Documentation
¶
Overview ¶
Package spf decodes and statically analyses an SPF (Sender Policy Framework) DNS record (the `v=spf1 …` TXT record, RFC 7208) — the third leg of the email-authentication triad alongside DKIM and DMARC.
SPF declares which hosts may send mail for a domain, so it is a direct read on spoofability. The headline findings are objective and fall straight out of the record: the terminal `all` qualifier sets the default disposition (`+all` authorises the *entire internet* to send as the domain — critical; `?all` neutral — no protection; `~all` softfail; `-all` fail — strict), and the count of DNS-lookup-causing mechanisms feeds the RFC 7208 §4.6.4 limit of 10 (exceeding it is a permerror, which makes SPF fail open).
Scope: this is OFFLINE static analysis of a single record. The DNS-lookup count reported is the number of lookup-causing terms *in this record*; the RFC limit applies across the fully *resolved* tree (each `include`/`redirect` pulls more records), which requires live DNS — so the reported count is a lower bound, stated as such. The `all` qualifier and mechanism structure are fully determined offline.
Wrap-vs-native: native — RFC 7208 term tokenising, stdlib only, no new go.mod dependency. Pinned against live published records (google / paypal / github).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Mechanism ¶
type Mechanism struct {
// Qualifier is +, -, ~ or ? (default + when omitted).
Qualifier string `json:"qualifier"`
// Type is all / ip4 / ip6 / a / mx / ptr / exists / include.
Type string `json:"type"`
// Value is the part after ':' (domain / address / cidr), if any.
Value string `json:"value,omitempty"`
// CausesLookup is true for the mechanisms that count toward the RFC 7208
// 10-DNS-lookup limit (a, mx, ptr, exists, include).
CausesLookup bool `json:"causes_lookup,omitempty"`
}
Mechanism is one parsed SPF directive.
type Result ¶
type Result struct {
// Version is "spf1".
Version string `json:"version"`
// Mechanisms is the ordered directive list.
Mechanisms []Mechanism `json:"mechanisms"`
// Redirect is the redirect= modifier target, if present.
Redirect string `json:"redirect,omitempty"`
// Exp is the exp= explanation modifier target, if present.
Exp string `json:"exp,omitempty"`
// AllQualifier is the qualifier on the terminal `all` mechanism (+/-/~/?),
// or "" if the record has no `all`.
AllQualifier string `json:"all_qualifier,omitempty"`
// DirectLookups counts lookup-causing terms in THIS record (a/mx/ptr/
// exists/include + redirect) — a lower bound on the resolved-tree total.
DirectLookups int `json:"direct_lookups"`
// Warnings carries objective, RFC-anchored observations.
Warnings []string `json:"warnings,omitempty"`
// Note carries interpretation guidance.
Note string `json:"note,omitempty"`
}
Result is the decoded SPF record.
Source Files