Scans SPF and DMARC records for issues that could allow email spoofing.

Email spoofing is alive and well. Many organisations' SPF and DMARC records do not provide the necessary guidance for recipients to validate the authenticity of emails bearing their domain names.

mailspoof can be used by organisations, pentesters and red-teamers to quickly sift through a large list of domains for lax SPF and DMARC policies.

In some cases mailspoof could highlight spoofable external domains that employees are likely to trust, such as suppliers gathered from OSINT or other known organisations.

Email spoofing may be successful against recipients that manage their filtering themselves. Large email providers like GMail have the big data and the heuristics to efficiently handle spam. For example, GMail will likely forward a spoofed email from a common domain directly to the spam folder, even if the email doesn't fail validation due to lax policies.

$ pip3 install mailspoof

mailspoof outputs JSON, making it easy to query with a tool like jq.

$ printf "google.com\napple.com\nmicrosoft.com" > /tmp/list
$ mailspoof -d github.com -d reddit.com -iL /tmp/list
[
  {
    "domain": "google.com",
    "issues": [
      {
        "code": 4,
        "title": "'SoftFail' qualifer for 'all' mechanism",
        "detail": "The 'all' mechanism uses the 'SoftFail' qualifer '~'. It should be possible to spoof the domain by only causing a soft SPF failure. Most fil
ters will let this through by only raising the total spam score."
      }
    ]
  },
  ...
]

You can use mailspoof in your own Python scripts:

$ python
>>> import mailspoof
>>> mailspoof.scan('google.com')
[{'code': 4, 'title': "'SoftFail' qualifer for 'all' mechanism", 'detail': "The 'all' mechanism uses the 'SoftFail' qualifer '~'. It should be possible to spoof the domain by only causing a soft SPF failure. Most filters will let this through by only raising the total spam score."}]

mailspoof can check the registration status of domains in an SPF record, including included domains (see issue code 6 below). If any domains are found to be unregistered, attackers may register the domain and inject SPF mechanisms.

The registration status will only be checked if there is an environment variable WHOAPI_KEY with a valid key for whoapi.com. At the time of writing the service offers 500 API calls with a free account.

The following SPF and DMARC issues are currently checked: