🛡️ MailAudit is a Bash-based tool that audits the security posture of mail domains.
It checks DNS, MX records, TLS, DANE, and policy configurations (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, CAA, DNSSEC) to ensure domains are hardened against spoofing, downgrade attacks, and misconfigurations.
- 🔍 Resolve MX records for a domain
- 🌐 Detect cloud/hosted MX (Microsoft 365, Google Workspace, etc.) and skip redundant checks
- 📡 Port & TLS checks:
- 25 (SMTP)
- 465 (SMTPS)
- 587 (Submission, if open)
- 993 (IMAPS)
- 🔑 Validate DANE/TLSA records
- 🔒 Detect TLS protocol support (1.0 → 1.3)
- 📜 Parse and validate X.509 certificates
- 📨 Check SPF, DMARC (DKIM is inferred via keys), ARC
- 📑 Fetch and validate MTA-STS policies (handles CRLF/BOM issues)
- 📊 Check TLS-RPT, BIMI, CAA, and DNSSEC
- 🚫 Highlight weak, missing, or legacy configurations
- ⚡ Parallel mode for faster scans
bash(>= 3.0, tested on macOS’s Bash 3 and GNU Bash 4+)dig(bind-utils / dnsutils)curlopensslncorncat
It should also work on other Linux distros, but you may need to install the required dependencies manually.
On Debian/Ubuntu:
sudo apt install dnsutils curl openssl netcatOn RHEL/CentOS:
sudo yum install bind-utils curl openssl nmap-ncatClone the repo:
git clone https://github.com/lulzkiller666/MailAudit.git
cd MailAudit
chmod +x MailAudit.shRun a simple scan against a domain (auto-detect MX):
./MailAudit.sh example.comRun against a domain and its MX (explicit):
./MailAudit.sh -D example.com --mxRun directly against a host:
./MailAudit.sh -H mail.example.comRun with parallel scanning enabled:
./MailAudit.sh example.com --parallel
- NIST SP 800-177: Trustworthy Email
- NIST SP 800-52r2: TLS Guidelines
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)
- RFC 8460: SMTP TLS Reporting (TLS-RPT)
MIT