Email security assessments often stop at a dashboard that says “DMARC is missing.” That tells you something, but it does not tell you what a recipient’s mail system will actually do when an unauthenticated message arrives with a forged From header.
Wraith is a command-line email security assessment tool for authorized testing. It inspects a domain’s email-authentication DNS records, builds clearly labeled proof-of-concept messages, and preserves the evidence: generated .eml files, JSON result records, and full SMTP transcripts. By default, the spoof command is a dry run — it resolves the recipient’s MX records and writes the message locally, but makes no SMTP connection and sends nothing. Live delivery to the target’s mail server only happens when you pass the --send flag.
The workflow is built for engagements where the deliverable has to survive a security review. Built-in scenarios cover common social-engineering shapes — CEO fraud, IT helpdesk, payment alerts — with an authorized-test notice appended to every generated message. A local SMTP relay listener supports lab-style testing without exposing an open relay to the internet. Reports aggregate test outcomes into JSON the operator can attach to the final write-up.
Wraith is honest about what it proves and what it does not. A 250 response at RCPT/DATA means the receiving server accepted the message at SMTP time, not that it reached the inbox. It does not validate DKIM alignment, test DMARC policy enforcement end-to-end, or guarantee delivery past downstream filtering. That narrow scope is the point: defensible evidence of what the mail path actually did, not a vendor scorecard.