generate_spf
Builds an SPF DNS record that authorizes specified senders and sets the policy for unauthorized mail.
Instructions
Build an SPF (Sender Policy Framework) record — the DNS TXT record that lists which servers may send mail for a domain. Pass the senders as mechanisms: include for a provider's own SPF (Google Workspace is _spf.google.com, Microsoft 365 is spf.protection.outlook.com, SendGrid is sendgrid.net), ip4/ip6 for your own servers, plus useMx/useA to authorise the domain's own MX or A records. The policy decides what receivers do with mail from anywhere else: 'fail' (-all, the production choice), 'softfail' (~all, for testing), 'neutral', or 'pass' (+all, which authorises the entire internet and should never be published). The reason to call this rather than write the string yourself: SPF is limited to ten DNS lookups when it is evaluated, and exceeding that is a PermError which receivers treat as the domain having no SPF at all. include, a, mx, exists and redirect each cost a lookup; ip4 and ip6 are free. Returns the record, the lookup count, whether either the lookup or 255-character limit is exceeded, warnings in plain language, and the DNS entry to publish. Use check_spf instead to read and validate the record a domain already publishes, and flatten_spf when an existing record is over the lookup limit and has to be reduced; use this to build a new record from scratch. Nothing is looked up or stored — this is computation only.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| useA | No | Authorise the domain's own A/AAAA records. Costs one DNS lookup. | |
| useMx | No | Authorise the domain's MX hosts. Costs one DNS lookup. | |
| policy | No | What receivers do with everything else: fail (-all) for production, softfail (~all) while testing. Defaults to fail. | |
| mechanisms | No | Senders to authorise, in the order they should appear in the record |