From 9a0bbc4f8b5d511943e379f9437fcb30ab9f1e7e Mon Sep 17 00:00:00 2001 From: Steffen Fritz Date: Sat, 28 Mar 2026 23:52:03 +0100 Subject: [PATCH] Update README and man page for v1.9.0 features Document TLSRPT lookup, BIMI lookup, full DMARC field parsing, and TLS certificate details (expiry, Subject CN, Issuer CN, SANs) added in the previous release. Co-Authored-By: Claude Sonnet 4.6 Signed-off-by: Steffen Fritz --- README.md | 5 +++-- mxcheck.1 | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index ffcf86f..ed931fb 100644 --- a/README.md +++ b/README.md @@ -2,10 +2,11 @@ mxcheck is an info scanner for e-mail servers. -It checks - * DNS records: A, MX, PTR, SPF, MTA-STS, DKIM, DMARC +It checks + * DNS records: A, MX, PTR, SPF, MTA-STS, DKIM, DMARC (fully parsed), TLSRPT, BIMI * AS Number and AS Country * the support of StartTLS and the certificate + * TLS certificate details on port 465: expiry date, Subject CN, Issuer CN, SANs * open ports: 25, 465, 587 * if the service is listed by blacklists * if it leaks information by server string and VRFY command diff --git a/mxcheck.1 b/mxcheck.1 index f771eb4..b52750e 100644 --- a/mxcheck.1 +++ b/mxcheck.1 @@ -22,7 +22,7 @@ .\" %%%LICENSE_END -.TH mxcheck 1 "November 2025" "version 1.8.0" +.TH mxcheck 1 "March 2026" "version 1.9.0" .SH NAME @@ -30,8 +30,9 @@ mxcheck .SH SYNOPSIS .B mxcheck [OPTION] .SH DESCRIPTION -mxcheck is an info scanner for e-mail servers. It checks the following DNS records: A, MX, PTR, SPF, MTA-STS, DKIM and DMARC. +mxcheck is an info scanner for e-mail servers. It checks the following DNS records: A, MX, PTR, SPF, MTA-STS, DKIM, DMARC (all fields parsed), TLSRPT (RFC 8460), and BIMI. It also checks for StartTLS support and the validity of the certificate, TLS versions, and if the VRFY command is supported. +On port 465 (SMTPS), mxcheck retrieves full TLS certificate details including expiry date, Subject CN, Issuer CN, and Subject Alternative Names. After scanning the tcp ports 25, 465 and 587 mxcheck checks if the e-mail server is an open relay by trying to send a single message. It also checks whether the service is blacklisted by querying public blacklist services.