mailspoof

A security checklist app for your Mac that helps you with basic security hygiene and prevents 80% of problems.

Many organizations' SPF and DMARC records do not offer adequate guidance for recipients to verify the authenticity of emails that use their domain names. Mailspoof can be utilized by organizations, penetration testers, and red-teamers to efficiently analyze a large number of domains for weak SPF and DMARC policies. In certain instances, Mailspoof may identify external domains that can be easily spoofed, which employees are likely to trust, such as suppliers obtained from OSINT or other recognized organizations. Email spoofing can be particularly effective against recipients who manage their own email filtering. In contrast, major email providers like Gmail leverage big data and advanced heuristics to effectively combat spam.

For example, GMail is likely to send a spoofed email from a well-known domain directly to the spam folder, even if that email passes validation due to lenient policies.

$ pip3 install mailspoof Examples: The CLI mailspoof provides output in JSON format, which simplifies querying with tools like jq. $ printf "google.com\napple.com\nmicrosoft.com" > /tmp/list $ mailspoof -d github.com -d reddit.com -iL /tmp/list