mxcheck/mxcheck.1 at main · steffenfritz/mxcheck · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
.\" Copyright (c) 2019-2026, Steffen Fritz
.\"
.\" %%%LICENSE_START(GPLv2+_DOC_FULL)
.\" This is free documentation; you can redistribute it and/or
.\" modify it under the terms of the GNU General Public License as
.\" published by the Free Software Foundation; either version 2 of
.\" the License, or (at your option) any later version.
.\"
.\" The GNU General Public License's references to "object code"
.\" and "executables" are to be interpreted as the output of any
.\" document formatting or typesetting system, including
.\" intermediate and printed output.
.\"
.\" This manual is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public
.\" License along with this manual; if not, see
.\" <http://www.gnu.org/licenses/>.
.\" %%%LICENSE_END


.TH mxcheck 1 "April 2026" "version 2.0.0"


.SH NAME
mxcheck
.SH SYNOPSIS
.B mxcheck [OPTION]
.SH DESCRIPTION
mxcheck is an info scanner for e-mail servers. It checks the following DNS records: A, MX, PTR, SPF, MTA-STS, DKIM, DMARC (all fields parsed), TLSRPT (RFC 8460), and BIMI.
It also performs DANE/TLSA checks per MX host (RFC 6698, RFC 7672), including usage, selector, matching type, and certificate data.
It also checks for StartTLS support and the validity of the certificate, TLS versions, and if the VRFY command is supported.
On port 465 (SMTPS), mxcheck retrieves full TLS certificate details including expiry date, Subject CN, Issuer CN, and Subject Alternative Names.
After scanning the tcp ports 25, 465 and 587 mxcheck checks if the e-mail server is an open relay by trying to send a single message.
It also checks whether the service is blacklisted by querying public blacklist services.

.SH FLAGS
mxcheck

.BR \-b,\ --blacklist\fR
    Check if the service is on blacklists.

.BR \-d,\ --dnsserver\fR
    The dns server to consult (default "8.8.8.8").

.BR \-g,\ --smuggle\fR
    Test for SMTPSmuggling vulnerability.

.BR \-p,\ --disable-port-scan\fR
    Disable SMTP port scan.

.BR \-f,\ --mailfrom\fR
    Set the mailFrom address (default "info@foo.wtf").

.BR \-n,\ --no-prompt\fR
    Answer yes to all questions.

.BR \-s,\ --service\fR
    The service to check. This is a mandatory flag and must be a domain name.

.BR \-S,\ --dkim-selector\fR
    The DKIM selector. If set a DKIM check is performed on the provided service domain.

.BR \-t,\ --mailto\fR
    Set the mailTo address (default "info@baz.wtf").

.BR \-u,\ --updatecheck\fR
    Check if a new version of mxcheck is available.

.BR \-V,\ --verbose\fR
    Show timestamps in output.

.BR \-v,\ --version\fR
    Print the version and build and a license notice.

.BR \-w,\ --write-tsv\fR
    Write tsv formated report to file. Its name is fixed to target host, an RFC3339 timestamp and a tsv suffix.

.SH AUTHOR
Steffen Fritz <steffen@fritz.wtf>