How do I install the Email Security skill?

Run npx skillmds@latest add uphiago/email-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Email Security skill do?

DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis It is listed under Security on SkillMD.

Is Email Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Email Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Email Security free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Email Security?

uphiago (@uphiago) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Email Security by uphiago — Agent Skill

Name: Email Security
Author: uphiago

File contents

Email Security -- DMARC, SPF, DKIM

When to Use

During passive reconnaissance (Phase 1)
After initial DNS enumeration
DMARC p=none means the domain can be totally spoofed
Critical for identifying phishing/business email compromise risks

DMARC/SPF/DKIM Check Commands

# SPF
dig +short TXT $target | grep "v=spf1"

# DMARC
dig +short TXT _dmarc.$target

# DKIM (common selector: google)
dig +short TXT google._domainkey.$target

# MX
dig +short MX $target

Interpreting Results

Config	Meaning	Risk
v=spf1 ~all (softfail)	SPF suggests blocking but doesnt enforce	Spoofed emails may pass
v=spf1 ?all (neutral)	SPF does nothing	Totally permissive
v=spf1 include:amazonses.com ~all	SES can send as domain	Any AWS SES account can spoof
v=DMARC1; p=none	DMARC disabled	Zero spoofing protection
v=DMARC1; p=quarantine	Failed emails go to spam	Partial protection
v=DMARC1; p=reject	Failed emails rejected	Full protection
DKIM missing	No cryptographic signature	Email can be forged

Email Spoofing via SMTP

# Test SMTP relay
timeout 3 bash -c 'exec 3<>/dev/tcp/TARGET/25; head -1 <&3'

# Send spoofed email via open relay (swaks)
swaks --to victim@target.com --from admin@target.com   --server TARGET --body "Spoofed email"

Headers That Indicate Security Level

Header	Value	Meaning
Authentication-Results	spf=pass	SPF passed
Authentication-Results	spf=fail	SPF failed
Authentication-Results	dmarc=pass	DMARC passed
Authentication-Results	dmarc=fail	DMARC failed
Authentication-Results	dkim=pass	DKIM passed
Received-SPF	Pass	Sender authorized
Received-SPF	Softfail	Sender not fully authorized
Received-SPF	Fail	Sender not authorized
ARC-Authentication-Results		Authentication chain

AWS SES Spoofing (When SPF includes amazonses.com)

With v=spf1 include:amazonses.com ~all:

Create AWS account
Configure SES with your own domain (verified)
Send email with From: admin@target.com
SPF PASSES (because of include:amazonses.com)
DMARC p=none -- provider delivers normally

Real-World Cases

Real-world case (CRITICAL): Political party -- DMARC p=none on both domains (DOMAIN_PLACEHOLDER_A, DOMAIN_PLACEHOLDER_B). SPF with include:amazonses.com (any SES account can send as the domain). Total email spoofing.

Pitfalls

Issue	Solution
SPF lookup limit	DNS has 10 lookup limit for SPF includes
DKIM selector unknown	Try common selectors: google, selector1, selector2, 2022, 2023
DMARC reporting	rua=mailto: may leak authentication results to third party

Verification

# Verify email spoofing is possible
# Send test email and check headers:
dig +short TXT _dmarc.target.com
# If p=none -> confirmed spoofable

---name: email-securitydescription: DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysislicense: MIT---# Email Security -- DMARC, SPF, DKIM## When to Use- During passive reconnaissance (Phase 1)- After initial DNS enumeration- DMARC p=none means the domain can be totally spoofed- Critical for identifying phishing/business email compromise risks## DMARC/SPF/DKIM Check Commands```bash# SPFdig +short TXT $target | grep "v=spf1"# DMARCdig +short TXT _dmarc.$target# DKIM (common selector: google)dig +short TXT google._domainkey.$target# MXdig +short MX $target```## Interpreting Results| Config | Meaning | Risk ||--------|---------|------|| v=spf1 ~all (softfail) | SPF suggests blocking but doesnt enforce | Spoofed emails may pass || v=spf1 ?all (neutral) | SPF does nothing | Totally permissive || v=spf1 include:amazonses.com ~all | SES can send as domain | Any AWS SES account can spoof || v=DMARC1; p=none | DMARC disabled | Zero spoofing protection || v=DMARC1; p=quarantine | Failed emails go to spam | Partial protection || v=DMARC1; p=reject | Failed emails rejected | Full protection || DKIM missing | No cryptographic signature | Email can be forged |## Email Spoofing via SMTP```bash# Test SMTP relaytimeout 3 bash -c 'exec 3<>/dev/tcp/TARGET/25; head -1 <&3'# Send spoofed email via open relay (swaks)swaks --to victim@target.com --from admin@target.com --server TARGET --body "Spoofed email"```## Headers That Indicate Security Level| Header | Value | Meaning ||--------|-------|---------|| Authentication-Results | spf=pass | SPF passed || Authentication-Results | spf=fail | SPF failed || Authentication-Results | dmarc=pass | DMARC passed || Authentication-Results | dmarc=fail | DMARC failed || Authentication-Results | dkim=pass | DKIM passed || Received-SPF | Pass | Sender authorized || Received-SPF | Softfail | Sender not fully authorized || Received-SPF | Fail | Sender not authorized || ARC-Authentication-Results | | Authentication chain |## AWS SES Spoofing (When SPF includes amazonses.com)With `v=spf1 include:amazonses.com ~all`:1. Create AWS account2. Configure SES with your own domain (verified)3. Send email with From: admin@target.com4. SPF PASSES (because of include:amazonses.com)5. DMARC p=none -- provider delivers normally## Real-World Cases**Real-world case (CRITICAL)**: Political party -- DMARC p=none on both domains (DOMAIN_PLACEHOLDER_A, DOMAIN_PLACEHOLDER_B). SPF with include:amazonses.com (any SES account can send as the domain). Total email spoofing.## Pitfalls| Issue | Solution ||-------|----------|| SPF lookup limit | DNS has 10 lookup limit for SPF includes || DKIM selector unknown | Try common selectors: google, selector1, selector2, 2022, 2023 || DMARC reporting | rua=mailto: may leak authentication results to third party |## Verification```bash# Verify email spoofing is possible# Send test email and check headers:dig +short TXT _dmarc.target.com# If p=none -> confirmed spoofable```

Frequently asked questions

Email Security