vamp-mail-audit

Overview

vamp-mail-audit is an email security auditor that evaluates SPF, DKIM, DMARC, MX, and active SMTP posture for one or more domains. It performs DNS-level analysis (lookup counts, policy strictness, record conflicts) plus optional live SMTP probing for STARTTLS availability, open relay conditions, and banner version disclosure. It is the email security counterpart in the VampSecure Labs toolkit, built for both point-in-time assessments and ongoing CI/CD monitoring of domain email hygiene.

Features

• SPF analysis: presence check (HIGH if absent), duplicate TXT record detection (RFC 7208 §3.2 violation, HIGH), permissive +all/?all mechanisms (CRITICAL), softfail ~all (MEDIUM), -all pass (INFO), excessive DNS lookup count > 10 (MEDIUM)
• DMARC analysis: presence check (HIGH if absent), p=none reporting-only policy (HIGH), p=quarantine (MEDIUM), p=reject (INFO), partial deployment pct < 100 (LOW), missing rua reporting address (LOW)
• DKIM selector probing across 15 common selectors: default, google, mail, dkim, k1, k2, s1, s2, selector1, selector2, mandrill, mailjet, sendgrid, amazonses, smtp; key size analysis (< 1024 HIGH, 1024–2047 MEDIUM, ≥ 2048 INFO); revoked selector detection (p= empty)
• MX record presence check (HIGH if absent)
• Active SMTP probing (optional): STARTTLS detection, open relay test (MAIL FROM + RCPT TO external address), banner version disclosure (LOW)
• Multi-domain batch scanning: -d/--domain repeatable, or a domain list file (-f/--file)
• SMTP-free mode (--no-smtp) for pure DNS assessment in restricted environments
• Export to Console (Rich), JSON, and HTML (dark-theme standalone)

Requirements

• Python 3.9 or later
• dnspython >= 2.4
• rich >= 13.7.0
• Optional: fpdf2 >= 2.7 for --report-pdf

Installation

git clone https://github.com/belky-me/vamp-mail-audit.git
cd vamp-mail-audit
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

python3 vamp_mail_audit.py --help

usage: vamp_mail_audit.py [-h] [-d DOMINIO] [-f FICHERO]
                           [--mx-timeout SEG] [--no-smtp]
                           [--json FICHERO] [--html FICHERO]
                           [--client CLIENT] [--engagement ENGAGEMENT]
                           [--auditor AUDITOR] [--report-scope SCOPE]
                           [--report-html FILE] [--report-pdf FILE]

vamp-mail-audit — Email Security Auditor (VampSecure Labs)

Examples

# Audit a single domain
python3 vamp_mail_audit.py -d example.com

# Audit multiple domains in one command
python3 vamp_mail_audit.py -d example.com -d mail.example.org -d partner.io

# Audit a list of domains from file
python3 vamp_mail_audit.py -f domains.txt

# DNS-only mode (skip live SMTP probing)
python3 vamp_mail_audit.py -d example.com --no-smtp

# Custom SMTP timeout for slow MX servers
python3 vamp_mail_audit.py -d example.com --mx-timeout 30

# Export findings to JSON and HTML
python3 vamp_mail_audit.py -d example.com --json results.json --html report.html

# Generate client-ready engagement report
python3 vamp_mail_audit.py -f domains.txt \
    --client "Acme Corp" --engagement "Email Security Review Q3 2026" \
    --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf

CLI Reference

Output Formats

Exit Codes

Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the domain owner. Active SMTP probing (--no-smtp off) performs live connections to target mail servers. VampSecure Studios assumes no liability for unauthorized use.

Part of VampSecure Labs Toolkit

vamp-mail-audit is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

• Portfolio: github.com/belky-me
• Orchestrator: github.com/belky-me/vamp-orchestrator

© VampSecure Studios — VampSecure Labs Security Research Division