email-security – Security skill for AI agents

DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

SecuritySKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the email-security skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/email-security-dc993.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /email-security – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/email-security-dc993.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $email-security – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/email-security-dc993.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /email-security – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/email-security-dc993.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /email-security – then describe the task you want done.

SKILL.md content

Email Security -- DMARC, SPF, DKIM

When to Use

During passive reconnaissance (Phase 1)
After initial DNS enumeration
DMARC p=none means the domain can be totally spoofed
Critical for identifying phishing/business email compromise risks

DMARC/SPF/DKIM Check Commands

# SPF
dig +short TXT $target | grep "v=spf1"

# DMARC
dig +short TXT _dmarc.$target

# DKIM (common selector: google)
dig +short TXT google._domainkey.$target

# MX
dig +short MX $target

Interpreting Results

| Config | Meaning | Risk |

|--------|---------|------|

| v=spf1 ~all (softfail) | SPF suggests blocking but doesnt enforce | Spoofed emails may pass |

| v=spf1 ?all (neutral) | SPF does nothing | Totally permissive |

| v=spf1 include:amazonses.com ~all | SES can send as domain | Any AWS SES account can spoof |

| v=DMARC1; p=none | DMARC disabled | Zero spoofing protection |

| v=DMARC1; p=quarantine | Failed emails go to spam | Partial protection |

| v=DMARC1; p=reject | Failed emails rejected | Full protection |

| DKIM missing | No cryptographic signature | Email can be forged |

Email Spoofing via SMTP

# Test SMTP relay
timeout 3 bash -c 'exec 3<>/dev/tcp/TARGET/25; head -1 <&3'

# Send spoofed email via open relay (swaks)
swaks --to [email protected] --from [email protected]   --server TARGET --body "Spoofed email"

Headers That Indicate Security Level

| Header | Value | Meaning |

|--------|-------|---------|

| Authentication-Results | spf=pass | SPF passed |

| Authentication-Results | spf=fail | SPF failed |

| Authentication-Results | dmarc=pass | DMARC passed |

| Authentication-Results | dmarc=fail | DMARC failed |

| Authentication-Results | dkim=pass | DKIM passed |

| Received-SPF | Pass | Sender authorized |

| Received-SPF | Softfail | Sender not fully authorized |

| Received-SPF | Fail | Sender not authorized |

| ARC-Authentication-Results | | Authentication chain |

AWS SES Spoofing (When SPF includes amazonses.com)

With v=spf1 include:amazonses.com ~all:

1. Create AWS account

2. Configure SES with your own domain (verified)

3. Send email with From: [email protected]

4. SPF PASSES (because of include:amazonses.com)

5. DMARC p=none -- provider delivers normally

Real-World Cases

Real-world case (CRITICAL): Political party -- DMARC p=none on both domains (DOMAIN_PLACEHOLDER_A, DOMAIN_PLACEHOLDER_B). SPF with include:amazonses.com (any SES account can send as the domain). Total email spoofing.

Pitfalls

| Issue | Solution |

|-------|----------|

| SPF lookup limit | DNS has 10 lookup limit for SPF includes |

| DKIM selector unknown | Try common selectors: google, selector1, selector2, 2022, 2023 |

| DMARC reporting | rua=mailto: may leak authentication results to third party |

Verification

# Verify email spoofing is possible
# Send test email and check headers:
dig +short TXT _dmarc.target.com
# If p=none -> confirmed spoofable

Related skills

enterprise-vpn-attack – External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect…
ai-engineering-toolkit – Overview of six AI engineering workflows: prompt evaluation (8-dimension scoring)…
error-log-mining – Mine error_log for creds, paths, SQL when leak hunt finds.
atlassian-admin – Atlassian Administrator for managing and organizing Atlassian products (Jira…
firebase-supabase-attack – Exploit Firebase/Supabase for data via JS config leak probe.
ai-security-hardening – Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and…
flask-werkzeug-attack – Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
gitlab-public-recon – Mine GitLab for secrets, CI tokens when subdomain found.

← Browse all skills