id: dkim-record-detect

info:
  name: DKIM Record - Detection
  author: princechaddha
  severity: info
  description: |
    A DKIM (DomainKeys Identified Mail) TXT record was detected. DKIM is an email authentication method that allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.
  reference:
    - https://www.rfc-editor.org/rfc/rfc6376
    - https://dkim.org/
  metadata:
    max-request: 10
  tags: dns,dkim,email,discovery

dns:
  - name: "{{selector}}._domainkey.{{FQDN}}"
    type: TXT

    payloads:
      selector:
        - default
        - selector1
        - selector2
        - google
        - k1
        - s1
        - s2
        - dkim
        - mail
        - email
        - class
        - smtpapi
        - bfi
        - spop
        - spop1024
        - beta
        - domk
        - dk
        - ei
        - smtpout
        - sm
        - authsmtp
        - alpha
        - mesmtp
        - cm
        - prod
        - pm
        - gamma
        - dkrnt
        - dkimrnt
        - private
        - gmmailerd
        - pmta
        - x
        - selector
        - qcdkim
        - postfix
        - mikd
        - main
        - m
        - dk20050327
        - delta
        - yibm
        - wesmail
        - test
        - stigmate
        - squaremail
        - sitemail
        - sasl
        - sailthru
        - responsys
        - publickey
        - proddkim
        - mail-in
        - key
        - ED-DKIM
        - ebmailerd
        - Corporate
        - care
        - 0xdeadbeef
        - yousendit
        - www
        - tilprivate
        - testdk
        - snowcrash
        - smtpcomcustomers
        - smtpauth
        - smtp
        - sl
        - sharedpool
        - ses
        - server
        - scooby
        - scarlet
        - safe
        - s
        - pvt
        - primus
        - primary
        - postfix.private
        - outbound
        - originating
        - one
        - neomailout
        - mx
        - msa
        - monkey
        - mkt
        - mimi
        - mdaemon
        - mailrelay
        - mailjet
        - mail-dkim
        - mailo
        - mandrill
        - lists
        - iweb
        - iport
        - id
        - hubris
        - googleapps
        - global
        - gears
        - exim4u
        - exim
        - et
        - dyn
        - duh
        - dksel
        - dkimmail
        - corp
        - centralsmtp
        - ca
        - bfi
        - auth
        - allselector
        - zendesk1
        - dkim
        - proddkim
        - testdkim

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "v=DKIM1"
        case-insensitive: true

      - type: regex
        regex:
          - 'p=[A-Za-z0-9+/]{20,}'
        negative: false

    extractors:
      - type: regex
        regex:
          - "v=DKIM1(.+)"
# digest: 4a0a00473045022003cb8121b2cdd05984997bf21e4f8f65b0ff0f39c9ecbd2c60d08ddd2f6bb998022100b058c1170a760e1848bf27babc5c410c2f7955b29c84d28cc86425f22ddc9845:922c64590222798bb761d5b6d8e72950