vulkro-sf org mail

Audits OrgWideEmailAddress and EmailServicesAddress (SF-MAIL-001 / -002).

Email is a two-way surface in Salesforce. Outbound, an org-wide address open to every profile lets any user send as the brand mailbox. Inbound, an Email Services address routes external mail straight into an Apex handler, and those are routinely forgotten long after the use case ends.

Synopsis

vulkro-sf org mail --target-org <alias> [flags]

Flags

Flag	Type	Default	Description
--target-org, -o <alias>	string	(required)	Target org alias or username, as known to sf org login.
--format <fmt>	enum	table	Output format.
--verbose, -v	flag	off	Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins).

What gets read

• OrgWideEmailAddress: Id, Address, DisplayName, IsAllowAllProfiles, Purpose.
• EmailServicesAddress: Id, LocalPart, AddressDomain, FunctionId.

What gets reported

Rule	Severity	What fires
SF-MAIL-001	Medium	An org-wide address with "Allow All Profiles to Use this From Address" on, so any user can send Apex or workflow email as that address. A compromised or junior account can impersonate a trusted sender. Signal mail-org-wide-allow-all-profiles.
SF-MAIL-002	Medium	An Email Services address bound to a domain that is not Salesforce's own inbound infrastructure. Anything that domain accepts is routed into the org's Apex email handler. Signal mail-services-address-custom-domain.

Examples

vulkro-sf org mail --target-org my-prod

vulkro-sf org mail -o my-prod --format json > mail.json

Exit codes

• 0 - no findings.
• 1 - posture findings reported.
• 2 - error.

These follow the org command-family contract printed by vulkro-sf org --help.

Scope and honesty

The org is read locally through your own authenticated sf CLI login; nothing is sent anywhere. The audit reads email configuration rows only. It does not read mailboxes, does not read EmailMessage records, and does not send any mail.

Findings are static posture signals. SF-MAIL-002 reports that an inbound address exists on a non-Salesforce domain, not that the address is currently receiving hostile mail. A custom domain here is often legitimate: the rule surfaces it for review rather than condemning it. A run with no findings does not certify the org's email surface clean.

Where to go next

• vulkro-sf org report - the consolidated live-org posture report.
• vulkro-sf org audit-trail - who changed these settings and when.