email-security

1# Email Security -- DMARC, SPF, DKIM
2 
3## When to Use
4 
5- During passive reconnaissance (Phase 1)
6- After initial DNS enumeration
7- DMARC p=none means DMARC enforcement is off; actual spoofability still depends on SPF/DKIM and the receiver's local policy
8- Critical for identifying phishing/business email compromise risks
9 
10## Prerequisites
11 
12- Explicit authorization, target boundaries, and rate limits for the target.
13- Tooling: `dig`, `swaks`.
14- A writable evidence directory: `export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR"`.
15- For any state-changing step (writes, uploads, credential attempts), obtain explicit confirmation immediately before the command.
16 
17## How to Run
18 
19```bash
20# SPF
21dig +short TXT $target | grep "v=spf1"
22 
23# DMARC
24dig +short TXT _dmarc.$target
25 
26# DKIM (common selector: google)
27dig +short TXT google._domainkey.$target
28 
29# MX
30dig +short MX $target
31```
32 
33## Procedure
34 
35The phases below are the procedure. Keep each probe bounded (`--max-time`), record evidence beneath `OUTPUT_DIR`, and stop at the stop-conditions listed in Pitfalls.
36 
37## DMARC/SPF/DKIM Check Commands
38 
39```bash
40# SPF
41dig +short TXT $target | grep "v=spf1"
42 
43# DMARC
44dig +short TXT _dmarc.$target
45 
46# DKIM (common selector: google)
47dig +short TXT google._domainkey.$target
48 
49# MX
50dig +short MX $target
51```
52 
53## Interpreting Results
54 
55| Config | Meaning | Risk |
56|--------|---------|------|
57| v=spf1 ~all (softfail) | SPF suggests blocking but doesnt enforce | Spoofed emails may pass |
58…