guest@geearr:~/services$ man geearr-email
NAME
geearr-email — email security by George Rios
Email Security: Your domain is someone’s phishing kit. Take it back.
SYNOPSIS
geearr email [--auth] [--enforce=reject] [--transport] [--bec] <domain>…DESCRIPTION
Email is still the number-one way into an organization — and the number-one way attackers impersonate you to your customers. George takes domains from “anyone can spoof us” to DMARC enforcement without breaking legitimate mail, then hardens the human side: phishing, business email compromise and payment-fraud workflows. He also built Fromenance, a communication-provenance platform for banks and insurers, because SPF, DKIM and DMARC alone do not prove a specific message is real.
OPTIONS — WHAT GETS TESTED
--auth · Authentication & enforcement
- Inventory of every SaaS that sends mail as you
- SPF flattening & 10-DNS-lookup limit fixes
- DKIM 2048-bit keys, rotation & alignment
- DMARC rollout: p=none → quarantine → reject
- Parked & non-sending domain lockdown
--transport · Transport & brand
- MTA-STS & TLS-RPT
- DNSSEC & DANE where supported
- BIMI with VMC/CMC readiness
- Lookalike & cousin-domain monitoring
- Dangling-record & subdomain-takeover checks
--bec · Threats & people
- Phishing & BEC tabletop exercises
- Microsoft 365 / Google Workspace & gateway tuning
- Payment-change & vendor-fraud controls
- DMARC report & header forensics
- Communication provenance for customer-facing mail
OUTPUT — WHAT YOU GET
- 01Domain-by-domain email authentication scorecard
- 02Staged DMARC enforcement plan with report monitoring
- 03DNS changes prepared (or applied) for SPF, DKIM, DMARC, MTA-STS and BIMI
- 04BEC and payment-fraud control recommendations
- 05Executive summary for your board, regulators or cyber insurer
EXAMPLES
$ geearr email --auth example.com senders found: 11 · aligned: 6 · unknown: 2 spf: 13 DNS lookups (limit 10) → PermError risk
$ geearr email --enforce=reject --parked example.net example.org _dmarc: p=reject · spf: -all · null MX published spoofing of 3 domains: blocked at receivers
# illustrative output
CONFORMING TO
- RFC 7208 (SPF)
- RFC 6376 (DKIM)
- RFC 7489 (DMARC)
- RFC 8461 (MTA-STS)
- RFC 7505 (Null MX)
- Google / Yahoo / Microsoft bulk-sender rules
- M3AAWG best practices
FAQ
[+][-]What are SPF, DKIM and DMARC?
SPF lists which servers may send mail for your domain. DKIM cryptographically signs each message so receivers can verify it was not altered. DMARC ties the two to the visible From: address and tells receivers what to do when a message fails — monitor (p=none), send to spam (p=quarantine) or block (p=reject) — while sending you reports on who is mailing as you.
[+][-]Do I need DMARC set to p=reject?
If you want to stop attackers from spoofing your exact domain, yes. A DMARC policy of p=none only monitors; it does not protect anyone. Google, Yahoo and Microsoft already require DMARC for bulk senders, and p=reject is the goal for any domain your customers trust. The safe path is a staged rollout that inventories every legitimate sender first.
[+][-]Does DMARC stop phishing and business email compromise?
DMARC stops exact-domain spoofing, which is a large share of phishing — but not lookalike domains, compromised vendor accounts, or a real employee mailbox being taken over. Effective BEC defense combines DMARC enforcement, lookalike-domain monitoring, mailbox hardening, and out-of-band verification for payment and banking changes.
SEE ALSO
guides: How to get DMARC to p=reject without breaking email
glossary: spf(7), dkim(7), dmarc(7), bimi(7), mta-sts(7), email-spoofing(7), bec(7), phishing(7)
shipped: fromenance(8) — Communication provenance for banks, credit unions, insurers and utilities., pryvc(8) — OAuth for contact details.
services: geearr-pentest(1), geearr-appsec(1), geearr-cloud(1), geearr-ai(1)
EXIT STATUS
0 when every finding is closed and retested. Anything else means we keep going.
BUGS
None known. That’s what retests are for. Found one in this site? security.txt