skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

email-security

Analyze SPF, DKIM, and DMARC records to identify spoofing vulnerabilities.

3|1|Updated Jul 2, 2026
Search Tags:#security#reconnaissance#email#spoofing#spf#dkim#dmarc
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill email-security-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-security
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/email-security
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill email-security-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dig, swaks.

What problem does it solve?

This skill addresses the critical security gap where domains lack proper email authentication, leaving them vulnerable to phishing and business email compromise (BEC) attacks.

Core Features & Use Cases

  • Authentication Analysis: Automatically checks for the presence and configuration of SPF, DKIM, and DMARC records.
  • Spoofing Risk Assessment: Identifies permissive configurations like DMARC p=none or weak SPF policies that allow unauthorized actors to send emails on behalf of a domain.
  • Use Case: During a reconnaissance phase, use this skill to determine if a target organization's domain can be spoofed to facilitate a social engineering campaign.

Quick Start

Use the email-security skill to perform a full DNS and header analysis on the target domain example.com.

Frequently Asked Questions about email-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check SPF, DKIM, and DMARC records to assess domain email spoofing risks?▼

Evaluating email authentication involves analyzing SPF, DKIM, and DMARC DNS records to identify permissive configurations like DMARC p=none. This exposes spoofing vulnerabilities and business email compromise risks for the target domain.

What is a DMARC p=none vulnerability in email security?▼

A DMARC p=none vulnerability occurs when a domain's DMARC policy is set to take no action on failed authentication checks. This permissive configuration allows attackers to spoof emails, facilitating phishing and business email compromise campaigns.

Do I need dig and swaks installed to audit domain email authentication configurations?▼

Yes, you need dig and swaks installed to audit domain email authentication. Dig queries DNS records for SPF, DKIM, and DMARC, while swaks evaluates SMTP relay configurations to assess overall domain protection levels.

How does SMTP relay configuration analysis help identify business email compromise vectors?▼

SMTP relay configuration analysis identifies business email compromise vectors by evaluating how mail servers handle incoming and outgoing messages. This exposes weaknesses in security headers and relay settings that attackers can exploit for phishing.

What's the best way to evaluate email security headers and spoofing vulnerabilities during reconnaissance?▼

The best way to evaluate email security headers and spoofing vulnerabilities during reconnaissance is by auditing domain authentication records alongside SMTP relay configurations. This provides actionable insights into domain protection levels and potential exploitation vectors.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

analyzing-email-headers-for-phishing-investigation

Parse email headers and validate SPF, DKIM, and DMARC records.

Official
Advanced
SherifEldeebSherifEldeeb
5

email-forensics

Parse email mailboxes and extract messages, headers, and artifacts for forensic investigations.

Community
Intermediate
LeoWSY-hashblueLeoWSY-hashblue
3

reconnaissance

Aggregate subdomains, ports, endpoints, and APIs into structured inventories.

Community
Intermediate
rampstackcorampstackco
523

email-deliverability

Audit domain email deliverability and configure SPF, DKIM, and DMARC.

Official
Advanced