Own consultancy · personal project

Email audit of 200 Warsaw businesses: SPF, DKIM and DMARC

A tool that rates in seconds how easy it is to forge email from a given business and gives ready-made DNS records to fix it. It uses public data only.

200Warsaw law firms, accountants and clinics
37.8out of 100: average score
9%have SPF, DKIM and a blocking DMARC together

First page of the sample report: score 30 out of 100, grade E, no DMARC policy and the recommended DNS record. Domain changed to kancelaria.example — Part for the business owner

Technical page of the report: SPF record with the DNS lookup tree, DKIM selectors checked, no DMARC and a ready DNS record — Part for the IT person

Challenge

Without correct SPF, DKIM and DMARC, anyone can send email that looks like it came from a company’s address. That is how fake invoices and payment requests work. Small businesses rarely check this, and when someone does, the owner gets jargon instead of clear instructions.

My role

Idea, tool, tests, analysis of the results and report content.

What I did

Audit engine: SPF per RFC 7208 (10 DNS lookup limit, loops, multiple records), DKIM (23 common and provider selectors, RSA key length), DMARC (policy, pct, reporting, organisational domain), MX, MTA-STS and TLS-RPT.
A DNS client with caching, retries and rate limiting that tells NXDOMAIN, SERVFAIL and timeouts apart.
Scan history in SQLite with a comparison of two audits of the same domain, a command line and a local browser app with a live progress bar.
A PDF report for the business: a 0–100 score with an A–F grade, risks in the owner’s language and DNS records ready to copy. A second part is for the IT person.
15 unit tests against a mocked DNS server, including SPF loops, the lookup limit and syntax errors.

Safety

The scan is fully passive: public DNS queries only, no connections to the businesses’ mail servers and no emails sent. I do not publish the list of domains. The sample report is anonymised: the domain and server names are changed.

Result

120 of 200 businesses (60%) have no DMARC, 45 only monitor and one has a broken record. In total, 83% do not block spoofing.
The average score is 37.8 out of 100. 15 businesses got an A or B, 87 got an E or F.
176 have SPF (88%). One exceeds the 10-lookup limit, so its SPF does not work at all. Only one business uses MTA-STS.
I found DKIM at 66 businesses. That is a lower bound, because selectors cannot be listed from DNS, and the report says so instead of claiming DKIM is missing.

Tools

Python, dnspython, Pydantic, SQLite, FastAPI, Server-Sent Events, Jinja2, xhtml2pdf, pytest, DNS, SPF, DKIM, DMARC, OSINT

Sample report (PDF in Polish, 3 pages) →