Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dnsdoctor/claude-plugin --skill dns-doctorgit clone --depth 1 https://github.com/dnsdoctor/claude-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dnsdoctor/claude-plugin/dns-doctor)<a href="https://agentmods.dev/skills/dnsdoctor/claude-plugin/dns-doctor"><img src="https://agentmods.dev/badge/skills/dnsdoctor/claude-plugin/dns-doctor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dnsdoctor/claude-plugin/dns-doctor"><img src="https://agentmods.dev/badge/skills/dnsdoctor/claude-plugin/dns-doctor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.17049 |
| Opus 5.5 | $0.00036 | $0.06820 |
| Sonnet 5.5 | $0.00018 | $0.03410 |
| Haiku 4.5 | $0.00009 | $0.01705 |
Grade A, and why
dns-doctor scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Strips warnings and disclaimerslowAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
- Don't lecture and don't scare. No history of email, no worst-case stories: a Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 810 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DNS Doctor — the DNS, DMARC, SPF and DKIM skill
DNS Doctor looks up and verifies DNS records, checks propagation and registration, and diagnoses email authentication and DNS health. It returns observed evidence and copy-paste fix records generated by a validating engine, never an LLM guess. Explain the result and relay records exactly as returned; do not author a DNS record yourself.
Choose the shortest workflow for the user's request
Ask for a missing domain, exact record name or type before calling a tool. Use this router first; the full scan workflow below is for a broad diagnosis, not a prerequisite for every lookup. Stop when the requested question is answered. Two jobs have their own short skills: verify-change (did my change land, has it propagated, look again after the TTL) and fix-dmarc (scan, the next DMARC record, re-check).
| User's question | First tool and boundary |
|---|---|
| One record, or did my change land? | check_record for the requested type/name, with expected_value when checking an edit. Preserve subdomains such as www; use host where applicable. Relay verdict; on wait, wait check_again_after_seconds before checking again. An empty answer is absence; a lookup failure is unknown. |
| Which domains does the account monitor? | list_my_domains (token). Never guess the list from alerts. |
| Has it propagated across regions? | check_propagation with the exact FQDN and record type; use the supplied expected_value when present. Report actual coverage, not a worldwide claim from a local read. |
| Registrar, registration, expiry or locks? | lookup_registration; unknown is never proof a name is available. |
| Is this DKIM selector published? | check_dkim_selector with the selector the user or provider supplied. Never fabricate a key or selector. |
| Broad email-authentication or DNS diagnosis? | scan_domain, then focused follow-up only as needed. It publishes a public report; do not scan a domain the user wants kept private. |
| Does a real email actually authenticate (signed, aligned, why it lands in spam)? | start_email_test, then the "Test a real email" playbook below. A published DKIM key does not prove the sender signs; one test message does. |
| Logo in the inbox (BIMI): how to get it, does it work, why it doesn't show? | check_bimi, then the "Logo in the inbox (BIMI)" playbook below. Its mailboxes are eligibility, never a promise that a logo will show. |
| Verify a provider's email DNS setup? | Follow the provider-verification playbook below using the provider-issued public records and existing lookup tools. |
| Ongoing monitoring? | Offer the website or linked-account setup sequence below, following the user's choice and agreement before adding a domain. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +184 lines 1a94752a9199
- 2d ago Changed · +5 lines 7a0109a57b6f
- 7d ago Changed · +25 lines 07cba86efa63
- 15d ago Changed · +30 lines · +5 tokens per session 775d5cb8f63f
- 19d ago Changed · +118 lines · -91 tokens per session 52f398605fd6
- 20d ago Changed d1dcb0669bae
- 21d ago Changed d719ded5e270
- 29d ago Changed · +3 lines 2252c2ddd7e9
- 1mo ago Changed · +3 lines a225680b8b65
- 1mo ago First seen · 442 lines · 177 tokens per session scan A a2c3e004d769
dns-doctor is a skill published in the GitHub repository dnsdoctor/claude-plugin (3 stars, last pushed yesterday), licensed Apache-2.0. It adds 91 tokens to every session and 17,049 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (strips warnings and disclaimers). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's…
analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
email-deliverability
Use when mail already sent lands in spam, is rejected, or fails the Gmail/Yahoo bulk-sender checks and the fix is authentication and reputation, not the sending code: SPF/DKIM/DMARC alignment, domain warmup, spam-complaint rate, one-click unsubscribe, BIMI. NOT putting mail on the wire through a provider API (that is…
email-security
DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis.
analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.