Email Security -- DMARC, SPF, DKIM

When to Use

• During passive reconnaissance (Phase 1)
• After initial DNS enumeration
• DMARC p=none means the domain can be totally spoofed
• Critical for identifying phishing/business email compromise risks

DMARC/SPF/DKIM Check Commands

# SPF
dig +short TXT $target | grep "v=spf1"

# DMARC
dig +short TXT _dmarc.$target