Module todo: DMARK/DKIM/SPF

[TheTechromancer]

Some basic examples, courtesy of chatgpt:

# Checking for common misconfigurations in SPF, DKIM, and DMARC records

def check_spf_misconfigurations(record):
    issues = []
    if 'all' in record:
        if '+all' in record:
            issues.append("SPF configured to allow all hosts.")
    return issues

def check_dkim_misconfigurations(record):
    issues = []
    if 'k=rsa;' not in record:
        issues.append("DKIM is not using RSA for signing.")
    return issues

def check_dmarc_misconfigurations(record):
    issues = []
    if 'p=none' in record:
        issues.append("DMARC policy is set to 'none'.")
    return issues

def check_email_security(domain):
    all_issues = {}

    # Check SPF record
    spf_issues = []
    try:
        spf_record = dns.resolver.resolve(domain, 'TXT')
        spf_text = [r.to_text() for r in spf_record if 'v=spf1' in r.to_text()][0]
        spf_issues = check_spf_misconfigurations(spf_text)
    except dns.resolver.NoAnswer:
        spf_issues.append("No SPF record found.")
    all_issues['SPF'] = spf_issues

    # Check DKIM record
    dkim_issues = []
    try:
        dkim_record = dns.resolver.resolve(f"selector1._domainkey.{domain}", 'TXT')
        dkim_text = dkim_record[0].to_text()
        dkim_issues = check_dkim_misconfigurations(dkim_text)
    except dns.resolver.NoAnswer:
        dkim_issues.append("No DKIM record found.")
    all_issues['DKIM'] = dkim_issues

    # Check DMARC record
    dmarc_issues = []
    try:
        dmarc_record = dns.resolver.resolve(f"_dmarc.{domain}", 'TXT')
        dmarc_text = dmarc_record[0].to_text()
        dmarc_issues = check_dmarc_misconfigurations(dmarc_text)
    except dns.resolver.NoAnswer:
        dmarc_issues.append("No DMARC record found.")
    all_issues['DMARC'] = dmarc_issues

    return all_issues

domain = "example.com"
issues = check_email_security(domain)
for key, value in issues.items():
    if value:
        print(f"Potential {key} issues for {domain}:")
        for issue in value:
            print(f"- {issue}")

Explanation

• SPF Checks: 'all' should not be configured to allow all hosts (+all). This is a common misconfiguration that basically nullifies the purpose of having an SPF record.

• DKIM Checks: The key algorithm (k=) should be RSA. If it's not, that's a potential problem as RSA is the recommended signing algorithm.

• DMARC Checks: A common misconfiguration is having the policy (p=) set to 'none', which means that the DMARC policy will not take any action against emails that fail the DMARC checks.

This should give you a starting point to build a more comprehensive tool.