SPF Validator

Input Contract

Provide a domain. Optional sender_ip adds sender simulation without requiring Mail From or HELO. Optional spf_record and dns_records can be supplied for deterministic offline analysis. The evaluate endpoint also accepts mail_from and helo.

Output Contract

Returns parsed terms, recursive include/redirect traversal, DNS lookup and void lookup counts, sender simulation results when requested, and structured findings.

Errors

Invalid domain, invalid sender IP, malformed SPF mechanisms, multiple SPF records, loop detection, or DNS lookup-limit findings.

Auth and Limits

Anonymous JSON API for initial rollout. Browser form submissions use standard Laravel CSRF protection.

JSON API uses the standard API throttle. DNS traversal is bounded by SPF lookup limits and loop detection.

Examples

Requests

POST /api/tools/spf/validate {"domain":"example.com"}

POST /api/tools/spf/evaluate {"domain":"example.com","sender_ip":"192.0.2.10","mail_from":"sender@example.com"}

Responses

{"tool":"spf.validate","domain":"example.com","dns":{"lookup_count":2},"findings":[{"code":"SPF_RECORD_PARSED","severity":"Info"}]}