touch, and what it cannot
Six mechanisms, each one checkable. The short version: you sign in instead of pasting a secret, your DNS credentials stay with you, and every write is recorded.
No DNS credentials change hands
No tool in this server writes a record at an external DNS provider. Your agent publishes the returned records with its own DNS access, and verify_domain checks the result against live DNS.
Revocable OAuth connections
Sign in with Palisade's public OAuth client, select an organization, and grant scopes within your role. Revoke the connection from API and MCP in the Palisade app.
Scopes mirror real permissions
The scopes a client requests are the same permissions the tools enforce. The consent screen lists them, and a token only ever carries the subset your role grants.
One organization at a time
Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data.
Rate limits on every caller
Each signed-in identity is rate limited, and responses carry standard rate-limit headers a client can read and back off on.
Writes land in the audit log
Every tool call that changes something, from create_domain to delete_webhook_endpoint, is recorded in your account's activity log with the tool name attached.
How it compares to other DMARC MCP servers
Most DMARC MCP servers wrap a reporting or DNS API in tools. The differences that matter are who holds which credential and what your agent gets back.
| Dimension | Typical DMARC MCP server | Palisade |
|---|---|---|
| Credential custody | Some store your registrar or DNS API keys so they can write records for you. | Never asks for DNS credentials. Your agent publishes records with its own DNS access, and Palisade verifies the result against live DNS. |
| Sign-in | A token that reaches whatever the vendor's account happens to cover. | OAuth through Palisade's public connector client. You select an organization, scopes follow your role, and the connection can be revoked in the app. |
| Official MCP registry | Rarely listed. | Listed as email.palisade/palisade, with control of the name proven by a DNS record on palisade.email. |
| Remediation | Findings you interpret and fix yourself. | A work queue of tasks, each carrying the evidence and a recommended fix your agent can read before anything changes. |
| SPF lookup budget | Usually a pass/fail syntax check, when SPF is covered at all. | get_spf reads the live chain: every include with what it costs, the count against the 10-lookup limit, and problems like duplicate records or stale includes. |
| Webhooks | Usually none. | Four tools to register HTTPS endpoints, pick the events Palisade posts, and watch delivery health. |
| DMARC report data | DNS lookups at call time; few ingest aggregate reports. | Palisade ingests your DMARC aggregate reports continuously and turns authentication failures into tasks. |
All 42 tools, by name
Tools on the full MCP endpoint. ChatGPT's directory connection exposes read-only monitoring and diagnosis tools.
Domains
list_domains- List the domains in your Palisade account with their monitoring status, deliverability score, DMARC policy, and managed DNS record statuses.
get_domain- Check the status of a domain in your Palisade account, by id or by name: the managed DNS status of each record (SPF, DKIM, DMARC, BIMI, MTA-STS), monitoring status, DMARC policy, score, and 14-day pass rates.
create_domain- Add a domain you already own to your Palisade account, to start email authentication monitoring.
verify_domain- Trigger DNS verification for a domain after publishing records at your DNS provider.
update_domain- Change the settings of a domain already in your Palisade account: which group it belongs to, whether it is parked, its DMARC policy options, and the SPF record Palisade publishes for it.
delete_domain- Permanently remove a domain from your Palisade account.
get_domain_plan- Answer "what happens next on this domain" rather than "what is open right now".
DNS and policy
get_dns_records- Get the DNS records to publish for a domain: purpose (dmarc, spf, dkim, mta_sts, mta_sts_policy, tls_rpt, bimi), record type, host (absolute and relative to the apex), value, recommended TTL, required action (create, replace, or delete), whether the record is required, its live verification status, and already_published.
get_spf- Read the live SPF state of a domain: the record DNS actually serves, how many DNS lookups it costs receivers against SPF's limit of 10, a breakdown of every include/a/mx/exists lookup with what each accounts for, and the problems found — a record over the lookup limit, more than one v=spf1 record (which receivers reject outright), includes that no longer resolve, loops, and unsafe all mechanisms.
enable_hosted_dmarc- Switch a domain to Palisade-hosted DMARC.
get_mta_sts- Get the MTA-STS state for a domain: whether Palisade-hosted MTA-STS is enabled, the policy mode, MX list, and the DNS targets to publish.
enable_mta_sts- Enable Palisade-hosted MTA-STS for a domain.
disable_mta_sts- Turn off Palisade-hosted MTA-STS for a domain.
Groups
list_groups- List the groups in your Palisade account.
create_group- Create a group to organize domains — for example one group per customer if you are an MSP.
update_group- Rename a group or change the external identifiers it is reconciled by.
delete_group- Permanently delete a group.
Webhooks
list_webhook_events- List the event types a webhook endpoint can subscribe to, with what each one means.
list_webhook_endpoints- List the webhook endpoints registered for your organization, including their status and recent delivery health.
create_webhook_endpoint- Register an https URL that Palisade POSTs events to, so you can react to domain changes instead of polling get_domain.
delete_webhook_endpoint- Stop delivering events to a webhook endpoint and remove it.
Work queue
list_tasks- List remediation tasks Palisade opened for your domains (failing SPF/DKIM sources, DNS issues, setup steps).
get_task- Get a single task by id.
complete_task- Close a remediation task as done, once the change it asked for is actually live.
dismiss_task- Close a remediation task that does not apply, without doing the work it asks for - for example a failing sender the organization does not own and will not authenticate.
DMARC reports
get_dmarc_summary- Summarize what DMARC aggregate reports say about a domain over a recent window: message volume, DMARC/SPF/DKIM pass rates, the compliance breakdown, and the change against the immediately preceding window of the same length (so the default 7-day period is a week-over-week comparison).
list_dmarc_senders- List the sources sending mail as a domain, built from DMARC aggregate reports and ordered by volume.
Account and billing
get_account- Get the Palisade organization (account) you are signed in to: name, contact details, and settings.
get_subscription- Get the billing state of your Palisade organization: pricing type, subscription status, the current billing period (start and end), resource limits, Free-plan email usage when applicable, and current-calendar-month domain usage.
start_checkout- Create a Stripe Checkout session to start a paid Palisade subscription for your organization.
start_billing_portal- Start a Stripe billing-portal session for your organization and return its URL.
Public DNS checks
audit_domain- Check the status of any domain's email authentication from live DNS in one call: MX, SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT, each with a verdict and the records behind it, plus a score out of 100.
validate_spf_include- Check whether a domain can be used as an SPF `include:` and how many DNS lookups adding it would cost.
Prospecting reports
create_prospecting_report- Audit up to ten domains and produce a branded PDF report on their email-authentication posture, hosted behind a Palisade link you can send to a prospect.
list_prospecting_reports- List the prospecting reports your organization has generated, newest first, with the link and expiry for each.
get_prospecting_report- Read one prospecting report by id: the domains it covers, who it was written for, its link and when that link expires.
delete_prospecting_report- Delete a prospecting report and the stored PDF behind it.
DNS connections
list_dns_connections- List the DNS providers your organization has connected to Palisade.
get_dns_connection- Read one DNS provider connection by id, including whether its stored credentials still work.
get_dns_connection_coverage- Answer whether one of your DNS connections can publish records for a given domain, and which one.
Activity log
list_activity_log- Read what has happened in your Palisade account: who changed a domain, when a record was published, which API key did it.
list_activity_log_actions- Return every action value that can appear in the activity log.
Tell your agent how to use them
The order the guide recommends, and a brief you can paste into your own repo so a coding agent knows when to reach for Palisade.
Order of work
Start with a read-only check. Continue to onboarding only when the operator requests it, using the returned DNS evidence.
audit_domainRead the domain's public DNS and explain the findings. For an audit-only request, stop here: the domain does not need to be added to your account. Continue below only for operator-approved onboarding through the full MCP endpoint.
create_domainIf the operator wants ongoing monitoring, add the domain. Skip this step when it is already in the account.
get_dns_recordsGet the exact SPF, DKIM, and DMARC records to publish.
- (your DNS provider)
Publish those records. MCP hands your assistant the values and has no tool that writes them at a provider. In the Palisade app, Smart DNS Deployment publishes the ones you approve into your own DNS.
verify_domainVerify the records once they resolve.
list_tasksWork through the authentication issues Palisade reports.
Instructions for your agent
Paste this into the AGENTS.md or CLAUDE.md of a repo whose coding agent has Palisade connected. It carries the same order of work, plus the limits worth knowing before a tool is called.
## Palisade: email authentication (MCP)
Palisade is connected as an MCP server at https://api.palisade.email/mcp (Streamable HTTP, OAuth through Palisade's public connector client).
Use it for anything involving SPF, DKIM, DMARC, MTA-STS or BIMI on the domains this project sends mail from.
Work in this order:
1. `audit_domain`: Read the domain's public DNS and explain the findings. For an audit-only request, stop here: the domain does not need to be added to your account. Continue below only for operator-approved onboarding through the full MCP endpoint.
2. `create_domain`: If the operator wants ongoing monitoring, add the domain. Skip this step when it is already in the account.
3. `get_dns_records`: Get the exact SPF, DKIM, and DMARC records to publish.
4. (your DNS provider): Publish those records. MCP hands your assistant the values and has no tool that writes them at a provider. In the Palisade app, Smart DNS Deployment publishes the ones you approve into your own DNS.
5. `verify_domain`: Verify the records once they resolve.
6. `list_tasks`: Work through the authentication issues Palisade reports.
Rules:
- Never write a record value from memory. Read it from `get_dns_records`, which returns each record with its current verification status.
- No tool in this server publishes DNS at an external provider. Hand the records back for a person to publish, or point them at Smart DNS Deployment in the Palisade app.
- `enable_hosted_dmarc` and `enable_mta_sts` change the domain's live configuration. Confirm before calling them.
- `start_checkout` and `start_billing_portal` touch billing. Never call them unprompted.
- Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data.The same brief is at /mcp.md, alongside every config and all the tool names, as plain Markdown for an assistant to read directly.
Solve DMARC problems without leaving your AI
Palisade turns 42 MCP tools into practical work: finding issues, explaining the evidence, proposing the next fix, and keeping every domain moving.
Find authentication problems
Ask your AI to inspect a domain and surface the SPF, DKIM, and DMARC issues Palisade found.
Fix DNS and deliverability blockers
Open any task to review the exact evidence and Palisade's recommended remediation before making a change.
Publish with confidence
Retrieve the right DNS records, see each record's status, and ask your AI to verify the domain after publishing.
Manage every domain in context
Add, inspect, verify, or remove domains from the same conversation where you are working through the fix.
Keep teams and clients organized
Group domains by team, customer, or portfolio so your AI works with the right organization and context.
Automate the follow-up
Use webhooks to connect domain and task changes to the operational workflows your team already runs.
Proof from teams using Palisade as an operating layer.The same DMARC work, available from the AI you already use.
5.0 out of 5 on G2Trusted by over 10,000 domains
Deliverability
21% more meetings booked.How gaiia stopped landing in spam.
“We increased our meetings booked by 21% and slept better at night knowing our emails are now secured”
Marc-André Campagna, CEO, gaiia
MCP Server: FAQ
What is the Palisade MCP server?
It is a Model Context Protocol server at https://api.palisade.email/mcp, over Streamable HTTP, that gives an AI assistant 42 tools for managing email authentication: adding domains, reading the exact DNS records to publish, verifying them, and working through the authentication issues Palisade finds.
Can Palisade MCP find and fix DMARC, SPF, and DKIM problems?
Yes. Your AI can use Palisade to list authentication tasks, open a task for its evidence and recommended fix, retrieve the exact SPF, DKIM, and DMARC records to publish, and verify the domain afterward. It can also read a domain's live SPF chain with get_spf, including the DNS lookup count against the 10-lookup limit that SPF flattening exists to solve. Supported Palisade-hosted fixes can be enabled through MCP; records at an external DNS provider remain yours to publish.
Can Palisade MCP help improve email deliverability?
It helps you find and remediate SPF, DKIM, and DMARC problems that can contribute to rejected or spam-folder mail. Your AI can review Palisade's evidence, proposed remediation, and verification status in one conversation. Email authentication is only one part of deliverability, so MCP does not guarantee inbox placement.
How do I authenticate with the Palisade MCP server?
MCP requires OAuth through Palisade's public connector client (ryKtuiPypMeYMoL1Cmhxtz6BYrEYQbLV), using PKCE with no client secret. Sign in and select your organization. API keys and self-registered OAuth clients are not accepted on the MCP endpoint; API keys remain available for the REST API.
Which AI assistants can connect to it?
ChatGPT uses Palisade's read-only directory endpoint for monitoring and diagnosis. Claude and Claude Code connect using Palisade's public OAuth client. Codex CLI, Cursor and Windsurf can use the official stdio bridge, which handles the same OAuth sign-in. Follow the client-specific setup steps on this page.
Can I connect Palisade to ChatGPT?
Palisade supports ChatGPT through a custom MCP connection to https://api.palisade.email/mcp/directory for read-only monitoring and diagnosis. This connection requires an account with exactly one active Palisade organization. Palisade is not yet listed in the OpenAI app directory; directory availability is separate from ChatGPT support.
What does stdio mean, and when do I need the MCP bridge?
Stdio is a local transport used by some MCP clients instead of a direct web connection. If your client cannot connect to Palisade's remote Streamable HTTP endpoint, the published @palisadeemail/mcp package bridges that local connection to the same remote server.
Is the Palisade MCP connection secure?
The remote server is HTTPS-only. Account data and changes stay within the authenticated organization. Public DNS checks can inspect domains outside that account without accessing another organization's private data. OAuth scopes follow your role. Revoke a connection from API and MCP in the Palisade app. Review any returned DNS changes before you publish them.
Do I need a paid plan to use the MCP server?
No. MCP is available on any plan, including the free plan. Sign in to an existing Palisade organization to connect.
Can the assistant change my DNS by itself?
Not from MCP. This server returns the exact records; no tool in it writes at a DNS provider. In the Palisade app, Smart DNS Deployment can publish the records you approve straight into your own DNS across 64 providers. Either way the boundary is the same: nothing changes without your approval.
Connect your AI to Palisade
1 domain free up to 1,000 emails/month