MailCrypto

Mail Crypto

The Mail Crypto module automates the discovery of cryptographic public keys associated with email addresses, specifically querying DNS for OPENPGPKEY and SMIMEA records. This is critical for mapping an organization's secure communications infrastructure and identifying active public keys used by staff.

Note

Brute-Force Disabled by Default: By default, this module strictly accepts Email nodes as input. Only if you explicitly enable brute-forcing in your Network Configuration, will the module also accept Domain and Subdomain nodes.

Capabilities

Depending on your configuration, the module accepts Email, Domain, and Subdomain nodes.

If an Email node is provided, the module directly targets that specific address. If a Domain or Subdomain is provided (and brute-forcing is enabled), the module will systematically iterate through a curated list of 15 standard infrastructure aliases (e.g., admin, postmaster, security, support, abuse) to discover hidden cryptographic records.

For every target email address, the module executes the following:

1. OpenPGP Key Discovery

The module queries the domain for an OPENPGPKEY record associated with the target email.

• Public Key Extraction: If found, the module extracts the binary key material and emits an OpenPGPKey property containing the clean Base64-encoded public key.
• Contextual Mapping: The property is contextualized with the exact email address it was discovered on.

2. S/MIME Certificate Discovery

The module queries the domain for a SMIMEA record associated with the target email.

• Certificate Extraction: If found, the module parses the complex DANE structure and extracts the SMIMEA association data.
• Deep Parsing: The module decodes the binary payload to automatically determine and map the cryptographic context, emitting human-readable identifiers for the Certificate Usage (e.g., PKIX-CA, DANE-EE), Selector (e.g., Cert, SPKI), and Matching Type (e.g., Full, SHA256). This detailed context is attached to the resulting property.