spoof_checker/README.md

# SPF/DMARC Spoofing & Subdomain Takeover Checker

A command-line tool written in Go that checks domains for email spoofing vulnerabilities and subdomain takeover risks.

## Features

- Analyzes SPF (Sender Policy Framework) records for common misconfigurations
- Evaluates DMARC (Domain-based Message Authentication, Reporting & Conformance) policies
- Detects potential spoofing vulnerabilities like:
  - Missing or improperly configured SPF/DMARC records
  - Overly permissive SPF policies (e.g., "+all" or "?all")
  - Insecure DMARC policy qualifiers
  - SPF record loops and excessive DNS lookups
- Checks for subdomain takeover vulnerabilities using known fingerprints
- Multiple output formats (text and JSON)
- Process individual domains or bulk check from a file
- Interactive mode for checking domains one by one
- Save results to an output file
- Concurrent processing for faster bulk scanning

## Installation

You can install this tool using Go:

```bash
go install github.com/taygun08/spoof_checker@latest
```

Or clone the repository and install locally:

```bash
git clone https://github.com/taygun08/spoof_checker.git
cd spoof_checker
go build -o spoof_check
```

## Usage

### Check a single domain

```bash
./spoof_check -domain example.com
```

### Process multiple domains from a file

Create a text file with one domain per line. Lines starting with `#` will be treated as comments and skipped.

```bash
./spoof_check -input domains.txt
```

### Interactive mode

```bash
./spoof_check -interactive
```

### Output options

#### JSON output

```bash
./spoof_check -domain example.com -json
```

#### Save results to a file

```bash
./spoof_check -domain example.com -output results.txt
```

#### JSON output saved to a file

```bash
./spoof_check -domain example.com -json -output results.json
```

#### Bulk processing with JSON output

```bash
./spoof_check -input domains.txt -json -output results.json
```

#### Bulk processing with TXT output

```bash
./spoof_check -input domains.txt -output results.txt
```

#### Bulk processing subdomain takeover check with json output

```bash
./spoof_check -input domains.txt -subtakeover -json -output results.txt
```
## Command-Line Options

| Option | Description |
| ------ | ----------- |
| `-domain` | Specify a single domain to check |
| `-input` | Specify a file containing a list of domains to check |
| `-output` | Save results to the specified file |
| `-json` | Output results in JSON format |
| `-interactive` | Run in interactive mode |
| `-subtakeover` | Check for subdomain takeover vulnerabilities (untested)|
| `-debug` | Debug Mode |

## Issue Codes

The tool identifies several types of issues with the following codes:

| Code | Title | Severity |
| ---- | ----- | -------- |
| 0 | Non-existent domain | Low |
| 1 | No SPF record exists | High |
| 2 | SPF "all" mechanism is missing or set to "?all" | High |
| 3 | SPF "+all" mechanism set | Very High |
| 4 | SPF "~all" (SoftFail) mechanism set | Medium |
| 5 | SPF has too many lookups for receiver validation | Medium |
| 6 | No SPF sub-domain record exists | Medium |
| 7 | No DMARC record exists | High |
| 8 | Insecure DMARC policy 'p' qualifier | High |
| 9 | Insecure DMARC sub-domain 'p' qualifier | High |
| 10 | Partial DMARC coverage | Medium |
| 11 | DNS Timeout during Scan | Low |
| 12 | Trivial SPF recurse loop | Medium |

## Example Output

### Text format:

```
--- Checking domain: example.com ---
SPF Record: v=spf1 include:_spf.example.com ~all
DMARC Record: v=DMARC1; p=none; rua=mailto:dmarc@example.com

Found the following issues:

Code 4: SPF "~all" (SoftFail) ```bash

```echanism set
   Severity: Medium
   Detail: The "all" mechanism at the end of the end of an SPF record tells receivers how to treat unauthorised (i.e. spoofed) emails - the "~all" setting tells receivers to 'SoftFail' (i.e. quarantine) emails that fail SPF authentication. In practice however, many email filters only slightly raise the total spam score and accept 'SoftFailed' (i.e. spoofed) emails.

Code 8: Insecure DMARC policy 'p' qualifier
   Severity: High
   Detail: The DMARC policy 'p' qualifier is "none". If the DMARC policy is neither "reject" nor "quarantine", spoofed emails utilising an attack technique known as SPF-bypass are likely to be accepted.

--- Subdomain Takeover Check ---
Not vulnerable to subdomain takeover.
CNAME: example.com

--- End of report ---
```

### JSON format:

```json
{
  "domain": "example.com",
  "spf_record": "v=spf1 include:_spf.example.com ~all",
  "dmarc_record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com",
  "issues": [
    {
      "code": 4,
      "title": "SPF \"~all\" (SoftFail) mechanism set",
      "detail": "The \"all\" mechanism at the end of the end of an SPF record tells receivers how to treat unauthorised (i.e. spoofed) emails - the \"~all\" setting tells receivers to 'SoftFail' (i.e. quarantine) emails that fail SPF authentication. In practice however, many email filters only slightly raise the total spam score and accept 'SoftFailed' (i.e. spoofed) emails.",
      "severity": "Medium"
    },
    {
      "code": 8,
      "title": "Insecure DMARC policy 'p' qualifier",
      "detail": "The DMARC policy 'p' qualifier is \"none\". If the DMARC policy is neither \"reject\" nor \"quarantine\", spoofed emails utilising an attack technique known as SPF-bypass are likely to be accepted.",
      "severity": "High"
    }
  ],
  "success": true,
  "subdomain_takeover": {
    "domain": "example.com",
    "vulnerable": false,
    "cname_record": "example.com"
  }
},
```

## License

This tool is provided as-is without any warranty. Use at your own risk.