PSGet-Domain-MailInfo - PowerShell script to get domain mail info and cont

项目说明

PSGet-Domain-MailInfo

Output is accessible in PowerShell pipeline.
Results are also written to DomainResults.CSV file and optionally to pie-chart PNGs by adding -CreateGraphs 1.

Three example uses for one / a limited number of domain(s):

Example where a is assigned the data that is returned when checking domains listed in a txt file:

(progress bar will be shown - enumerating each domain as it is checked)
The array $mydomains now holds the result for all requested domain names.

List the domainnames that have SPF:

Print information for one domain:

or named

More information and examples can be found using Get-Help, see output below:

```
PS C:\> Get-Help .\Get-Domain-MailInfo.ps1 -Full

NAME
C:\PSGet-Domain-MailInfo\Get-Domain-MailInfo.ps1

SYNOPSIS
Get MailInfo for domain(s).

Default is to retrieve MX, SPF and DMARC records.
* Will recognize Null MX - RFC7505

Optionally add -CheckDKIM 1 to retrieve DKIM record(s).
* Note requirement to provide DKIMSelector parameter.
This parameter is a text array - provide selectors separated by comma

Will fall back to using -DKIMSelector Selector1, Selector2 (Microsoft Exchange Online)

Returns two columns
- DKIMSelector holding all Selectors tested, separated by /
- DKIMRecord holding [Selector1]DKIMRecord1/[Selector2]DKIMRecord2

Example below is typically seen when DNS has wildcard TXT/SOA record:
"Selector1/Selector2";"[Selector1]NoDKIMRecord/[Selector2]NoDKIMRecord"

- Outputs to DomainResults.csv and console.
- Uses System Default List Separator Character and Quotes to simplify CS.

SYNTAX
.\Get-Domain-MailInfo.ps1 [-Name <String[]>] [-CheckSPF <Boolean>] [-CheckDMARC <Boolean>] [-CheckDKIM <Boolean>]
[-DKIMSelector <String[]>] [-DNSServer <String>] [-ForceDNSServer <Boolean>] [-CheckStartTLS <Boolean>]
[-O <Boolean>] [-UseHeader <Boolean>] [-CreateGraphs <Boolean>] [-PolicyChecks <String[]>] [<CommonParameters>]

.\Get-Domain-MailInfo.ps1 [[-Name] <String[]>] [-Path <String>] [-CheckSPF <Boolean>] [-CheckDMARC <Boolean>]
[-CheckDKIM <Boolean>] [-DKIMSelector <String[]>] [-DNSServer <String>] [-ForceDNSServer <Boolean>]
[-CheckStartTLS <Boolean>] [-O <Boolean>] [-UseHeader <Boolean>] [-CreateGraphs <Boolean>]
[-PolicyChecks <String[]>] [<CommonParameters>]

DESCRIPTION

PARAMETERS
-Name <String[]>
Script execution option 1 is to check ONE domain

Required? false
Position? 1
Default value example.com
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-Path <String>
Script execution option 2 is to check a list of domains from a file, one domain per line

Required? false
Position? named
Default value
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-CheckSPF <Boolean>
Default is to check SPF (RFC7208)

Required? false
Position? named
Default value True
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-CheckDMARC <Boolean>
Default is to check DMARC (RFC7489)

Required? false
Position? named
Default value True
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-CheckDKIM <Boolean>
Default is NOT to check DKIM (RFC6376)
If you add -CheckDKIM 1 you should also specify -DKIMSelector <selector>

Required? false
Position? named
Default value False
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-DKIMSelector <String[]>
Specify the DKIMSelector(s) to check separated by comma.
Tip: Send an e-mail to external mailbox for each system to check Selector for.
Note: The script defaults to -DKIMSelector Selector1, Selector2
This is the default used by Microsoft Exchange online.
You could try -DKIMSelector google for G-Suite

Required? false
Position? named
Default value @("Selector1", "Selector2")
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-DNSServer <String>
Default is to use system default DNS Server

Required? false
Position? named
Default value
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-ForceDNSServer <Boolean>
Default is to check if DNS server is working

Required? false
Position? named
Default value False
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-CheckStartTLS <Boolean>
Default is to check StartTLS (RFC3207)

Required? false
Position? named
Default value True
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-O <Boolean>
Default is to o the .CSV file.
Note: The script will check for file lock and softfail.
Remember to close the CSV file before running the script again.

Required? false
Position? named
Default value True
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-UseHeader <Boolean>
The UseHeader line preference follows O unless specified

Required? false
Position? named
Default value $O
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-CreateGraphs <Boolean>
The CreateGraph option is set to False by default as it is just a nice-to-have.
Will create one .PNG pie-chart per protection type; HasSPF/HasDKIM/HasDMARC.

Required? false
Position? named
Default value False
Accept pipeline input? false
Aliases
Accept wildcard characters? false

-PolicyChecks <String[]>
Policy Check tool was created to help if the email polices for
a domain pass the requirements of named service pro. E.g. Microsoft.
Specify the Policy Checks to perform separated by comma.

Required? false
Position? named
Default value
Accept pipeline input? false
Aliases
Accept wildcard characters? false

<CommonParameters>
This cmdlet supports the common parameters: , Debug,
ErrorAction, Error, WarningAction, Warning,
OutBuffer, Pipeline, and Out. For more information, see
about_CommonParameters ().

INPUTS

OUTPUTS

-------------------------- EXAMPLE 1 --------------------------

PS > .\Get-Domain-MailInfo
Domain : example.com
HasMX : True
HasSPF : True
HasDKIM : #N/A
HasDMARC : False
HasStartTLS : #N/A
MXRecord : Null MX (RFC7505)
SPFRecord : v=spf1 -all
DKIMSelector : #N/A
DKIMRecord : #N/A
DMARCRecord : False
DMARCPolicy : none
PolicyChecks : #N/A

-------------------------- EXAMPLE 2 --------------------------

PS > .\Get-Domain-MailInfo.ps1 -CheckDKIM 1 | Format-Table -AutoSize
Domain HasMX HasSPF HasDKIM HasDMARC HasStartTLS MXRecord SPFRecord DKIMSelector DKIMRecord DMARCPolicy PolicyChecks
------ ----- ------ ------- -------- ----------- -------- --------- ------------ ---------- ----------- ------------
example.com True True False False #N/A Null MX (RFC7505) v=spf1 -all Selector1/Selector2 False #N/A #N/A

-------------------------- EXAMPLE 3 --------------------------

PS > .\Get-Domain-MailInfo.ps1 github.com -CheckDKIM 1 -DKIMSelector google -PolicyChecks Microsoft
[Notice: ] Could not connect to the SMTP Server alt1.aspmx.l.google.com

Domain : github.com
HasMX : True
HasSPF : True
HasDKIM : True
HasDMARC : True
HasStartTLS : False
MXRecord : aspmx.l.google.com,alt4.aspmx.l.google.com,alt3.aspmx.l.google.com,alt2.aspmx.l.google.com,alt1.aspmx.l.
google.com
SPFRecord : v=spf1 ip4:192.30.252.0/22 include:_netblocks.google.com include:_netblocks2.google.com include:_netbloc
ks3.google.com include:spf.protection.outlook.com include:mail.zendesk.com include:_spf.salesforce.com i
nclude:servers.mcsv.net include:mktomail.com ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ip4:1
67.89.101.2 ip4:167.89.101.192/28 ip4:192.254.112.60 ip4:192.254.112.98/31 ip4:192.254.113.10 ip4:192.25
4.113.101 ip4:192.254.114.176 ip4:62.253.227.114 ~all
DKIMSelector : google
DKIMRecord : [google]; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0g
ogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/
ap9tds4JG9ApgNNdSpPxp9DmAPKu/OP
DMARCRecord : ; p=reject; pct=100; rua=mailto:
DMARCPolicy : p=reject
PolicyChecks : [Microsoft]Unqualified(SPFTrue;DKIMTrue;DMARCTrue;DMARCStrictFalse);[Google]Qualified(SPFTrue;DKIMTrue;DMARCTrue)

-------------------------- EXAMPLE 4 --------------------------

PS > .\Get-Domain-MailInfo.ps1 -Name "-invalid.name" - | FT
: Script Get-Domain-MailInfo.ps1
: Last Updated 2025-05-09
:
: Checking 1 domain(s)
: [INVALID:] Domain lookup failed - probable invalid domain name (-invalid.name)

Domain HasMX HasSPF HasDKIM HasDMARC HasStartTLS MXRecord SPFRecord DKIMSelector DKIMRecord DMARCPolicy PolicyChecks
------ ----- ------ ------- -------- ----------- -------- --------- ------------ ---------- ----------- ------------
-invalid.name #N/A #N/A #N/A #N/A #N/A #N/A #N/A #N/A #N/A none #N/A

-------------------------- EXAMPLE 5 --------------------------

PS > .\Get-Domain-MailInfo.ps1 -Path .\DomainList.txt | FT
Domain HasMX HasSPF HasDKIM HasDMARC HasStartTLS MXRecord SPFRecord DKIMSelector DKIMRecord DMARCPolicy PolicyChecks
------ ----- ------ ------- -------- ----------- -------- --------- ------------ ---------- ----------- ------------
example.com True True #N/A False #N/A Null MX (RFC7505) v=spf1 -all #N/A #N/A p=reject #N/A
-example.com #N/A #N/A #N/A #N/A #N/A #N/A #N/A #N/A #N/A #N/A #N/A

RELATED LINKS

项目信息

开发语言：PowerShell

Star 数：12

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PowerShell script to get domain mail info and control status such as MX, SPF, DKIM, DMARC and StartTLS.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。