About email-security
A security-testing skill for reviewing a domain’s DMARC, SPF, and DKIM records and interpreting their implications for email spoofing. It includes DNS checks, SMTP relay tests, and guidance for verifying findings using message headers.
Key features
- 01Checks DMARC, SPF, and DKIM records
- 02Interprets email authentication settings
- 03Tests SMTP relay availability
- 04Explains relevant message headers
- 05Lists common DNS and selector pitfalls
Use cases
- 01Reviewing email security during reconnaissance
- 02Assessing a domain’s email spoofing exposure
- 03Checking whether SMTP relays accept test connections
- 04Verifying authentication results in message headers
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/email-securityin Claude Code to confirm it loaded.
Details
From the project READMEEmail Security -- DMARC, SPF, DKIM
When to Use
- During passive reconnaissance (Phase 1)
- After initial DNS enumeration
- DMARC p=none means the domain can be totally spoofed
- Critical for identifying phishing/business email compromise risks
DMARC/SPF/DKIM Check Commands
# SPF
dig +short TXT $target | grep "v=spf1"
# DMARC
dig +short TXT _dmarc.$target
# DKIM (common selector: google)
dig +short TXT google._domainkey.$target
# MX
dig +short MX $target
Interpreting Results
| Config | Meaning | Risk |
|---|---|---|
| v=spf1 ~all (softfail) | SPF suggests blocking but doesnt enforce | Spoofed emails may pass |
| v=spf1 ?all (neutral) | SPF does nothing | Totally permissive |
| v=spf1 include:amazonses.com ~all | SES can send as domain | Any AWS SES account can spoof |
| v=DMARC1; p=none | DMARC disabled | Zero spoofing protection |
| v=DMARC1; p=quarantine | Failed emails go to spam | Partial protection |
| v=DMARC1; p=reject | Failed emails rejected | Full protection |
| DKIM missing | No cryptographic signature | Email can be forged |
Email Spoofing via SMTP
# Test SMTP relay
timeout 3 bash -c 'exec 3<>/dev/tcp/TARGET/25; head -1 <&3'
# Send spoofed email via open relay (swaks)
swaks --to [email protected] --from [email protected] --server TARGET --body "Spoofed email"
Headers That Indicate Security Level
| Header | Value | Meaning |
|---|---|---|
| Authentication-Results | spf=pass | SPF passed |
| Authentication-Results | spf=fail | SPF failed |
| Authentication-Results | dmarc=pass | DMARC passed |
| Authentication-Results | dmarc=fail | DMARC failed |
| Authentication-Results | dkim=pass | DKIM passed |
| Received-SPF | Pass | Sender authorized |
| Received-SPF | Softfail | Sender not fully authorized |
| Received-SPF | Fail | Sender not authorized |
| ARC-Authentication-Results | Authentication chain |
AWS SES Spoofing (When SPF includes amazonses.com)
With v=spf1 include:amazonses.com ~all:
- Create AWS account
- Configure SES with your own domain (verified)
- Send email with From: [email protected]
- SPF PASSES (because of include:amazonses.com)
- DMARC p=none -- provider delivers normally
Real-World Cases
Real-world case (CRITICAL): Political party -- DMARC p=none on both domains (DOMAIN_PLACEHOLDER_A, DOMAIN_PLACEHOLDER_B). SPF with include:amazonses.com (any SES account can send as the domain). Total email spoofing.
Pitfalls
| Issue | Solution |
|---|---|
| SPF lookup limit | DNS has 10 lookup limit for SPF includes |
| DKIM selector unknown | Try common selectors: google, selector1, selector2, 2022, 2023 |
| DMARC reporting | rua=mailto: may leak authentication results to third party |
Verification
# Verify email spoofing is possible
# Send test email and check headers:
dig +short TXT _dmarc.target.com
# If p=none -> confirmed spoofable
Comments
Markdown supported