Email Exposure Audit Tool

A simple command-line tool for discovering publicly exposed email addresses associated with domains through various sources including DNS records, security.txt files, and web crawling.

Features

• Multi-source email discovery (DNS SOA, DMARC, SPF, security.txt, web crawling)
• Batch processing from input files
• CSV output with source attribution
• Rate limiting and robots.txt compliance
• Email deobfuscation for common patterns
• External vs domain-specific email categorization

Installation

git clone <repository-url>
cd email-exposure-audit
pip install -r requirements.txt

Usage

Single Domain audit

python email_audit.py example.com
python email_audit.py example.com --verbose
python email_audit.py example.com --json

Batch Processing

python email_audit.py --input-file domains.txt
python email_audit.py --input-file domains.txt --output results.csv --verbose
python email_audit.py --input-file domains.txt --output results.csv --verbose --workers 10

Input File Format

example.com
google.com
github.com 

Output Format

The tool generates a CSV file with three columns:

• domain: The audited domain
• external_emails: Semicolon-separated list of discovered external emails
• top_source_method: Method that found the most emails (alphabetically first if tied)

Command Line Outputs

• domain: Single domain to audit
• --input-file, -i: Text file containing domains (one per line)
• --output, -o: Output CSV file path (default: email_audit_results.csv)
• --verbose, -v: Show detailed output during processing
• --json: Output single domain results in JSON format
• --workers: Custom number of workers to perform the task

Discovery Methods

The tool searches for email addresses through:

• DNS SOA: Start of Authority RNAME field
• DMARC Records: Policy reporting addresses
• SPF Records: Sender Policy Framework data
• Security.txt: RFC 9116 security contact files
• Web Crawling: Homepage and linked pages
• Sitemap Crawling: XML sitemap discovery

Rate Limiting

The tool implements respectful rate limiting:

• 0.5 second delay between requests
• 1 second delay between domain processing
• Robots.txt compliance for web crawling
• Maximum 20 pages per domain crawl

Security Considerations

This tool is designed for legitimate security research and compliance auditing. Users are responsible for ensuring their use complies with applicable laws and terms of service.

Requirements

• Python 3.7+
• See requirements.txt for dependencies

License

MIT License