email-security-check

Fast, zero-dependency email security scanner for Node.js. Checks DMARC, SPF, DKIM, MTA-STS, BIMI, and DANE records for any domain.

6 checks. 1 function call. 0 dependencies.

npx email-security-check google.com

  email-security-check v1.0.0
  ─────────────────────────────────────
  Scanning google.com ...

  Score: ██████████████████████████░░░░ 87/100  A

  [OK] DMARC     PASS     p=reject
       DMARC reject — spoofed emails are blocked. Well configured.

  [OK] SPF       PASS     -all
       SPF configured with -all (hardfail). 4 DNS lookups.

  [OK] DKIM      PASS     found
       DKIM selectors found: google.

  [~ ] MTA-STS   MEDIUM   mode=testing
       MTA-STS is in testing mode — failures are reported but mail is still delivered without TLS.

  [OK] BIMI      PASS     full
       BIMI configured with logo and VMC authority certificate.

  [- ] DANE      LOW      missing
       No TLSA records for MX hosts. DANE is uncommon but provides strong TLS authentication when present.

Install

npm install email-security-check

Usage

As a library

import { scan } from "email-security-check";

const result = await scan("example.com");

console.log(result.grade);           // "A+" | "A" | "B" | "C" | "D" | "F"
console.log(result.score);           // 0-100
console.log(result.dmarc.policy);    // "reject" | "quarantine" | "none"
console.log(result.spf.all_qualifier); // "-all" | "~all" | "?all" | "+all"
console.log(result.dkim.selectors_found); // ["google", "selector1"]
console.log(result.mta_sts.mode);    // "enforce" | "testing" | "none"
console.log(result.mx_hosts);        // ["mx1.example.com", "mx2.example.com"]

Individual checks

import { checkDmarc, checkSpf, checkDkim, checkMtaSts, checkBimi, checkDane } from "email-security-check";

const dmarc = await checkDmarc("example.com");
const spf   = await checkSpf("example.com");
const dkim  = await checkDkim("example.com", ["google", "selector1"]);

CLI

# Pretty output
email-security-check example.com

# JSON output (pipe to jq, scripts, CI)
email-security-check example.com --json

# Custom DKIM selectors
email-security-check example.com --selectors default,google,o365

CI/CD Integration

# .github/workflows/email-security.yml
name: Email Security Audit
on:
  schedule:
    - cron: "0 9 * * 1"  # Every Monday at 9am
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - run: npx email-security-check your-domain.com --json > report.json
      - run: |
          GRADE=$(cat report.json | jq -r '.grade')
          if [[ "$GRADE" =~ ^(D|F)$ ]]; then
            echo "::error::Email security grade is $GRADE"
            exit 1
          fi

What gets checked

| Check | What | RFC / Standard | |----------|-------------------------------------------|----------------------| | DMARC | Policy, pct, rua/ruf, subdomain policy | RFC 7489 | | SPF | Mechanism, all qualifier, lookup count | RFC 7208 | | DKIM | Selector enumeration (22 common selectors)| RFC 6376 | | MTA-STS | DNS record + policy file + mode | RFC 8461 | | BIMI | Logo URL + VMC authority | IETF Draft | | DANE | TLSA records on MX hosts | RFC 7672 |

Scoring

Each finding carries a severity weight:

| Severity | Weight | Example | |----------|--------|----------------------------------| | Critical | -40 | No DMARC, SPF +all | | High | -25 | DMARC p=none, no SPF | | Medium | -10 | SPF ~all, no DKIM selectors found| | Low | -3 | No MTA-STS, no BIMI | | Pass | 0 | Correctly configured |

Score = 100 - sum(weights). Grade: A+ (90+), A (80+), B (70+), C (60+), D (40+), F (<40).

API Reference

scan(domain, options?)

| Parameter | Type | Description | |-----------|------|-------------| | domain | string | Domain to scan (with or without protocol) | | options.dkim_selectors | string[] | Custom DKIM selectors to check | | options.timeout | number | MTA-STS fetch timeout in ms (default: 5000) | | options.follow_includes | boolean | Reserved for future SPF include resolution |

Returns: Promise<ScanResult>

ScanResult

{
  domain: string;
  score: number;          // 0-100
  grade: string;          // A+ through F
  scanned_at: string;     // ISO 8601
  findings: Finding[];    // All 6 findings
  dmarc: DmarcResult;
  spf: SpfResult;
  dkim: DkimResult;
  mta_sts: MtaStsResult;
  bimi: BimiResult;
  dane: DaneResult;
  mx_hosts: string[];
}

Why this exists

Most email security tools are either SaaS-only, outdated, or pull in a tree of dependencies for what is fundamentally DNS lookups. This package uses only Node.js built-in dns and https modules — nothing else.

Built by DC INFOSEC for automated compliance scanning at scale.

License

MIT