n8n Domain Security Node

A comprehensive n8n community node for domain security assessment, designed for Managed Service Providers (MSPs) and IT security consultants.

Overview

This node provides automated domain security validation covering email authentication (SPF, DKIM, DMARC), DNS infrastructure security, transport security (MTA-STS, TLS-RPT), and brand indicators (BIMI). Scoring rules are JSON-configurable and executed by a rules engine, producing transparent per-section scores and a weighted overall score.

Operations

| Operation | Value | Description | |-----------|-------|-------------| | Full Security Audit | audit | Comprehensive audit: email auth + DNS infra + transport security, with overall score | | Check DMARC | dmarc | DMARC record validation and best-practice scoring | | Check DKIM | dkim | DKIM selector discovery and key validation | | Check SPF | spf | SPF record syntax and best-practice validation | | Check BIMI | bimi | BIMI record (RFC 8553) validation with logo reachability and SVG Tiny 1.2 profile check | | Check MTA-STS | mtaSts | MTA-STS policy (RFC 8461) discovery and validation | | Check TLS-RPT | tlsRpt | TLS-RPT record (RFC 8460) endpoint validation | | Check DNSSEC | dnssec | DNSSEC presence and chain validation (AD bit via Cloudflare DoH) | | Check CAA | caa | CAA record validation | | Check Open Resolver | openResolver | Tests if nameservers are open resolvers | | Check Zone Transfer | zoneTransfer | Tests if nameservers allow AXFR zone transfers | | Check MX Records | mx | MX presence, priorities, reachability, and null MX (RFC 7505) | | Check DNSBL/RBL | dnsbl | IP reputation against Spamhaus ZEN/DBL and Barracuda BRBL | | Get DNS Hosting Info | dnsHosting | Authoritative NS, SOA, and provider detection | | Get WHOIS/RDAP | whois | Domain registration data via WHOIS with RDAP fallback and domain age computation |

Features

Email Authentication Validation (JSON Rules)

• SPF: Syntax validation, -all vs ~all distinction, +all detection, multiple-record detection, lookup-limit guidance, include-chain traversal, overly broad IP range detection (prefix ≤ /16 for IPv4, ≤ /32 for IPv6), void lookup tracking (RFC 7208 §4.6.4) (rules at nodes/DomainSecurity/rules/spf.json)
• DKIM: Common + provider-specific selector discovery, key strength validation, revoked/test-mode key detection (rules at nodes/DomainSecurity/rules/dkim.json)
• DMARC: Policy analysis, alignment checks, reporting endpoint validation, multiple-record detection, 25-rule scoring (rules at nodes/DomainSecurity/rules/dmarc.json)

DNS Infrastructure Security

• CAA Validation: issue, issuewild, and iodef tag checks
• Open Resolver Detection: Recursion availability testing
• Zone Transfer (AXFR) Testing: TCP-based AXFR queries against each nameserver
• DNSSEC: DS/DNSKEY record detection plus chain validation via Cloudflare DoH (AD bit)
• MX Validation: Presence, priority ordering, duplicate priority detection, host reachability, null MX (RFC 7505)

Transport Security

• MTA-STS Policy Discovery (RFC 8461): TXT record lookup, HTTPS policy fetch, MX coverage validation
• TLS-RPT Configuration (RFC 8460): Reporting endpoint validation (mailto and https)

Brand Indicators

• BIMI Validation (RFC 8553): Record parsing, logo reachability check, SVG Tiny 1.2 profile validation (version, baseProfile, namespace), VMC detection

Domain Intelligence

• DNS Hosting Info: Authoritative NS, SOA, provider guess with confidence and evidence (NS patterns, SOA mname, IP RDAP orgs)
• WHOIS/RDAP: Domain registration data via whoiser with automatic node-rdap fallback; computes registrationDate, domainAgeYears, isRecentlyRegistered
• DNSBL/RBL Reputation: Queries MX host IPs against Spamhaus ZEN (IP), Spamhaus DBL (domain), and Barracuda BRBL; decodes return codes to human-readable reasons

Scoring

Weighted Overall Score (0-100)

The audit operation computes a weighted overall score:

| Category | Weight | Components | |----------|--------|------------| | Email Authentication | 60% | Average of DMARC, SPF, DKIM scores | | DNS Infrastructure | 25% | Average of CAA, open resolver, zone transfer, DNSSEC scores | | Transport Security | 15% | MTA-STS and TLS-RPT scores |

Risk Levels

| Score Range | Risk Level | |-------------|------------| | 0-25 | Critical | | 26-50 | High | | 51-75 | Medium | | 76-100 | Low |

JSON Rules Engine

Rules are defined in nodes/DomainSecurity/rules/*.json and executed via json-rules-engine:

• DMARC: 25 rules, max 104 points (policy strength, alignment, reporting, TTL, multiple-record detection, etc.)
• SPF: 13 rules (v1.2.0), max 30 points (presence, syntax, -all vs ~all, +all detection, lookups, no PTR, multiple-record detection, broad IP ranges, void lookups)
• DKIM: 6 rules, max 45 points (selector found, passing selectors, warnings, key strength, revoked keys, test mode)

Edit the JSON files to adjust checks, points, or recommendations without code changes.

Output

Every operation returns a stable flat JSON envelope (DomainReport):

{
  "domain": "example.com",
  "timestamp": "2025-06-09T10:30:00Z",
  "operation": "audit",
  "version": "0.1.0",
  "overallScore": 82,
  "riskLevel": "medium",
  "checks": {
    "spf": { "status": "pass", "score": 90, "..." : "..." },
    "dkim": { "status": "pass", "score": 85, "..." : "..." },
    "dmarc": { "status": "pass", "score": 78, "..." : "..." },
    "dnssec": { "status": "warn", "..." : "..." },
    "caa": { "status": "pass", "..." : "..." },
    "mtaSts": { "status": "fail", "..." : "..." },
    "tlsRpt": { "status": "fail", "..." : "..." },
    "openResolver": { "status": "pass", "..." : "..." },
    "zoneTransfer": { "status": "pass", "..." : "..." }
  },
  "recommendations": ["Consider upgrading DMARC policy to reject", "..."],
  "summary": "Human-readable summary"
}

Fields in checks are absent (not null) when the operation doesn't include that check. Consumers can detect via if ('dmarc' in result.checks).

Output Modes

• Simple (default): Concise, logically grouped results
• Detailed: Full breakdown including raw DNS records, per-rule score breakdowns, and debug details

Configuration

Node Parameters

| Parameter | Description | Applies To | |-----------|-------------|------------| | Domain Name | Domain to analyze (required) | All operations | | Operation | Which check to run | All | | DKIM Selector | Specific selector or auto for discovery | dkim only | | DNS Servers | Comma-separated IPs, overrides credential/system default | Most operations | | Output Mode | simple or detailed | audit, dmarc, dkim, spf, mtaSts, tlsRpt | | Remote Rules URL | URL to fetch custom scoring rules JSON | audit, dmarc, spf |

Credential Settings (optional)

Configured via the Domain Security API credential:

• Custom DNS Servers: Comma-separated IPs
• DNS Timeout: Milliseconds
• Retry Attempts: Number of retries for failed lookups
• Remote Rules URL: URL to fetch custom scoring rules
• DKIM Selectors: Extra selectors for auto-discovery

DNS Caching

Built-in per-process cache for TXT, NS, CAA, A/AAAA, MX lookups:

• Default TTL: 5 minutes (configurable via DNS_CACHE_TTL_MS, default 300000)
• Max entries: configurable via DNS_CACHE_MAX_ENTRIES (default 2000)

Requirements

• n8n: 1.0.0+
• Node.js: 18+

Dependencies

| Package | Purpose | |---------|---------| | mailauth | SPF/DKIM/DMARC validation | | native-dns | Zone transfer and open resolver testing | | dns2 | Modern DNS queries | | @layered/dns-records | DNS record types | | json-rules-engine | Rule-based scoring | | whoiser | WHOIS data retrieval | | node-rdap | RDAP fallback for WHOIS | | @xmldom/xmldom | XML parsing (BIMI SVG) |

Testing

Unit Tests (no env vars required)

npm test -- --testPathPattern=unit

Integration Tests (live DNS)

Require environment variables:

| Variable | Description | Example | |----------|-------------|---------| | DOMAINS | Comma-separated domains to test | google.com,microsoft.com | | DNS_SERVERS | Comma-separated DNS server IPs | 8.8.8.8,1.1.1.1 |

DOMAINS=google.com DNS_SERVERS=8.8.8.8 npm test

Copy .env.example to .env and fill in the values, or pass them inline.

Target Audience

• Managed Service Providers (MSPs)
• IT Security Consultants
• DevOps & SecOps Teams
• Compliance Officers

Use Cases

• Client Onboarding: Automated security assessment during new client setup
• Quarterly Reviews: Regular security posture evaluation
• Incident Response: Quick domain security validation during security incidents
• Proactive Monitoring: Ongoing security configuration validation

Out of Scope

The following checks are intentionally not implemented due to infrastructure constraints or reliability concerns:

| Item | Reason | |------|--------| | MTA-STS TLS certificate validation | Requires SMTP connections on port 25, which is blocked by most ISPs and cloud providers | | DANE/TLSA records | Requires a DNSSEC-validating recursive resolver — not available via standard Node.js DNS APIs | | SPF macro expansion | Complex parser (%{s}, %{d}, %{l}, etc.) with low real-world value; macros are rarely used in production SPF records | | Subdomain enumeration | NSEC/NSEC3 zone walking is blocked on most modern authoritative servers; brute-force is unreliable | | Compliance framework reporting | Requires external data mappings (NIST, CIS controls) — a significant external dependency outside the node's scope |

Contributing

We welcome:

• Bug reports and feature requests via GitHub Issues
• Use case scenarios from MSPs and security professionals
• Technical suggestions for implementation approaches
• Beta testing volunteers

License

This project is licensed under the MIT License - see the LICENSE file for details.

Links

• n8n Community: n8n.io/community
• Documentation: docs.n8n.io
• Issue Tracker: GitHub Issues