The increasingly widespread use of SaaS email service providers such as Exchange Online, G-Suite, Amazon SES, SendGrid and others is a challenge for email administrators. To prevent emails to customers from ending up in the spam filter or not being accepted at all, a proper configuration of DMARC, DKIM and SPF is mandatory.
Especially with SPF, it is easy to simply add all the ‘include’ entries of the third-party providers. However, this can also backfire if, for example, the maximum number of DNS lookups (10) or the maximum length of a TXT DNS record (255) is exceeded. Especially with include the effects are not always directly visible, because many services themselves also use include to organize the IP ranges.
The overview of the involved services can be lost easily.
To query the current SPF DNS records, including all included services, I wrote the function Resolve-SPFRecord.
Function overview
Supported SPF directives and functions
- include
- mx
- a
- ip4 und ip6
- redirect
- Warning for too many
include entries
Not supported
Usage
For the query of the corresponding TXT records in the DNS only the paramater name is needed. The domain to be queried must be specified here, and the script does the rest.
Resolve-SPFRecord -Name domainname.tld
It is recommended to output the result with ‘Format-Table’ for better readability.
Resolve-SPFRecord -Name domainname.tld | ft
Alternative DNS server
Optionally, the Server parameter can be used. With this you change the DNS server to be queried. This can be helpful, for example, if you want to test the DNS changes directly on your own root name server shortly after the update, or if there are restrictions on which DNS server your client is allowed to query.
Download
The complete script is available for download here or can also be copied from the code block.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
function Resolve-SPFRecord {
[CmdletBinding()]
param (
# Domain Name
[Parameter(Mandatory = $true,
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true,
Position = 1)]
[string]$Name,
# DNS Server to use
[Parameter(Mandatory = $false,
ValueFromPipelineByPropertyName = $true,
Position = 2)]
[string]$Server = "1.1.1.1",
# If called nested provide a referrer to build valid objects
[Parameter(Mandatory = $false)]
[string]$Referrer
)
begin {
class SPFRecord {
[string] $SPFSourceDomain
[string] $IPAddress
[string] $Referrer
[string] $Qualifier
[bool] $Include
# Constructor: Creates a new SPFRecord object, with a specified IPAddress
SPFRecord ([string] $IPAddress) {
$this.IPAddress = $IPAddress
}
# Constructor: Creates a new SPFRecord object, with a specified IPAddress and DNSName
SPFRecord ([string] $IPAddress, [String] $DNSName) {
$this.IPAddress = $IPAddress
$this.SPFSourceDomain = $DNSName
}
# Constructor: Creates a new SPFRecord object, with a specified IPAddress and DNSName and
SPFRecord ([string] $IPAddress, [String] $DNSName, [String] $Qualifier) {
$this.IPAddress = $IPAddress
$this.SPFSourceDomain = $DNSName
$this.Qualifier = $Qualifier
}
}
}
process {
# Keep track of number of DNS queries
# DNS Lookup Limit = 10
# https://tools.ietf.org/html/rfc7208#section-4.6.4
# Query DNS Record
$DNSRecords = Resolve-DnsName -Server $Server -Name $Name -Type TXT
# Check SPF record
$SPFRecord = $DNSRecords | Where-Object { $_.Strings -match "^v=spf1" }
# Validate SPF record
$SPFCount = ($SPFRecord | Measure-Object).Count
if ( $SPFCount -eq 0) {
# If there is no error show an error
Write-Error "No SPF record found for `"$Name`""
}
elseif ( $SPFCount -ge 2 ) {
# Multiple DNS Records are not allowed
# https://tools.ietf.org/html/rfc7208#section-3.2
Write-Error "There is more than one SPF for domain `"$Name`""
}
else {
# Multiple Strings in a Single DNS Record
# https://tools.ietf.org/html/rfc7208#section-3.3
$SPFString = $SPFRecord.Strings -join ''
# Split the directives at the whitespace
$SPFDirectives = $SPFString -split " "
# Check for a redirect
if ( $SPFDirectives -match "redirect" ) {
$RedirectRecord = $SPFDirectives -match "redirect" -replace "redirect="
Write-Verbose "[REDIRECT]`t$RedirectRecord"
# Follow the include and resolve the include
Resolve-SPFRecord -Name "$RedirectRecord" -Server $Server -Referrer $Name
}
else {
# Extract the qualifier
$Qualifier = switch ( $SPFDirectives -match "^[+-?~]all$" -replace "all" ) {
"+" { "pass" }
"-" { "fail" }
"~" { "softfail" }
"?" { "neutral" }
}
$ReturnValues = foreach ($SPFDirective in $SPFDirectives) {
switch -Regex ($SPFDirective) {
"%[{%-_]" {
Write-Warning "[$_]`tMacros are not supported. For more information, see https://tools.ietf.org/html/rfc7208#section-7"
Continue
}
"^exp:.*$" {
Write-Warning "[$_]`tExplanation is not supported. For more information, see https://tools.ietf.org/html/rfc7208#section-6.2"
Continue
}
'^include:.*$' {
# Follow the include and resolve the include
Resolve-SPFRecord -Name ( $SPFDirective -replace "^include:" ) -Server $Server -Referrer $Name
}
'^ip[46]:.*$' {
Write-Verbose "[IP]`tSPF entry: $SPFDirective"
$SPFObject = [SPFRecord]::New( ($SPFDirective -replace "^ip[46]:"), $Name, $Qualifier)
if ( $PSBoundParameters.ContainsKey('Referrer') ) {
$SPFObject.Referrer = $Referrer
$SPFObject.Include = $true
}
$SPFObject
}
'^a:.*$' {
Write-Verbose "[A]`tSPF entry: $SPFDirective"
$DNSRecords = Resolve-DnsName -Server $Server -Name $Name -Type A
# Check SPF record
foreach ($IPAddress in ($DNSRecords.IPAddress) ) {
$SPFObject = [SPFRecord]::New( $IPAddress, ($SPFDirective -replace "^a:"), $Qualifier)
if ( $PSBoundParameters.ContainsKey('Referrer') ) {
$SPFObject.Referrer = $Referrer
$SPFObject.Include = $true
}
$SPFObject
}
}
'^mx:.*$' {
Write-Verbose "[MX]`tSPF entry: $SPFDirective"
$DNSRecords = Resolve-DnsName -Server $Server -Name $Name -Type MX
foreach ($MXRecords in ($DNSRecords.NameExchange) ) {
# Check SPF record
$DNSRecords = Resolve-DnsName -Server $Server -Name $MXRecords -Type A
foreach ($IPAddress in ($DNSRecords.IPAddress) ) {
$SPFObject = [SPFRecord]::New( $IPAddress, ($SPFDirective -replace "^mx:"), $Qualifier)
if ( $PSBoundParameters.ContainsKey('Referrer') ) {
$SPFObject.Referrer = $Referrer
$SPFObject.Include = $true
}
$SPFObject
}
}
}
Default {
Write-Warning "[$_]`t Unknown directive"
}
}
}
$DNSQuerySum = $ReturnValues | Select-Object -Unique SPFSourceDomain | Measure-Object | Select-Object -ExpandProperty Count
if ( $DNSQuerySum -gt 6) {
Write-Warning "Watch your includes!`nThe maximum number of DNS queries is 10 and you have already $DNSQuerySum.`nCheck https://tools.ietf.org/html/rfc7208#section-4.6.4"
}
if ( $DNSQuerySum -gt 10) {
Write-Error "Too many DNS queries made ($DNSQuerySum).`nMust not exceed 10 DNS queries.`nCheck https://tools.ietf.org/html/rfc7208#section-4.6.4"
}
$ReturnValues
}
}
}
end {
}
}
|
