Skip to content
/ mx-chan Public

A specialized defensive security tool for detecting email spoofing vulnerabilities by analyzing SPF, DMARC, and DKIM configurations to determine domain spoofing risk.

0 stars 0 forks Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

maxmuxammil/mx-chan

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

ย 

History

1 Commit
images
images
ย 
ย 
README.md
README.md
ย 
ย 
mxchan.py
mxchan.py
ย 
ย 
requirements.txt
requirements.txt
ย 
ย 

Repository files navigation

๐ŸŽฏMX-Chan - [Spoofable Domain Vulnerability Scanner]

โ „โ „โฃผโกŸโฃฟโ โข€โฃฟโฃ‡โฃฟโฃโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโขธโก‡โฃฟโฃฟโฃฟโฃŸโฃฟโฃฟโฃฟโฃฟ                                                              
โก†โฃธโกŸโฃผโฃฏโ โฃพโฃฟโขธโฃฟโขธโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโกŸโ ธโ โขนโกฟโฃฟโฃฟโขปโฃฟโฃฟโฃฟ                                                              
โก‡โกŸโฃธโขŸโฃซโก…โฃถโข†โกถโก†โฃฟโฃฟโฃฟโฃฟโฃฟโขฟโฃ›โ ƒโ ฐโ †โ ˆโ โ ˆโ ™โ ˆโ ปโฃฟโขน                                                              
โฃงโฃฑโกทโฃฑโ ฟโ Ÿโ ›โ ผโฃ‡โ ‡โฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโ ƒโฃฐโฃฟโฃฟโก†โ „โ „โ „โ „โ „โ ‰โ ˆ                                                              
โกโกŸโข‘โ ƒโก โ ‚โ „โ „โ ˆโฃพโขปโฃฟโฃฟโกฟโกนโกณโ ‹โ ‰โ โ ‰โ ™โ „โข€โ „โ „โ „โ „โ „  โ–‘  โ–‘โ–‘โ–‘โ–‘  โ–‘โ–‘  โ–‘โ–‘โ–‘โ–‘  โ–‘โ–‘โ–‘      โ–‘โ–‘โ–‘  โ–‘โ–‘โ–‘โ–‘  โ–‘โ–‘โ–‘      โ–‘โ–‘โ–‘   โ–‘โ–‘โ–‘  โ–‘
โก‡โ โขˆโขฐโก‡โ „โ „โก™โ ‚โฃฟโฃฟโฃฟโฃฟโฃฑโฃฟโก—โ „โ „โ „โข€โก€โ „โ ˆโขฐโ „โ „โ „โ   โ–’   โ–’โ–’   โ–’โ–’โ–’  โ–’โ–’  โ–’โ–’โ–’  โ–’โ–’โ–’โ–’  โ–’โ–’  โ–’โ–’โ–’โ–’  โ–’โ–’  โ–’โ–’โ–’โ–’  โ–’โ–’    โ–’โ–’  โ–’
โ „โ „โ ˜โฃฟโฃงโ ดโฃ„โฃกโข„โฃฟโฃฟโฃฟโฃทโฃฟโฃฟโก‡โข€โ „โ คโ ˆโ โฃ โฃ โฃธโข โ „โ „โ „  โ–“        โ–“โ–“โ–“โ–“    โ–“โ–“โ–“โ–“  โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“        โ–“โ–“  โ–“โ–“โ–“โ–“  โ–“โ–“  โ–“  โ–“  โ–“
โข€โ „โ „โฃฟโฃฟโฃทโฃฌโฃตโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃทโฃŸโขทโกถโข—โกฐโฃฟโฃฟโ ‡โ ˜โ „โ „โ „  โ–ˆ  โ–ˆ  โ–ˆ  โ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ        โ–ˆโ–ˆ  โ–ˆโ–ˆ    โ–ˆ
โฃฟโ „โ „โฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃทโฃถโฃพโฃฟโฃฟโกŸโข€โ ƒโ „โขธโก„  โ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ      โ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ   โ–ˆ
โฃฟโ „โ „โ ˜โขฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโข›โฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃŸโข„โก†โ „โข€โฃชโก†                           
โกŸโ „โ „โ „โ „โฃพโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโฃฟโกฟโขฟโฃŸโฃปโฃฉโฃพโฃƒโฃดโฃฟโฃฟโก‡                           

   ๐ŸŽฏ Domain Spoofing Vulnerability Analyzer (โ—•โ€ฟโ—•)
   SHUT UP and --------------> HACKKK
   Detecting email spoofing attack vectors...
   Created by Max Muxammil
   v1.0 - Enhanced with Rich Dashboard, Email Validation & Analysis

Domain Spoofing Vulnerability Analyzer (Python Edition)

A specialized defensive security tool for detecting email spoofing vulnerabilities by analyzing SPF, DMARC, and DKIM configurations to determine domain spoofing risk. Now with enhanced Rich terminal UI and comprehensive email validation capabilities.

๐ŸŒŸ Features

๐ŸŽจ Enhanced Terminal UI

  • Rich Dashboard: Beautiful bordered panels with color-coded output
  • Custom Progress Bars: Real-time animated progress tracking
  • Professional Banner: ASCII art with Rich formatting
  • Color-Coded Results: Green (secure), Red (vulnerable), Yellow (warning)

๐Ÿ” Comprehensive DNS Analysis

  • SPF Record Analysis: Detects missing, weak, or dangerous policies
  • DMARC Policy Evaluation: Checks enforcement levels and subdomain policies
  • DKIM Signature Validation: Scans multiple selectors and key strengths
  • MX Record Assessment: Identifies routing and wildcard vulnerabilities

๐Ÿ“ง Advanced Email Validation

  • Format Validation: Regex-based email syntax checking
  • Domain Matching: Verifies email domain against target domain
  • SMTP Connectivity: Tests mail server reachability on port 25
  • Real-time Verification: Attempts email existence validation
  • Detailed Reporting: Comprehensive validation results with status indicators

๐Ÿ“Š Risk Assessment & Scoring

  • Protection Score: 0-100 scoring system based on vulnerabilities
  • Risk Levels: CRITICAL, HIGH, MEDIUM, LOW, VERY_LOW classifications
  • Spoofability Assessment: Determines if domain can be spoofed
  • Actionable Recommendations: Specific remediation guidance

๐Ÿ›ก๏ธ Security Analysis Coverage

SPF (Sender Policy Framework)

  • โŒ Missing SPF Records (CRITICAL)
  • ๐Ÿšจ Dangerous Policies (+all allows any sender)
  • โš ๏ธ Weak Policies (~all soft fail, ?all neutral)
  • ๐Ÿ“ Incomplete Records (missing all mechanism)
  • ๐Ÿ” Overly Permissive (too many includes)

DMARC (Domain-based Message Authentication)

  • โŒ Missing DMARC Policy (CRITICAL)
  • ๐Ÿ“Š Policy Strength (none, quarantine, reject)
  • ๐ŸŒ Subdomain Weaknesses (weaker subdomain policies)
  • ๐Ÿ“ˆ Partial Enforcement (percentage < 100%)

DKIM (DomainKeys Identified Mail)

  • โŒ Missing DKIM (HIGH risk)
  • ๐Ÿ” Weak Cryptographic Keys (< 2048 bits)
  • ๐Ÿ” Common Selectors (default, selector1, selector2, google, k1, s1, s2)

Additional Security Vectors

  • ๐Ÿ“ฌ MX Record Analysis (missing or wildcard MX)
  • ๐ŸŒ Mail Routing (potential manipulation vectors)
  • ๐Ÿ”— DNS Configuration (resolution and timeout handling)

๐Ÿš€ Installation

Prerequisites

  • Python 3.7+
  • DNS resolution capability
  • Internet connection for DNS queries

Install Dependencies

# Install required packages
pip3 install -r requirements.txt

# Or install manually
pip3 install dnspython requests rich

Download and Setup

# Clone or download the script
wget https://raw.githubusercontent.com/maxmuxammil/mx-chan/main/mxchan.py
chmod +x mxchan.py

๐Ÿ“– Usage

Basic Domain Analysis

python3 mxchan.py example.com

Email Validation

# Validate email address
python3 mxchan.py example.com --email admin@example.com
python3 mxchan.py example.com -e user@gmail.com

Debug Mode

# Enable debug output for troubleshooting
python3 mxchan.py --debug gmail.com
python3 mxchan.py -d example.com --email user@example.com

Command Reference

python3 mxchan.py --help                    # Show help with Rich banner
python3 mxchan.py [OPTIONS] DOMAIN          # Full syntax

Available Options

  • -e, --email EMAIL: Email address to validate (optional)
  • -d, --debug: Enable debug output for DNS queries
  • -h, --help: Show help message with Rich banner

๐Ÿ“Š Sample Output

Domain Analysis Report

โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ MX-Chan Spoofing Analyzer โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚       ๐ŸŽฏ Domain Spoofing Vulnerability Analyzer (โ—•โ€ฟโ—•)                        โ”‚
โ”‚       SHUT UP and --------------> HACKKK                                     โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ

๐Ÿ” Analyzing SPF records    [โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘] 20%
๐Ÿ” Analyzing DMARC records  [โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘] 40%
๐Ÿ” Analyzing DKIM records   [โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘] 60%
๐Ÿ” Checking additional vectors [โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–‘โ–‘โ–‘โ–‘โ–‘โ–‘] 80%
๐Ÿ” Calculating protection score [โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ] 100%

================================================================================
๐ŸŽฏ DOMAIN SPOOFING VULNERABILITY REPORT
================================================================================
๐ŸŒ Target Domain: example.com
๐Ÿšจ Spoofing Risk: HIGH
๐ŸŽฏ Domain Status: SPOOFABLE
๐Ÿ›ก๏ธ Protection Score: 45/100
๐Ÿ” Vulnerabilities Found: 3

๐Ÿšจ DISCOVERED VULNERABILITIES
================================================================================

1. ๐Ÿšจ [CRITICAL] SPF Missing
   ๐ŸŽฏ Vulnerability: No SPF record found
   ๐Ÿ’ฅ Impact: Domain can be easily spoofed from any IP address
   ๐Ÿ”ง Recommendation: Implement SPF record immediately with '-all' mechanism
   ๐Ÿ” Technical Details: Missing SPF allows unlimited spoofing potential

2. ๐Ÿšจ [CRITICAL] DMARC Missing
   ๐ŸŽฏ Vulnerability: No DMARC record found
   ๐Ÿ’ฅ Impact: No policy enforcement against domain spoofing
   ๐Ÿ”ง Recommendation: Implement DMARC policy starting with p=none, then escalate to p=reject
   ๐Ÿ” Technical Details: Missing DMARC allows spoofing with no reporting

Email Validation Results

๐Ÿ“ง EMAIL VALIDATION REPORT
================================================================================
๐Ÿ“ง Email Address: admin@example.com
๐Ÿ“ Format: โœ… VALID
๐ŸŒ Domain Match: โœ… MATCHES
๐Ÿ“ฌ SMTP Server: โŒ UNREACHABLE
๐Ÿ” Email Exists: โ“ UNKNOWN

๐Ÿ“‹ VALIDATION DETAILS
------------------------------------------------------------
   โ€ข Format: Valid format
   โ€ข Domain_Match: Email domain matches target domain
   โ€ข Smtp: No SMTP servers reachable on port 25
   โ€ข Existence: Could not determine primary MX server

๐Ÿ“Š Risk Assessment System

Risk Levels

Level Icon Score Impact Description Action Required
CRITICAL ๐Ÿšจ -30 points Immediate security risk Fix immediately
HIGH ๐Ÿ”ถ -20 points Significant vulnerability Address promptly
MEDIUM โš ๏ธ -10 points Moderate security concern Plan remediation
LOW โœ… -5 points Minor configuration issue Monitor and improve

Scoring Algorithm

  • Base Score: 100/100 (perfect protection)
  • Vulnerability Deductions: Based on severity levels above
  • Final Score: Maximum of 0 (completely vulnerable)

Risk Determination Logic

  • CRITICAL: Any critical vulnerabilities present
  • HIGH: 2+ high-risk vulnerabilities
  • MEDIUM: 1 high-risk OR 3+ medium-risk vulnerabilities
  • LOW: 1+ medium-risk vulnerabilities
  • VERY LOW: No significant vulnerabilities detected

๐Ÿ› ๏ธ Remediation Guide

Implement SPF Record

; Basic SPF record (blocks all unauthorized senders)
example.com. IN TXT "v=spf1 -all"

; SPF with Google Workspace
example.com. IN TXT "v=spf1 include:_spf.google.com -all"

; SPF with multiple providers
example.com. IN TXT "v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all"

Implement DMARC Policy

; Start with monitoring (p=none)
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com"

; Progress to quarantine suspicious emails
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

; Full protection (reject unauthorized emails)
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com"

Enable DKIM Signing

  1. Generate DKIM Keys: Use 2048-bit RSA or stronger
  2. Configure Email Provider: Enable DKIM in your email service
  3. Publish Public Key: Add DKIM record to DNS
selector1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

๐Ÿ” Technical Implementation

DNS Resolution

  • Primary Resolvers: 8.8.8.8, 1.1.1.1, 1.0.0.1
  • Timeout Settings: 3 seconds per query, 10 seconds total lifetime
  • Error Handling: Graceful fallback for NXDOMAIN and NoAnswer

Email Validation Process

  1. Format Validation: RFC-compliant regex checking
  2. Domain Extraction: Parse and validate domain portion
  3. MX Record Lookup: Find mail exchange servers
  4. SMTP Testing: Direct connection attempts on port 25
  5. Response Analysis: Interpret connection results

Progress Tracking

  • Custom Progress Bars: Terminal-safe animated indicators
  • Real-time Updates: Live progress display during analysis
  • Phase Indicators: Clear status for each analysis step

Rich UI Components

  • Bordered Panels: Professional presentation with Rich library
  • Color Coding: Consistent color scheme throughout interface
  • Text Formatting: Bold, italic, and colored text elements
  • Alignment: Centered and left-aligned content as appropriate

๐Ÿšจ Disclaimer

This tool is designed for defensive security purposes only. It should be used to:

  • โœ… Assess your own domains and email infrastructure
  • โœ… Conduct authorized security assessments with proper permissions
  • โœ… Improve email authentication configurations and policies
  • โœ… Educate teams about email spoofing vulnerabilities

โš ๏ธ Do not use this tool for malicious purposes or against domains you don't own or have explicit permission to test.

๐Ÿ”ง Dependencies

  • dnspython (>=2.0.0): DNS resolution and record parsing
  • requests (>=2.25.0): HTTP requests for additional lookups
  • rich (>=10.0.0): Enhanced terminal UI and formatting

๐Ÿ“„ License

This project is licensed under the MIT License - see the LICENSE file for details.

๐Ÿ™ Acknowledgments

  • Built for defensive security and domain protection awareness
  • Inspired by the need for better email authentication visibility
  • Thanks to the DNS and email security community for standards development
  • Rich library for beautiful terminal interfaces

๐Ÿ”— Resources

Email Authentication Standards

Security References

##Screenshot

mx-chan

โœจ Stay secure and keep those spoofing attacks away! (โ—•โ€ฟโ—•) ๐Ÿ›ก๏ธ Remember: Strong email authentication prevents domain spoofing!

About

A specialized defensive security tool for detecting email spoofing vulnerabilities by analyzing SPF, DMARC, and DKIM configurations to determine domain spoofing risk.

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases 1

mx-chan - v1.0 Latest
Aug 1, 2025

Packages

No packages published

Languages