@blackveil/dns-checks
v1.60.2
Published
Runtime-agnostic DNS and email security checks (16 checks + scoring engine) for BlackVeil Security
Readme
@blackveil/dns-checks
DNS and email security check implementations for BlackVeil Security.
License: BUSL-1.1 — Copyright (c) 2023-2026 BLACKVEIL Security
Installation
npm install @blackveil/dns-checksUsage
DNS checks take a queryDNS function as their second argument (dependency injection); the HTTP checks (checkSSL, checkHTTPSecurity) take a fetch-compatible function instead:
import { checkSPF } from '@blackveil/dns-checks';
const result = await checkSPF('example.com', async (domain, type, opts) => {
// Your DNS resolver implementation
return ['v=spf1 include:_spf.google.com ~all'];
});
console.log(result.score); // 0-100
console.log(result.findings); // Array of findingsScoring
import { computeScanScore } from '@blackveil/dns-checks/scoring';
const score = computeScanScore(checkResults);
const grade = score.grade; // A+, A, B+, etc., or null when the scan is ungraded (score.overall is null)The scoring registry includes the authoritative_dns_infra category used by the MCP worker's authoritative DNS infrastructure profile. In normal mail/web profiles it carries zero scoring weight; when the dedicated profile is selected, it is weighted with DNSSEC, NS, and zone-hygiene evidence.
Available Checks
| Check | Function | Standard |
|-------|----------|----------|
| SPF | checkSPF | RFC 7208 |
| DMARC | checkDMARC | RFC 7489 |
| DKIM | checkDKIM | RFC 6376 |
| DNSSEC | checkDNSSEC | RFC 4033 |
| SSL/TLS | checkSSL | — |
| MTA-STS | checkMTASTS | RFC 8461 |
| TLSRPT | checkTLSRPT | RFC 8460 |
| MX | checkMX | RFC 5321 |
| CAA | checkCAA | RFC 8659 |
| BIMI | checkBIMI | Draft |
| NS | checkNS | RFC 1035 |
| DANE Email | checkDANE | RFC 7672 |
| DANE HTTPS | checkDANEHTTPS | RFC 6698 |
| SVCB/HTTPS | checkSVCBHTTPS | RFC 9460 |
| Subdomain Takeover | checkSubdomainTakeover | — |
| HTTP Security | checkHTTPSecurity | — |
| Subdomailing | checkSubdomailing | — |
The MCP server package layers additional worker-only tools on top of this library, including check_authoritative_dns_infra and check_root_server_set.
License
Business Source License 1.1 (BUSL-1.1). See LICENSE. Non-commercial use is permitted under the Additional Use Grant; the Licensed Work converts to the MIT License on the Change Date (2030-03-17). Commercial licences are available on request via https://blackveilsecurity.com/contact.
