← back to /blog← powrót do /blog

→ czytaj po polsku

· 2 min read

mailops: SPF, DKIM, DMARC and the rest of mail, from one terminal

#mailops#release#email#deliverability#go#devops

Email breaks quietly. SPF still resolves, but you crossed the ten-lookup limit last week. DKIM is fine on the old selector and missing on the new one. DMARC says p=reject, except half your senders were never aligned. MTA-STS is published, but the policy doesn’t actually cover the MX host you migrated to. None of it throws an error. Mail just starts landing in spam, and you find out from a customer.

So I built mailops, a small Go CLI that checks the whole mail posture of a domain in one pass, from the terminal or CI.

What it does

One subcommand, mailops check example.com, and it looks at:

  • SPF: presence, multiple records, the all policy, and an estimated DNS-lookup count after include / redirect expansion, so you see the ten-lookup limit coming.
  • DKIM: selector discovery across common and provider selectors, plus public-key parsing and key size.
  • DMARC: policy, pct, report destinations, and external-report authorization hints.
  • MTA-STS & TLS-RPT: the TXT record, the HTTPS policy file, and whether your real MX hosts are actually covered by the policy mx: patterns.
  • BIMI: record syntax, the SVG logo and VMC authority-evidence URIs, and DMARC-enforcement compatibility.
  • Reputation: DNSBL checks for MX IPs out of the box, plus optional domain DBL / SURBL / URIBL zones.

With --smtp it goes active: connect to the MX or submission hosts, read the banner, EHLO, STARTTLS on 25/587, implicit TLS on 465, check the negotiated TLS version and certificate expiry, list the advertised AUTH mechanisms, and run an unauthenticated open-relay RCPT probe that never sends DATA. --mda does the same posture check for IMAP/POP on 143/993/110/995: availability and TLS only, no login, no mailbox reads.

Provider profiles

Most domains sit behind a known platform, so --profile google-workspace (or microsoft-365, amazonses, sendgrid, mailgun, postmark, zoho, …) pre-fills the right DKIM selectors and endpoints. Anything you pass explicitly wins over the profile.

In CI

Output is human-readable text by default, or --json / --yaml / --prom, and --otel-endpoint POSTs OTLP/HTTP metrics straight to a collector. Exit codes mean what they say; --fail-on warn and --strict decide exactly which findings break the build. Drop it in a scheduled job and you catch the broken SPF, the expiring MX cert, or a fresh DNSBL listing before your customers do.

Where it lives

- Paweł

← back to /blog← powrót do /blog

→ czytaj po polsku