spf

README

Go SPF Validator

• Implemented RFC7208
• Supports Golang 1.18+
• WIP: Add more tests

Documentation

Index

• type CheckError
  • func NewCheckError(result Result, message string) *CheckError
  • func WrapCheckError(err error, result Result, message string) *CheckError
  • func (e *CheckError) Error() string
  • func (e *CheckError) Unwrap() error
• type DNSResolver
• type LimitResolver
  • func NewLimitResolver(dns DNSResolver, limit int) *LimitResolver
  • func (r *LimitResolver) LookupAddr(ctx context.Context, addr string) ([]string, error)
  • func (r *LimitResolver) LookupMX(ctx context.Context, name string) ([]*net.MX, error)
  • func (r *LimitResolver) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
  • func (r *LimitResolver) LookupTXT(ctx context.Context, name string) ([]string, error)
• type Qualifier
• type Result
• type Verifier
  • func NewVerifier(sender string, ip netip.Addr, helloDomain string) *Verifier
  • func (s *Verifier) SetLogger(logger *log.Logger)
  • func (s *Verifier) SetResolver(resolver DNSResolver)
  • func (s *Verifier) SetTimeout(t time.Duration)
  • func (s *Verifier) Test(ctx context.Context) (Result, error)

Types

type CheckError

type CheckError struct {
	// contains filtered or unexported fields
}

CheckError is an error type for mechanisms checking failures. If it returns an exception, mechanism processing ends and the exception value is returned. If it matches, processing ends and the qualifier value is returned as the result of that record. If it does not match, processing continues with the next mechanism.

func NewCheckError

func NewCheckError(result Result, message string) *CheckError

func WrapCheckError

func WrapCheckError(err error, result Result, message string) *CheckError

func (*CheckError) Error

func (e *CheckError) Error() string

func (*CheckError) Unwrap

func (e *CheckError) Unwrap() error

type DNSResolver

type DNSResolver interface {
	// LookupTXT returns all TXT records for the given domain.
	LookupTXT(ctx context.Context, name string) ([]string, error)

	// LookupNetIP returns all IP addresses of the given host.
	// If network is "ip", IPv6 and IPv4 addresses are returned.
	// If network is "ip4", only IPv4 addresses are returned.
	// If network is "ip6", only IPv6 addresses are returned.
	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)

	// LookupMX returns all MX records (host and priority) for a domain.
	LookupMX(ctx context.Context, name string) ([]*net.MX, error)

	// LookupAddr returns the PTR records (domain) for an IP address.
	LookupAddr(ctx context.Context, addr string) ([]string, error)
}

type LimitResolver

type LimitResolver struct {
	Limit int32
	// contains filtered or unexported fields
}

LimitResolver is a DNSResolver that limits the number of DNS queries. If this limit is exceeded return ResultPermError. ref: https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4 todo: implement "void lookups" limit

func NewLimitResolver

func NewLimitResolver(dns DNSResolver, limit int) *LimitResolver

func (*LimitResolver) LookupAddr

func (r *LimitResolver) LookupAddr(ctx context.Context, addr string) ([]string, error)

func (*LimitResolver) LookupMX

func (r *LimitResolver) LookupMX(ctx context.Context, name string) ([]*net.MX, error)

func (*LimitResolver) LookupNetIP

func (r *LimitResolver) LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)

func (*LimitResolver) LookupTXT

func (r *LimitResolver) LookupTXT(ctx context.Context, name string) ([]string, error)

type Qualifier

type Qualifier byte

Qualifier for SPF DNS record's directive https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.2

const (
	QualifierPass     Qualifier = '+'
	QualifierFail     Qualifier = '-'
	QualifierSoftFail Qualifier = '~'
	QualifierNeutral  Qualifier = '?'
)

type Result

type Result string

Result of SPF check https://datatracker.ietf.org/doc/html/rfc7208#section-8

const (
	// ResultNone the verifier has no information at all about the authorization
	ResultNone Result = "none"

	// ResultNeutral no definite assertion about the client
	// although a policy for the identity was discovered
	ResultNeutral Result = "neutral"

	// ResultPass the client is authorized
	// to inject mail with the given identity
	ResultPass Result = "pass"

	// ResultFail the client is NOT authorized
	// to use the domain in the given identity
	ResultFail Result = "fail"

	// ResultSoftFail the host is not authorized
	// but is not willing to make a strong policy statement
	ResultSoftFail Result = "softfail"

	// ResultTempError the verifier encountered a transient (generally DNS) error while performing the check
	ResultTempError Result = "temperror"

	// ResultPermError the domain's published records could not be correctly interpreted
	ResultPermError Result = "permerror"
)

type Verifier

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier for SPF Version 1

func NewVerifier

func NewVerifier(sender string, ip netip.Addr, helloDomain string) *Verifier

NewVerifier creates a new SPF Verifier sender is the email address of the sender (we don't check if it's valid) ip is the remote IP address of current connection helloDomain is the domain of the SMTP HELO command (only used for %{h} macro)

func (*Verifier) SetLogger

func (s *Verifier) SetLogger(logger *log.Logger)

func (*Verifier) SetResolver

func (s *Verifier) SetResolver(resolver DNSResolver)

func (*Verifier) SetTimeout

func (s *Verifier) SetTimeout(t time.Duration)

func (*Verifier) Test

func (s *Verifier) Test(ctx context.Context) (Result, error)