メニュー
SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper im
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/xalgord/xalgorix --skill implementing-dmarc-dkim-spf-email-securityコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
| name | implementing-dmarc-dkim-spf-email-security |
| description | SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper im |
| domain | cybersecurity |
| subdomain | phishing-defense |
| tags | ["phishing","email-security","social-engineering","dmarc","awareness","dkim","spf","dns"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"] |
SPF, DKIM, and DMARC form the three pillars of email authentication. Together they prevent domain spoofing, validate message integrity, and define policies for handling unauthenticated mail. Proper implementation drastically reduces phishing attacks that impersonate your organization's domain.
+all/?all authorize the world, and more than 10 DNS lookups causes permerror and silent SPF failure - flatten includes and end with -all (hard fail) once sources are inventoried.adkim/aspf alignment, not just pass/fail.sp= lets attackers spoof noreply.example.com even when the org domain is locked - set sp=reject.rua mailbox nobody reads means failures go unnoticed - feed aggregate XML into an analyzer.dmarc=pass with alignment in the Authentication-Results header and that DKIM verifies a 2048-bit signature.Publishes a DNS TXT record listing authorized IP addresses and mail servers that can send email on behalf of your domain. Receiving servers check the envelope sender's IP against this list.
Adds a cryptographic signature to outgoing emails using a private key. The corresponding public key is published in DNS. Receivers verify the signature to ensure the message was not altered in transit.
Builds on SPF and DKIM by specifying a policy (none/quarantine/reject) for messages that fail authentication, and provides a reporting mechanism to monitor spoofing attempts.
# Check existing SPF record
dig TXT example.com | grep spf
# Check existing DKIM selector
dig TXT selector1._domainkey.example.com
# Check existing DMARC record
dig TXT _dmarc.example.com
# DNS TXT record for example.com
v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:spf.protection.outlook.com -all
Key SPF mechanisms:
ip4: / ip6: - Authorize specific IP rangesinclude: - Include another domain's SPF recorda - Authorize domain's A record IPsmx - Authorize domain's MX record IPs-all - Hard fail all others (recommended)~all - Soft fail (monitoring phase)# Generate DKIM key pair (2048-bit RSA)
openssl genrsa -out dkim_private.pem 2048
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem
# Format public key for DNS (remove headers, join lines)
grep -v "PUBLIC KEY" dkim_public.pem | tr -d '\n'
DNS TXT record at selector1._domainkey.example.com:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhki...
# DNS TXT record at _dmarc.example.com
# Phase 1 (Monitor):
v=DMARC1; p=none; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-forensic@example.com; pct=100
# Phase 2 (Quarantine):
v=DMARC1; p=quarantine; rua=mailto:dmarc-aggregate@example.com; pct=25
# Phase 3 (Reject):
v=DMARC1; p=reject; rua=mailto:dmarc-aggregate@example.com; pct=100
Use the scripts/process.py to parse DMARC aggregate XML reports and identify authentication failures, unauthorized senders, and spoofing attempts.