Email Auth Check (email-auth-check)

Summary

SPF, DMARC, and DKIM policy signals for outbound mail.

Classification

• Category: SECURITY
• Plugin id: email-auth-check
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */12 * * *', priority: 6 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
dkimSelectors	Optional extra DKIM selector hostnames to probe beyond the built-in list.

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for email-auth-check.

Check	Typical severity	Why
No SPF record configured	WARNING	No v=spf1 TXT at apex — receivers cannot authorize legitimate senders; spoofing risk.
Weak SPF policy (+all or ?all)	WARNING	+all allows any host to send; ?all is neutral — both fail to reject forged mail.
SPF issue (multiple records or >10 DNS lookups)	INFO	RFC violations — SPF may fail unpredictably at receivers.
No DMARC record configured	WARNING	No _dmarc TXT — no policy for handling SPF/DKIM failures.
DMARC policy p=none	INFO	Monitoring-only — failing messages still delivered.
DMARC missing rua= aggregate reporting	INFO	No aggregate reports to detect abuse or misconfiguration.
No DKIM records found	INFO	None of 25+ common selectors returned v=DKIM1 TXT — outbound mail may fail alignment.

How each check works

1. Domain — Strip www. from target URL hostname.
2. SPF — TXT lookup on apex; find v=spf1. Flag +all/?all as WARNING; ~all/-all OK. Count include:/a:/mx:/ptr:/exists: lookups (max 10). Multiple SPF TXT → INFO.
3. DMARC — TXT on _dmarc.{domain}; parse p=, rua=, pct=. Missing record → WARNING; p=none → INFO; missing rua → INFO; pct<100 → INFO issue text.
4. DKIM — Probe {selector}._domainkey.{domain} for selectors: default, google, selector1/2, k1/k2, mail, dkim, s1/s2, smtp, mandrill, mailjet, protonmail*, mxvault, postmark, cm, zendesk1/2, plus optional dkimSelectors from config. Any v=DKIM1 → success.
5. Score — −25 missing SPF/DMARC, −15 weak SPF, −10 DMARC none, −15 no DKIM.

Caveats and concerns

• DNS only — Does not send test email or verify alignment on live messages.
• Custom DKIM selectors — Unlisted selectors are missed unless added via dkimSelectors.
• Subdomain mail — Apex DNS only; mail from mail.example.com may use different SPF/DKIM.
• ~all not flagged — Soft fail is treated as acceptable (no WARNING).
• Subdomain DMARC — Does not check organizational domain DMARC for subdomain senders.

Source

packages/test-plugins/src/plugins/email-auth-check.ts