Unifying Mail Security Audits via Scripting

From Fragmented Tools to Native Probing

Following the friction experienced during customer domain reviews, a foundational question arose: could a comprehensive mail security audit be executed natively using standard command-line tools or a structured scripting approach before committing to custom software development?

Initial exploration focused on native Windows and PowerShell utilities to replicate the multi-tool workflow locally:

• DNS Interrogation: Utilizing Resolve-DnsName and nslookup -type=txt to pull apex records, MX endpoints, and explicit _dmarc records.
• Transport & TLS Probing: Using Test-NetConnection to verify outbound socket reachability on secure mail submission ports (Port 465 for SMTPS and Port 587 for STARTTLS).
• Selector Enumeration: Looping through arrays of common enterprise DKIM selectors (default, selector1, google, s1, k1) via PowerShell string formatting to query [_selector]._domainkey.[domain].

The Pivot to a Web-Based Utility (PHP)

While PowerShell scripts successfully automated local workstation checks, they presented deployment and sharing barriers for broader administrative use. A local script lacks an immediate graphical interface, real-time progress logging during asynchronous DNS resolution, and instant plaintext export formatting for client audit reports.

The observation led directly to a technical pivot: migrating the core logic into a server-side PHP application. A web utility could offer distinct advantages:

• Immediate Execution Stream: Leveraging cURL and server sockets to perform live TLS certificate handshakes, check issuer chains, and test port availability without local environment dependencies.
• Resilient DNS Handling: Utilizing native PHP DNS functions alongside root apex normalization to cleanly process user inputs, whether provided as raw domains, full URLs, or email addresses.
• Integrated Reporting: Instantly compiling SPF hop counts, DMARC telemetry policies (rua/ruf), and multi-port SSL statuses into structured, copy-pasteable plaintext reports.

This realization directly spawned the development of the Domain Mail Security Checker (DMSC), turning a fragmented multi-hour manual audit process into a streamlined single-pass verification tool.