Bash script that audits SPF, DKIM, DMARC, DNSSEC, MTA-STS and DNS hygiene to grade a domain's exposure to email spoofing and phishing.
Inspired by spoofcheck.
Mail Authentication Checker verifies SPF, DKIM, DMARC, DNSSEC, MTA-STS and the root domain hack to assess how well a domain is protected against spoofing and phishing.
Features:
pct, reporting addresses (incl. external report authorisation)-S: open relay, smuggling, NTLM, AUTH surfacebash mailAuthCheck.sh google.com
bash mailAuthCheck.sh google.com example.com github.com
Several domains can be passed at once; each is reported in its own boxed header and the checks run one domain after the other. The banner is printed once, the target card once per domain:
│ MAIL AUTHENTICATION CHECKER v1.1
│ The existence of a security record does not mean
│ it is actually implemented
│
╔══════════════════════════════════════════════════════════════════════╗
║ target example.com ║
║ resolver 8.8.8.8 2026-11-13T00:56:14Z ║
╚══════════════════════════════════════════════════════════════════════╝
The banner and the card share one width, so the version sits over the card's right edge; both widen when a domain is longer than the default 72 columns, and the same width is used for every domain in the run so the boxes line up.
Options can appear before, between or after the domains:
-s SELECTOR extra DKIM selector to try (repeatable)-r LABEL Microsoft 365 tenant name to test (default: first label of each domain)-d SERVER DNS resolver to query (default: 8.8.8.8, or $DNS_SERVER)-v show raw DNS records and details-q only show warnings and failures-S also run the intrusive SMTP probes (open relay, smuggling, NTLM, AUTH); needs outbound 25/587 and takes a minute or more per MX hostExit status: 0 no failing check, 1 at least one failing check (in any
domain), 2 usage error.
By default the report is grouped into AUTHENTICATION, DNS HYGIENE,
MAIL DELIVERY, TRANSPORT SECURITY and ADDITIONAL sections, with the
records shown in grey under each check.
Every row is a fixed three-column table: status, a short check name (at most
twelve characters, e.g. DKIM, Wildcard, Root domain), and the
description. Check-specific qualifiers such as the DKIM selector, the MX host
or the SPF include are appended to the description in parentheses, so the
columns line up across all sections:
OK DKIM secure (2048-bit RSA) (selector1._domainkey.example.com)
OK Wildcard no wildcard at the dns apex
Severity follows the effect on spoofing, not just the record: an SPF policy that
ends in ~all is OK when DMARC is p=reject or p=quarantine (DMARC
compensates for the softfail) and FAIL when DMARC is p=none or missing,
because then nothing rejects the unauthorised sender. A strict -all stays
OK even with p=none; that exposure is reported on the DMARC row.
include:sendgrid.net (or a per-account include:uXXXXXXX.wl.sendgrid.net)
authorises SendGrid's shared IP ranges to send for the domain. SPF is evaluated
against the envelope sender, so an attacker sending through their own SendGrid
account still passes SPF while the visible From is yours; only DMARC keeps
that mail out. The check follows nested SPF includes and reports:
FAIL when SendGrid or Mandrill is included and there is no DMARC record or the policy is p=none: a spoofed From is deliveredWARN when the policy is only p=quarantine: the spoofed mail lands in spamOK when the policy is p=rejectThe list of shared platforms lives in SPF_SHARED_PROVIDERS; only add providers
that do not verify the From domain for every customer.
Both recordings below were slowed to improve readability, in reality it took less than 1 second to execute.
git clone https://gitlab.com/brn1337/mailAuthCheck.git
cd mailAuthCheck
Run the script from inside WSL, not from PowerShell, and install dig first:
sudo apt update && sudo apt install -y bind9-dnsutils
bash mailAuthCheck.sh google.com
The repository ships a .gitattributes that forces LF line endings for *.sh.
If you cloned it before that file existed, re-checkout the script once so it no
longer has Windows CRLF endings (which make bash fail with $'\r': command not found):
git checkout -- mailAuthCheck.sh
Mail Authentication Checker is licensed under CC BY-NC-SA 4.0
CC-BY-NC-SA This license requires that reusers give credit to the creator.
It allows reusers to distribute, remix, adapt, and build upon the material in any medium or format, for noncommercial purposes only.
If others modify or adapt the material, they must license the modified material under identical terms.
- Credit must be given to you, the creator.
- Only noncommercial use of your work is permitted.
- Adaptations must be shared under the same terms.