Stop Guessing If Your Email Server Is Secure! Use mxcheck Instead

Stop Guessing If Your Email Server Is Secure! Use mxcheck Instead

Your email server is probably leaking secrets right now.

No, seriously. While you're reading this, your MX records could be misconfigured, your TLS certificates might be expired, and you could be one SMTP smuggling attack away from becoming the next headline breach. The terrifying part? Most organizations have no idea.

Here's the dirty secret that keeps security engineers awake at night: email infrastructure is simultaneously the most critical and the most neglected attack surface in modern IT. Companies spend millions on endpoint protection and fancy SIEMs, yet their email servers sit wide open like digital screen doors in a hurricane. The 2023 breaches at major organizations proved one thing conclusively—email security isn't just about phishing filters anymore.

But what if you could audit your entire email security posture in under 60 seconds? What if a single open-source tool could expose every hidden vulnerability, from dangling DNS records to that nightmare scenario where your server happily relays spam for any anonymous connection?

Enter mxcheck—the email security scanner that top penetration testers and DevSecOps teams are quietly adopting. Created by Steffen Fritz, this Go-powered tool doesn't just check boxes. It dismantles your email infrastructure's armor, finds the cracks, and shows you exactly how attackers would exploit them. And the best part? It's now officially available in Kali Linux's arsenal.

Ready to stop hoping and start knowing? Let's dive into why mxcheck deserves a permanent spot in your security toolkit.

What is mxcheck?

mxcheck is an open-source information gathering and security scanner specifically engineered for email servers. Born from the mind of security researcher Steffen Fritz, this tool represents a paradigm shift in how we approach email infrastructure auditing. Unlike generic network scanners that treat SMTP as an afterthought, mxcheck lives and breathes email protocols.

The project reached its mature v2.0.0 release after extensive real-world testing, earning recognition through multiple quality badges including Go Report Card, OpenSSF Scorecard, and OpenSSF Best Practices certification. Its inclusion in Kali Linux's official repositories signals something critical: this isn't hobbyist code—it's battle-tested tooling that professional penetration testers rely on.

But why is mxcheck trending now? The answer lies in two converging forces. First, SMTP smuggling emerged as a critical attack vector in late 2023, exposing how subtle protocol interpretation differences between mail servers could enable email spoofing at scale. Second, organizations finally recognize that email infrastructure spans far beyond the mail daemon itself—it's a complex ecosystem of DNS records, TLS configurations, authentication mechanisms, and network exposures that traditional vulnerability scanners simply don't understand holistically.

mxcheck bridges this gap by treating email security as an integrated discipline. It doesn't just check if port 25 is open; it validates your entire email trust chain from DNS to certificate to relay behavior. In an era where BEC (Business Email Compromise) losses exceed $2.7 billion annually, this comprehensive approach isn't luxury—it's survival.

Key Features That Set mxcheck Apart

What makes mxcheck genuinely exceptional is its obsessive comprehensiveness paired with surgical precision. This isn't a tool that overwhelms you with noise; every check serves a specific security purpose.

DNS Record Archaeology: mxcheck performs deep inspection of nine distinct DNS record types—A, MX, PTR, SPF, MTA-STS, DKIM, DMARC (fully parsed), TLSRPT, and BIMI. The DMARC parsing is particularly noteworthy because raw DMARC records are notoriously difficult to interpret correctly. mxcheck translates policy strings into actionable intelligence, revealing whether your domain actually enforces rejection or merely whispers suggestions to receiving servers.

DANE/TLSA Validation (RFC 6698, RFC 7672): For organizations serious about transport security, mxcheck validates DANE records with granular detail—usage fields, selector types, matching algorithms, and actual certificate data. This matters enormously because DANE without correct deployment is worse than useless; it creates false confidence while failing to prevent downgrade attacks.

TLS Certificate Forensics: Beyond simple expiry checking, mxcheck examines certificate chains on port 465, extracting Subject CN, Issuer CN, and all Subject Alternative Names (SANs). This catches subtle misconfigurations where certificates technically validate but don't actually cover the intended service names—a common cause of mail delivery failures and security warnings.

SMTP Smuggling Detection: The -g, --smuggle flag implements cutting-edge detection for this emerging attack class. SMTP smuggling exploits how different servers interpret line endings and data termination sequences, potentially allowing attackers to inject unauthorized emails. mxcheck actively probes for these interpretation differences before attackers do.

Open Relay Verification: Through intelligent two-phase testing with configurable mailFrom and mailTo addresses, mxcheck distinguishes between legitimate authenticated relaying and dangerous open relay configurations that transform your server into a spam cannon.

Information Leakage Detection: The tool probes for VRFY command responses and server banner strings—both classic information disclosure vectors that aid reconnaissance and enable targeted attacks.

Blacklist Monitoring: Real-time verification against multiple DNS blacklists ensures you discover reputation problems before they crater your deliverability.

Flexible Output: The -w, --write-tsv option generates machine-parseable reports for integration into CI/CD pipelines and automated security dashboards.

Real-World Use Cases Where mxcheck Shines

Use Case 1: Pre-Deployment Infrastructure Validation

Before cutting over to new email infrastructure, run mxcheck against staging environments. The comprehensive DNS validation catches record propagation issues, while DANE/TLSA verification ensures your TLSA records actually match deployed certificates. One enterprise saved a catastrophic production cutover by discovering their MTA-STS policy specified a max_age of only one second—functionally disabling the protection they believed active.

Use Case 2: Continuous Security Monitoring

Integrate mxcheck into your security automation with the TSV output flag. Schedule nightly scans of critical domains, diff results, and alert on any degradation. A financial services firm implemented this and discovered within hours when a certificate renewal script silently failed, leaving their primary MX with an expired TLS certificate.

Use Case 3: M&A Due Diligence and Asset Discovery

During acquisitions, email infrastructure assessment reveals shadow IT and misconfigurations. mxcheck's blacklist checking and open relay testing exposed that a target company's "decommissioned" mail server was actually still accepting connections and relaying spam—an undisclosed liability that would have become the acquirer's problem.

Use Case 4: Post-Incident Forensics and Hardening

After suspected email compromise, mxcheck provides rapid baseline assessment. The SMTP smuggling detection and VRFY probing reveal attack vectors that may have enabled initial access. One incident response team used mxcheck to discover that attackers had exploited a DMARC policy set to p=none (monitoring only) to spoof executive emails during a BEC campaign.

Use Case 5: Compliance and Audit Preparation

For SOC 2, ISO 27001, and other frameworks requiring email security controls, mxcheck generates objective evidence of control effectiveness. The detailed certificate and TLS configuration reporting satisfies technical assessors who actually understand the underlying protocols.

Step-by-Step Installation & Setup Guide

Getting mxcheck operational takes under two minutes. Choose your preferred installation path:

Option 1: Go Install (Recommended for Latest Version)

Ensure you have Go 1.21+ installed, then execute:

# Install directly from GitHub with version pinning
go install github.com/steffenfritz/mxcheck@v2.0.0

# Verify installation
mxcheck -v

This approach always delivers the exact release version and integrates cleanly with Go-based development environments.

Option 2: Pre-compiled Binary

Download platform-specific binaries from the GitHub releases page. Extract and place in your $PATH:

# Example for Linux amd64
wget https://github.com/steffenfritz/mxcheck/releases/download/v2.0.0/mxcheck_2.0.0_linux_amd64.tar.gz
tar -xzf mxcheck_2.0.0_linux_amd64.tar.gz
chmod +x mxcheck
sudo mv mxcheck /usr/local/bin/

Option 3: Kali Linux (For Penetration Testers)

mxcheck ships in Kali's default repositories:

sudo apt update
sudo apt install mxcheck

This installation includes the man page for offline reference.

Environment Configuration

No mandatory configuration exists, but consider these optimizations:

# Create alias for common scanning profile
echo 'alias mxcheck-full="mxcheck -n -b -g -w"' >> ~/.bashrc

# Set preferred DNS resolver (avoid ISP hijacking)
export MXCHECK_DNS="1.1.1.1"

The -n (no-prompt) flag is essential for automation, automatically answering yes to all interactive questions.

REAL Code Examples from mxcheck

Let's examine actual mxcheck usage patterns with detailed explanations of what each scan reveals.

Example 1: Basic Information Gathering

# Fundamental scan: discovers all DNS records and basic server properties
./mxcheck -s 2600.com

This command performs the core mxcheck assessment against the target domain 2600.com. Here's what happens under the hood: mxcheck first resolves the MX records for the domain, then for each mail exchanger, it queries A, PTR, SPF, MTA-STS, DKIM, DMARC, TLSRPT, and BIMI records. The DMARC record receives special treatment—instead of raw string output, mxcheck parses the policy into human-readable components showing whether the domain requests reporting, quarantine, or rejection of authentication failures.

The scan also establishes TCP connections to ports 25, 465, and 587, testing StartTLS support and capturing certificate details. This single command often reveals surprising misconfigurations—perhaps the MX record points to a decommissioned host, or the SPF record includes too many DNS lookups (exceeding RFC 7208's limit of 10), causing unpredictable authentication results.

Example 2: Verbose Scan with Custom DNS

# Detailed scan with timestamped output and alternative DNS resolver
./mxcheck -s 2600.com -v -d 8.8.8.8

The -v flag enables verbose mode, injecting timestamps into all output lines—critical when correlating scan results with other log sources during incident response. The -d 8.8.8.8 parameter overrides the default Google DNS with explicit specification, useful when testing against specific resolver behaviors or bypassing local DNS filtering.

This pattern shines when investigating DNS-based security controls. Different resolvers may return varying results for DNSSEC-signed zones, or corporate DNS might filter certain record types. By specifying the resolver explicitly, you eliminate ambiguity about where responses originate.

Example 3: Comprehensive Security Assessment with Full Output

# Maximum intensity scan: all security checks with TSV report generation
./mxcheck -s 2600.com -n -f info@baz.com -t boss@foo.org -w -S default -b -g

This is the production-grade assessment pattern. Let's dissect each flag:

• -n: Non-interactive mode—answers yes automatically, essential for cron jobs and CI pipelines
• -f info@baz.com: Sets the envelope sender for open relay testing; using an external domain tests whether the server relays unauthorized mail
• -t boss@foo.org: Sets the envelope recipient, also external to test relay boundaries
• -w: Writes TSV-formatted report to file for automated processing; the output includes structured data for every check performed
• -S default: Specifies the DKIM selector to query; "default" is a common selector name, but production environments should verify actual selectors in use
• -b: Enables blacklist checking across major DNSBLs like Spamhaus, SURBL, and Barracuda
• -g: Activates SMTP smuggling vulnerability detection—the cutting-edge check that probes how the server handles line ending sequences and data termination

The TSV output enables powerful downstream automation. Parse the report with standard Unix tools:

# Extract only critical findings from TSV report
cut -f1,3,5 mxcheck_report.tsv | grep -E "FAIL|VULNERABLE|OPEN"

Example 4: Authentication Bypass Detection Pattern

# Phase 1: External-to-external address test (should fail if properly secured)
./mxcheck -s example.com -f info@baz.com -t boss@foo.org

# Phase 2: Internal-to-internal address test (may succeed with local delivery)
./mxcheck -s example.com -f info@example.com -t boss@example.com

This two-phase methodology reveals subtle authentication bypass vulnerabilities. The first command tests whether the server relays mail between external domains—classic open relay behavior that should be blocked. The second command tests local-to-local delivery, which legitimate servers often permit without authentication.

Critical interpretation: If Phase 1 returns Server is not an open relay but Phase 2 returns Server is probably an open relay, you've discovered a local delivery bypass. Attackers with any foothold in your network could exploit this to send spoofed internal emails without credentials. This isn't technically an open relay, but it's a significant security gap that standard scanners miss entirely.

Advanced Usage & Best Practices

Automate Everything: The -n and -w flags exist specifically for automation. Wrap mxcheck in scripts that iterate across your entire domain portfolio:

#!/bin/bash
# Bulk domain assessment with dated reports
DOMAINS=$(cat domains.txt)
DATE=$(date +%Y%m%d)
for domain in $DOMAINS; do
    mxcheck -s "$domain" -n -b -g -w -f "scan@$domain" -t "test@$domain"
    mv mxcheck_report.tsv "reports/${domain}_${DATE}.tsv"
done

DKIM Selector Discovery: The -S flag requires knowing your selector. When uncertain, check common selectors (default, google, selector1, selector2) or extract from actual email headers:

# Extract DKIM selector from received email
grep "DKIM-Signature" email.eml | grep -o "s=[^;]*" | cut -d= -f2

DNS Server Strategy: Test with multiple resolvers. Corporate DNS may filter or cache aggressively, hiding propagation issues visible through public resolvers. The -d flag makes A/B testing trivial.

Correlate with External Intelligence: Combine mxcheck's AS number and country data with threat intelligence feeds. Mail servers hosted in unexpected ASNs or geographies may indicate compromise or shadow infrastructure.

Version Monitoring: The -u flag checks for updates—use it in automation to ensure your scanner itself isn't outdated.

Comparison with Alternatives

Why mxcheck wins: While Nmap provides raw SMTP scripting and testssl.sh excels at TLS deep-dives, only mxcheck treats email infrastructure as an integrated security domain. MXToolbox offers similar breadth but lacks automation, smuggling detection, and open-source extensibility. For security teams building reproducible, auditable email assessment programs, mxcheck's combination of comprehensiveness and scriptability is unmatched.

Frequently Asked Questions

Q: Is mxcheck safe to run against production email servers? A: Yes, with caveats. The scanning is non-destructive, but the open relay tests (-f and -t flags) actually attempt mail delivery. Use external test addresses and the -n flag to prevent interactive prompts from hanging automated runs.

Q: What is SMTP smuggling and why does mxcheck check for it? A: SMTP smuggling is a 2023-discovered attack where differences in how mail servers interpret line endings (CRLF vs. LF) allow attackers to inject unauthorized emails. mxcheck's -g flag actively probes for these interpretation differences, giving you early warning before exploitation becomes widespread.

Q: Can mxcheck replace my existing vulnerability scanner? A: mxcheck complements rather than replaces general scanners. It provides email-specific depth that Nessus, OpenVAS, and similar tools lack. Use mxcheck for email infrastructure, keep your general scanner for broader coverage.

Q: How do I interpret "Server is probably an open relay" results? A: This indicates local-to-local delivery succeeded without authentication. Review your mail server's relay restrictions—legitimate configurations may require SMTP AUTH for all submissions. The two-phase testing methodology distinguishes true open relays from local delivery policies.

Q: Does mxcheck support IPv6-only mail servers? A: mxcheck resolves AAAA records when present and follows standard DNS resolution. Ensure your environment has IPv6 connectivity if testing IPv6-only infrastructure.

Q: Can I contribute to mxcheck development? A: Absolutely. The project welcomes contributions under GPL v3. The Go codebase is clean and well-structured, with active maintenance evidenced by the v2.0.0 release and OpenSSF best practices adherence.

Q: What output format does the TSV report use? A: The TSV (Tab-Separated Values) format uses standard tab delimiters with one check result per row. Columns typically include check type, target, status, and detailed findings—easily parsed by Python^{↗ Bright Coding Blog} pandas, R, or standard Unix tools.

Conclusion

Email security is no longer a checkbox exercise—it's a continuous battle against evolving threats that target the very protocols powering global communication. mxcheck transforms this battle from reactive panic into proactive, systematic defense.

The tool's genius lies in its holistic obsession: every DNS record, every TLS handshake, every SMTP conversation nuance matters. In an era where SMTP smuggling can bypass authentication entirely and a single misconfigured DMARC policy enables executive impersonation at scale, this comprehensiveness isn't paranoia—it's professionalism.

Whether you're hardening production infrastructure, conducting penetration tests, or building automated security pipelines, mxcheck delivers actionable intelligence that generic tools simply cannot match. Its Kali Linux inclusion and active maintenance signal long-term viability.

Stop guessing. Start knowing.

Clone, install, or go get mxcheck today from the official repository at https://github.com/steffenfritz/mxcheck. Run your first scan within sixty seconds. The vulnerabilities you discover might just save your organization from becoming tomorrow's breach headline.

What's the most surprising email misconfiguration you've encountered? Share your mxcheck findings—tag me when you uncover something that made your security team gasp.

The mxcheck logo was created by Alex/Lignum5. Documentation and contact: https://mxcheck.fritz.wtf