# SPF Validator

Useful for mail operations, audits, and agent workflows that need deterministic SPF findings before changing DNS.

## Discovery

- Identifier: `spf.validate`
- Version: `v1`
- Category: DNS and email operations
- Status: `live`
- Access: `open`
- Human docs: https://dnsskills.md/skills/spf-validator
- Agent Markdown: https://dnsskills.md/skills/spf-validator.md
- OpenAPI: https://dnsskills.md/openapi.yaml
- Public GitHub mirror: https://github.com/easydns/dns-agent-skills
- Web UI: https://app.domainhelp.com/spf-validator

## Agent Invocation

Use the execution API endpoints below. Do not post to browser Web UI form routes; those routes are for humans and may require CSRF and reCAPTCHA.

- `POST https://app.domainhelp.com/api/tools/spf/validate`
  - Status: `live`
  - Response modes: `json`
- `POST https://app.domainhelp.com/api/tools/spf/evaluate`
  - Status: `live`
  - Response modes: `json`

## Input Contract

Provide a domain. Optional sender_ip adds sender simulation without requiring Mail From or HELO. Optional spf_record and dns_records can be supplied for deterministic offline analysis. The evaluate endpoint also accepts mail_from and helo.

## Output Contract

Returns parsed terms, recursive include/redirect traversal, DNS lookup and void lookup counts, sender simulation results when requested, and structured findings.

## Errors

Invalid domain, invalid sender IP, malformed SPF mechanisms, multiple SPF records, loop detection, or DNS lookup-limit findings.

## Auth And Limits

Anonymous JSON API for initial rollout. Browser form submissions use standard Laravel CSRF protection.

JSON API uses the standard API throttle. DNS traversal is bounded by SPF lookup limits and loop detection.

## Examples

### Requests

```text
POST /api/tools/spf/validate {"domain":"example.com"}
```

```text
POST /api/tools/spf/evaluate {"domain":"example.com","sender_ip":"192.0.2.10","mail_from":"sender@example.com"}
```

### Responses

```json
{"tool":"spf.validate","domain":"example.com","dns":{"lookup_count":2},"findings":[{"code":"SPF_RECORD_PARSED","severity":"Info"}]}
```

## FAQ

### Can agents avoid live DNS?

Yes. Provide spf_record and optional dns_records in the request to analyze a deterministic policy snapshot.

### Is this the same as the SPF Flattener?

No. The validator explains policy health and sender outcomes. The flattener produces a flattened SPF record for DNS publishing.

## Related Skills

- [SPF Flattener](https://dnsskills.md/skills/spf-flattener.md)
- [DNS Twister](https://dnsskills.md/skills/dns-twister.md)
- [What Is My Public IP](https://dnsskills.md/skills/what-is-my-public-ip.md)