n8n Domain Security Node

A comprehensive n8n community node for domain security assessment, designed for Managed Service Providers (MSPs) and IT security consultants.

Overview

This node provides automated domain security validation covering email authentication (SPF, DKIM, DMARC), DNS infrastructure security, transport security (MTA-STS, TLS-RPT), and brand indicators (BIMI). Scoring rules are JSON-configurable and executed by a rules engine, producing transparent per-section scores and a weighted overall score.

Operations

Features

Email Authentication Validation (JSON Rules)

• SPF: Syntax validation, -all vs ~all distinction, +all detection, multiple-record detection, lookup-limit guidance, include-chain traversal, overly broad IP range detection (prefix ≤ /16 for IPv4, ≤ /32 for IPv6), void lookup tracking (RFC 7208 §4.6.4) (rules at nodes/DomainSecurity/rules/spf.json)
• DKIM: Common + provider-specific selector discovery, key strength validation, revoked/test-mode key detection (rules at nodes/DomainSecurity/rules/dkim.json)
• DMARC: Policy analysis, alignment checks, reporting endpoint validation, multiple-record detection, 25-rule scoring (rules at nodes/DomainSecurity/rules/dmarc.json)

DNS Infrastructure Security

• CAA Validation: issue, issuewild, and iodef tag checks
• Open Resolver Detection: Recursion availability testing
• Zone Transfer (AXFR) Testing: TCP-based AXFR queries against each nameserver
• DNSSEC: DS/DNSKEY record detection plus chain validation via Cloudflare DoH (AD bit)
• MX Validation: Presence, priority ordering, duplicate priority detection, host reachability, null MX (RFC 7505)

Transport Security

• MTA-STS Policy Discovery (RFC 8461): TXT record lookup, HTTPS policy fetch, MX coverage validation
• TLS-RPT Configuration (RFC 8460): Reporting endpoint validation (mailto and https)

Brand Indicators

• BIMI Validation (RFC 8553): Record parsing, logo reachability check, SVG Tiny 1.2 profile validation (version, baseProfile, namespace), VMC detection

Domain Intelligence

• DNS Hosting Info: Authoritative NS, SOA, provider guess with confidence and evidence (NS patterns, SOA mname, IP RDAP orgs)
• WHOIS/RDAP: Domain registration data via whoiser with automatic node-rdap fallback; computes registrationDate, domainAgeYears, isRecentlyRegistered
• DNSBL/RBL Reputation: Queries MX host IPs against Spamhaus ZEN (IP), Spamhaus DBL (domain), and Barracuda BRBL; decodes return codes to human-readable reasons

Scoring

Weighted Overall Score (0-100)

The audit operation computes a weighted overall score:

Risk Levels

JSON Rules Engine

Rules are defined in nodes/DomainSecurity/rules/*.json and executed via json-rules-engine:

• DMARC: 25 rules, max 104 points (policy strength, alignment, reporting, TTL, multiple-record detection, etc.)
• SPF: 13 rules (v1.2.0), max 30 points (presence, syntax, -all vs ~all, +all detection, lookups, no PTR, multiple-record detection, broad IP ranges, void lookups)
• DKIM: 6 rules, max 45 points (selector found, passing selectors, warnings, key strength, revoked keys, test mode)

Edit the JSON files to adjust checks, points, or recommendations without code changes.

Output

Every operation returns a stable flat JSON envelope (DomainReport):

{
  "domain": "example.com",
  "timestamp": "2025-06-09T10:30:00Z",
  "operation": "audit",
  "version": "0.1.0",
  "overallScore": 82,
  "riskLevel": "medium",
  "checks": {
    "spf": { "status": "pass", "score": 90, "..." : "..." },
    "dkim": { "status": "pass", "score": 85, "..." : "..." },
    "dmarc": { "status": "pass", "score": 78, "..." : "..." },
    "dnssec": { "status": "warn", "..." : "..." },
    "caa": { "status": "pass", "..." : "..." },
    "mtaSts": { "status": "fail", "..." : "..." },
    "tlsRpt": { "status": "fail", "..." : "..." },
    "openResolver": { "status": "pass", "..." : "..." },
    "zoneTransfer": { "status": "pass", "..." : "..." }
  },
  "recommendations": ["Consider upgrading DMARC policy to reject", "..."],
  "summary": "Human-readable summary"
}

Fields in checks are absent (not null) when the operation doesn't include that check. Consumers can detect via if ('dmarc' in result.checks).

Output Modes

• Simple (default): Concise, logically grouped results
• Detailed: Full breakdown including raw DNS records, per-rule score breakdowns, and debug details

Configuration

Node Parameters

Credential Settings (optional)

Configured via the Domain Security API credential:

• Custom DNS Servers: Comma-separated IPs
• DNS Timeout: Milliseconds
• Retry Attempts: Number of retries for failed lookups
• Remote Rules URL: URL to fetch custom scoring rules
• DKIM Selectors: Extra selectors for auto-discovery

DNS Caching

Built-in per-process cache for TXT, NS, CAA, A/AAAA, MX lookups:

• Default TTL: 5 minutes (configurable via DNS_CACHE_TTL_MS, default 300000)
• Max entries: configurable via DNS_CACHE_MAX_ENTRIES (default 2000)

Requirements

• n8n: 1.0.0+
• Node.js: 18+

Dependencies

Testing

Unit Tests (no env vars required)

npm test -- --testPathPattern=unit

Integration Tests (live DNS)

Require environment variables:

DOMAINS=google.com DNS_SERVERS=8.8.8.8 npm test

Copy .env.example to .env and fill in the values, or pass them inline.

Target Audience

• Managed Service Providers (MSPs)
• IT Security Consultants
• DevOps & SecOps Teams
• Compliance Officers

Use Cases

• Client Onboarding: Automated security assessment during new client setup
• Quarterly Reviews: Regular security posture evaluation
• Incident Response: Quick domain security validation during security incidents
• Proactive Monitoring: Ongoing security configuration validation

Out of Scope

The following checks are intentionally not implemented due to infrastructure constraints or reliability concerns:

Contributing

We welcome:

• Bug reports and feature requests via GitHub Issues
• Use case scenarios from MSPs and security professionals
• Technical suggestions for implementation approaches
• Beta testing volunteers

License

This project is licensed under the MIT License - see the LICENSE file for details.

Links

• n8n Community: n8n.io/community
• Documentation: docs.n8n.io
• Issue Tracker: GitHub Issues