|
10 | 10 | domain's DNS. It also checks the mail servers listed in a domain's MX |
11 | 11 | records for STARTTLS support. It saves its results to CSV or JSON. |
12 | 12 |
|
13 | | -## Getting Started ## |
| 13 | +## Getting started ## |
14 | 14 |
|
15 | 15 | `trustymail` requires **Python 3.6+**. Python 2 is not supported. |
16 | 16 |
|
@@ -46,7 +46,7 @@ Then run the CLI: |
46 | 46 | python scripts/trustymail [options] example.com |
47 | 47 | ``` |
48 | 48 |
|
49 | | -### Using Docker (optional) |
| 49 | +### Using Docker (optional) ### |
50 | 50 |
|
51 | 51 | ```console |
52 | 52 | ./run [opts] |
@@ -112,93 +112,94 @@ output will always be written to disk, defaulting to `results.csv`. |
112 | 112 | ## What's Checked? ## |
113 | 113 |
|
114 | 114 | For a given domain, MX records, SPF records (TXT), DMARC (TXT, at |
115 | | -\_dmarc.<domain>), and support for STARTTLS are checked. Resource records can also be checked for DNSSEC if the resolver used is DNSSEC-aware. |
| 115 | +`_dmarc.<domain>`), and support for STARTTLS are checked. Resource records can |
| 116 | +also be checked for DNSSEC if the resolver used is DNSSEC-aware. |
116 | 117 |
|
117 | 118 | The following values are returned in `results.csv`: |
118 | 119 |
|
119 | 120 | ### Domain and redirect info ### |
120 | 121 |
|
121 | | -* `Domain` - The domain you're scanning! |
122 | | -* `Base Domain` - The base domain of `Domain`. For example, for a |
| 122 | +- `Domain` - The domain you're scanning! |
| 123 | +- `Base Domain` - The base domain of `Domain`. For example, for a |
123 | 124 | Domain of `sub.example.gov`, the Base Domain will be |
124 | 125 | `example.gov`. Usually this is the second-level domain, but |
125 | 126 | `trustymail` will download and factor in the [Public Suffix |
126 | 127 | List](https://publicsuffix.org) when calculating the base domain. |
127 | | -* `Live` - The domain is actually published in the DNS. |
| 128 | +- `Live` - The domain is actually published in the DNS. |
128 | 129 |
|
129 | 130 | ### Mail sending ### |
130 | 131 |
|
131 | | -* `MX Record` - If an MX record was found that contains at least a |
| 132 | +- `MX Record` - If an MX record was found that contains at least a |
132 | 133 | single mail server. |
133 | | -* `MX Record DNSSEC` - A boolean value indicating whether or not the |
| 134 | +- `MX Record DNSSEC` - A boolean value indicating whether or not the |
134 | 135 | DNS record is protected by DNSSEC. |
135 | | -* `Mail Servers` - The list of hosts found in the MX record. |
136 | | -* `Mail Server Ports Tested` - A list of the ports tested for SMTP and |
| 136 | +- `Mail Servers` - The list of hosts found in the MX record. |
| 137 | +- `Mail Server Ports Tested` - A list of the ports tested for SMTP and |
137 | 138 | STARTTLS support. |
138 | | -* `Domain Supports SMTP` - True if and only if __any__ mail servers |
| 139 | +- `Domain Supports SMTP` - True if and only if **any** mail servers |
139 | 140 | specified in a MX record associated with the domain supports SMTP. |
140 | | -* `Domain Supports SMTP Results` - A list of the mail server and port |
| 141 | +- `Domain Supports SMTP Results` - A list of the mail server and port |
141 | 142 | combinations that support SMTP. |
142 | | -* `Domain Supports STARTTLS` - True if and only if __all__ mail |
| 143 | +- `Domain Supports STARTTLS` - True if and only if **all** mail |
143 | 144 | servers that support SMTP also support STARTTLS. |
144 | | -* `Domain Supports STARTTLS Results` - A list of the mail server and |
| 145 | +- `Domain Supports STARTTLS Results` - A list of the mail server and |
145 | 146 | port combinations that support STARTTLS. |
146 | 147 |
|
147 | 148 | ### SPF ### |
148 | 149 |
|
149 | | -* `SPF Record` - Whether or not a SPF record was found. |
150 | | -* `SPF Record DNSSEC` - A boolean value indicating whether or not the |
| 150 | +- `SPF Record` - Whether or not a SPF record was found. |
| 151 | +- `SPF Record DNSSEC` - A boolean value indicating whether or not the |
151 | 152 | DNS record is protected by DNSSEC. |
152 | | -* `Valid SPF` - Whether the SPF record found is syntactically correct, |
| 153 | +- `Valid SPF` - Whether the SPF record found is syntactically correct, |
153 | 154 | per RFC 4408. |
154 | | -* `SPF Results` - The textual representation of any SPF record found |
| 155 | +- `SPF Results` - The textual representation of any SPF record found |
155 | 156 | for the domain. |
156 | 157 |
|
157 | 158 | ### DMARC ### |
158 | 159 |
|
159 | | -* `DMARC Record` - True/False whether or not a DMARC record was found. |
160 | | -* `DMARC Record DNSSEC` - A boolean value indicating whether or not |
| 160 | +- `DMARC Record` - True/False whether or not a DMARC record was found. |
| 161 | +- `DMARC Record DNSSEC` - A boolean value indicating whether or not |
161 | 162 | the DNS record is protected by DNSSEC. |
162 | | -* `Valid DMARC` - Whether the DMARC record found is syntactically |
| 163 | +- `Valid DMARC` - Whether the DMARC record found is syntactically |
163 | 164 | correct. |
164 | | -* `DMARC Results` - The DMARC record that was discovered when querying |
| 165 | +- `DMARC Results` - The DMARC record that was discovered when querying |
165 | 166 | DNS. |
166 | | -* `DMARC Record on Base Domain`, `DMARC Record on Base Domain DNSSEC`, |
| 167 | +- `DMARC Record on Base Domain`, `DMARC Record on Base Domain DNSSEC`, |
167 | 168 | `Valid DMARC Record on Base Domain`, `DMARC Results on Base |
168 | 169 | Domain` - Same definition as above, but returns the result for the |
169 | 170 | Base Domain. This is important in DMARC because if there isn't a |
170 | 171 | DMARC record at the domain, the base domain (or "Organizational |
171 | 172 | Domain", per [RFC |
172 | 173 | 7489](https://tools.ietf.org/html/rfc7489#section-6.6.3)), is |
173 | 174 | checked and applied. |
174 | | -* `DMARC Policy` - An adjudication, based on any policies found in |
| 175 | +- `DMARC Policy` - An adjudication, based on any policies found in |
175 | 176 | `DMARC Results` and `DMARC Results on Base Domain`, of the relevant |
176 | 177 | DMARC policy that applies. |
177 | | -* `DMARC Subdomain Policy` - An adjudication, based on any policies |
| 178 | +- `DMARC Subdomain Policy` - An adjudication, based on any policies |
178 | 179 | found in `DMARC Results` and `DMARC Results on Base Domain`, of the |
179 | 180 | relevant DMARC subdomain policy that applies. |
180 | | -* `DMARC Policy Percentage` - The percentage of mail that should be |
| 181 | +- `DMARC Policy Percentage` - The percentage of mail that should be |
181 | 182 | subjected to the `DMARC Policy` according to the `DMARC Results`. |
182 | | -* `DMARC Aggregate Report URIs` - A list of the DMARC aggregate report |
| 183 | +- `DMARC Aggregate Report URIs` - A list of the DMARC aggregate report |
183 | 184 | URIs specified by the domain. |
184 | | -* `DMARC Forensic Report URIs` - A list of the DMARC forensic report |
| 185 | +- `DMARC Forensic Report URIs` - A list of the DMARC forensic report |
185 | 186 | URIs specified by the domain. |
186 | | -* `DMARC Has Aggregate Report URI` - A boolean value that indicates if |
| 187 | +- `DMARC Has Aggregate Report URI` - A boolean value that indicates if |
187 | 188 | `DMARC Results` included `rua` URIs that tell recipients where to |
188 | 189 | send DMARC aggregate reports. |
189 | | -* `DMARC Has Forensic Report URI` - A boolean value that indicates if |
| 190 | +- `DMARC Has Forensic Report URI` - A boolean value that indicates if |
190 | 191 | `DMARC Results` included `ruf` URIs that tell recipients where to |
191 | 192 | send DMARC forensic reports. |
192 | | -* `DMARC Reporting Address Acceptance Error` - A boolean value that is |
| 193 | +- `DMARC Reporting Address Acceptance Error` - A boolean value that is |
193 | 194 | True if one or more of the domains listed in the aggregate and |
194 | 195 | forensic report URIs does not indicate that it accepts DMARC reports |
195 | 196 | from the domain being tested. |
196 | 197 |
|
197 | | -### Etc. ### |
| 198 | +### Everything else ### |
198 | 199 |
|
199 | | -* `Syntax Errors` - A list of syntax errors that were encountered when |
| 200 | +- `Syntax Errors` - A list of syntax errors that were encountered when |
200 | 201 | analyzing SPF records. |
201 | | -* `Debug Info` - A list of any other warnings or errors encountered, |
| 202 | +- `Debug Info` - A list of any other warnings or errors encountered, |
202 | 203 | such as DNS failures. These can be helpful when determining how |
203 | 204 | `trustymail` reached its conclusions, and are indispensible for bug |
204 | 205 | reports. |
|
0 commit comments