Powerful Features for Security Teams

Interactive Email Spoofing

Step-by-step CLI wizard for crafting spoofed emails. Set target, sender identity, subject, and body interactively or via command-line flags for full automation in scripted pipelines.

• Interactive wizard mode with validation
• Command-line flags for batch operations
• Support for HTML and plain-text bodies
• Custom header injection for advanced testing

Local SMTP Relay Server

Start a built-in SMTP server on any port. It resolves MX records for recipient domains and attempts relay with full error diagnostics. Supports STARTTLS and SSL for encrypted transmission testing.

• Bind to any local port
• Automatic MX record resolution
• STARTTLS and SSL/TLS support
• Detailed connection and error logging

Scenario-Based Testing

Run tests by template ID. Each scenario includes metadata like category, severity, and description. Perfect for repeatable penetration test campaigns and compliance assessments.

• 62 built-in attack scenario templates
• Severity classification (Critical, High, Medium)
• Category and tag-based filtering
• Repeatable campaigns with consistent parameters

SMTP Profiles

Save named SMTP relay configurations and reuse them across commands. No need to re-enter host, port, credentials, and TLS settings for every test.

• mailspoof profile add gmail --host smtp.gmail.com --port 587 --user you@gmail.com --use-tls
• Reuse with --profile gmail on start, test, and custom
• List and remove profiles easily
• Stored securely in ~/.mailspoof/config.json

Verbose Diagnostics

Trace every stage of SMTP communication with the --verbose flag. Get actionable error explanations for blacklists, SPF/DKIM/DMARC rejections, and relay failures.

• Real-time SMTP connection, STARTTLS, and auth tracing
• Automatic detection of IP blacklists and RBL blocks
• SPF, DKIM, and DMARC policy failure explanations
• Relay rejection guidance with example fixes

Automated Reporting

Generate structured assessment reports in JSON or CSV with success/failure rates, risk levels, and tailored remediation recommendations based on your test results.

Custom Template Engine

Create your own phishing scenarios with the interactive template builder. Store custom templates in ~/.mailspoof/templates/ and reuse them across campaigns.

• Interactive template creation wizard (mailspoof create or -t)
• Preview templates before sending (mailspoof preview <id>)
• Filter templates by keyword or tag (mailspoof list --filter)
• Edit templates in-place with your default editor (mailspoof edit-template <id>)
• Remove custom templates by ID (mailspoof remove-template <id>)

Rich HTML Templates

All built-in templates use professionally formatted HTML with branded layouts, styled tables, images, and call-to-action buttons. MailSpoof automatically generates a clean plain-text fallback for every HTML body, ensuring deliverability across all email clients.

• Realistic HTML emails with logo images and branded styling
• Responsive table-based layouts for email client compatibility
• Automatic plain-text fallback generation from HTML
• MailSpoof test disclaimer appended to both HTML and text parts

Audit Logging

Every test is logged as structured JSON in ~/.mailspoof/audit.log. View recent activity with mailspoof logs and export for compliance documentation.

• Structured JSON log format
• Timestamp, target, and result tracking
• Configurable line count with --lines
• Export to CSV or JSON for compliance

CLI Shortcuts & Help

MailSpoof provides quick aliases and help flags to speed up your workflow without memorizing every command.

• mailspoof -t — alias for mailspoof create
• mailspoof -h or --help — display the help banner
• mailspoof -v — print the current version
• mailspoof start --server-only — launch the SMTP server without entering interactive mode
• Every sent email includes an automatic test disclaimer footer for transparency

Clean Uninstall

Remove every trace of MailSpoof with mailspoof uninstall. Cleans system wrappers, project directories, venvs, and configuration files with sudo support.

Auto-Update

Built-in update command pulls the latest version from Git and re-runs the installer. Stay current with security fixes and new templates effortlessly.

HTTP Tracking Server New in v1.2.0

MailSpoof runs a concurrent multi-threaded HTTP Tracking Server on port 8080 alongside the SMTP server. Track who opened your simulated phishing emails in real-time.

• Automatic 1x1 tracking pixel injection into HTML templates
• Real-time open event logging to ~/.mailspoof/tracking.log
• View live hits directly in your terminal console
• Click tracking support for link engagement analysis

Bulk CSV Targeting New in v1.2.0

Pass a CSV file of target email addresses to send simulations to an entire department or organization with a single command. No scripting required.

• mailspoof test 1 --target-list employees.csv --profile gmail
• Accepts any CSV with email addresses in the first column
• Each target gets its own delivery attempt with independent logging
• Works with both test and custom commands

Attachment Payloads New in v1.2.0

Attach real files to your simulated phishing emails to test corporate email gateways, spam filters, and endpoint security against malicious attachment scenarios.

• mailspoof test 47 target@company.com --attach HR_Policy.pdf --attach Invoice.docx
• Attach multiple files using repeated --attach flags
• Tests how security appliances handle PDF, DOCX, ZIP, and other file types
• Works with both test and custom commands

Docker Deployment New in v1.2.0

Deploy MailSpoof instantly on any cloud VPS or server with the included Dockerfile and docker-compose.yml. No dependency installation required.

• Single command deployment: docker-compose up -d
• SMTP server and HTTP Tracking Server both containerized
• Volumes bound to persist audit logs and custom templates across restarts
• Ideal for red team infrastructure and remote assessments

Advanced Header Injection New in v1.2.0

Inject custom email headers for advanced spoofing scenarios. Control the Reply-To address and X-Mailer header to simulate specific email clients or bypass header-based filters.

• --reply-to attacker@evil.com — override the reply destination
• --x-mailer "Microsoft Outlook 16.0" — spoof the sending client
• Works with both test and custom commands
• All injected headers are sanitized to prevent CRLF injection