email-security

Name: email-security
Availability: InStock
Author: entrovyx

Analyze SPF, DKIM, and DMARC records to identify spoofing vulnerabilities.

3|1|Updated Jul 2, 2026

Search Tags:#security #reconnaissance #email #spoofing #spf #dkim #dmarc

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill email-security-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: email-security
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/email-security
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill email-security-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dig, swaks.

What problem does it solve?

This skill addresses the critical security gap where domains lack proper email authentication, leaving them vulnerable to phishing and business email compromise (BEC) attacks.

Core Features & Use Cases

Authentication Analysis: Automatically checks for the presence and configuration of SPF, DKIM, and DMARC records.
Spoofing Risk Assessment: Identifies permissive configurations like DMARC p=none or weak SPF policies that allow unauthorized actors to send emails on behalf of a domain.
Use Case: During a reconnaissance phase, use this skill to determine if a target organization's domain can be spoofed to facilitate a social engineering campaign.

Quick Start

Use the email-security skill to perform a full DNS and header analysis on the target domain example.com.

Frequently Asked Questions about email-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check SPF, DKIM, and DMARC records to assess domain email spoofing risks?▼

Evaluating email authentication involves analyzing SPF, DKIM, and DMARC DNS records to identify permissive configurations like DMARC p=none. This exposes spoofing vulnerabilities and business email compromise risks for the target domain.

What is a DMARC p=none vulnerability in email security?▼

A DMARC p=none vulnerability occurs when a domain's DMARC policy is set to take no action on failed authentication checks. This permissive configuration allows attackers to spoof emails, facilitating phishing and business email compromise campaigns.

Do I need dig and swaks installed to audit domain email authentication configurations?▼

Yes, you need dig and swaks installed to audit domain email authentication. Dig queries DNS records for SPF, DKIM, and DMARC, while swaks evaluates SMTP relay configurations to assess overall domain protection levels.

How does SMTP relay configuration analysis help identify business email compromise vectors?▼

SMTP relay configuration analysis identifies business email compromise vectors by evaluating how mail servers handle incoming and outgoing messages. This exposes weaknesses in security headers and relay settings that attackers can exploit for phishing.

What's the best way to evaluate email security headers and spoofing vulnerabilities during reconnaissance?▼

The best way to evaluate email security headers and spoofing vulnerabilities during reconnaissance is by auditing domain authentication records alongside SMTP relay configurations. This provides actionable insights into domain protection levels and potential exploitation vectors.