SPF record has a duplicate or misplaced all mechanism

dig +short TXT example.com | grep spf1
dig +short TXT example.com @8.8.8.8 | grep spf1

# count how many "all" tokens the record actually has
dig +short TXT example.com | tr ' ' '\n' | grep -c '^[+\-~?]\?all$'
# a count greater than 1 confirms a duplicate all mechanism

# Broken record (two all tokens, one mid-record)
Type: TXT  Name: @  Value: "v=spf1 include:_spf.google.com ~all include:sendgrid.net -all"

# Corrected record (one all, placed last)
Type: TXT  Name: @  Value: "v=spf1 include:_spf.google.com include:sendgrid.net -all"

dig +short TXT example.com
# expect: "v=spf1 include:_spf.google.com include:sendgrid.net -all"

dig +short TXT example.com | tr ' ' '\n' | grep -c '^[+\-~?]\?all$'
# expect: 1

# also check with an online validator, e.g. MXToolbox SPF record check,
# and confirm it reports no "too many all mechanisms" or PermError warning

"""Detect a duplicate or misplaced all mechanism in an SPF record and
optionally repair it via Cloudflare. Safe by default. Set DRY_RUN=false
to let it write.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("spf_all_mechanism")

DNS_DOMAIN = os.environ.get("DNS_DOMAIN", "example.com")
CLOUDFLARE_API_TOKEN = os.environ.get("CLOUDFLARE_API_TOKEN", "")
CLOUDFLARE_ZONE_ID = os.environ.get("CLOUDFLARE_ZONE_ID", "")
DRY_RUN = os.environ.get("DRY_RUN", "true").lower() == "true"

CF_API = "https://api.cloudflare.com/client/v4"


def check_spf_all_mechanism(spf_record):
    """Pure decision function. No I/O.

    Input: raw SPF TXT record string, e.g.
      'v=spf1 include:_spf.google.com ~all include:sendgrid.net -all'

    Output: {
      'ok': bool,
      'all_count': int,
      'all_position_ok': bool,   # True if the (first) all-token is the last token
      'unreachable_tokens': list[str],  # tokens after the first all-token
      'issue': str | None        # 'duplicate_all' | 'all_not_last' | None
    }
    """
    tokens = spf_record.strip().split()
    if tokens and tokens[0].lower() == "v=spf1":
        tokens = tokens[1:]

    all_indexes = [i for i, t in enumerate(tokens) if t.lstrip("+-~?").lower() == "all"]
    all_count = len(all_indexes)

    if all_count == 0:
        return {
            "ok": False,
            "all_count": 0,
            "all_position_ok": False,
            "unreachable_tokens": [],
            "issue": "all_not_last",
        }

    first_all_index = all_indexes[0]
    all_position_ok = first_all_index == len(tokens) - 1
    unreachable_tokens = tokens[first_all_index + 1:]

    issue = None
    if all_count > 1:
        issue = "duplicate_all"
    elif not all_position_ok:
        issue = "all_not_last"

    return {
        "ok": issue is None,
        "all_count": all_count,
        "all_position_ok": all_position_ok,
        "unreachable_tokens": unreachable_tokens,
        "issue": issue,
    }


def rebuild_spf_record(spf_record, qualifier="-"):
    """Rebuild a corrected record: dedupe/move all to the end with the chosen qualifier."""
    tokens = spf_record.strip().split()
    prefix = []
    if tokens and tokens[0].lower() == "v=spf1":
        prefix = [tokens[0]]
        tokens = tokens[1:]
    else:
        prefix = ["v=spf1"]

    kept = [t for t in tokens if t.lstrip("+-~?").lower() != "all"]
    return " ".join(prefix + kept + [f"{qualifier}all"])


def fetch_spf_record(domain):
    """Query TXT records and return the one starting with v=spf1. Requires network."""
    import dns.resolver

    resolver = dns.resolver.Resolver()
    answer = resolver.resolve(domain, "TXT")
    for rdata in answer:
        text = b"".join(rdata.strings).decode("utf-8", "ignore")
        if text.lower().startswith("v=spf1"):
            return text
    return None


def find_spf_record_id(domain):
    """Find the SPF TXT record via the Cloudflare API."""
    import requests

    headers = {"Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}"}
    url = f"{CF_API}/zones/{CLOUDFLARE_ZONE_ID}/dns_records"
    r = requests.get(url, headers=headers, params={"type": "TXT", "name": domain}, timeout=30)
    r.raise_for_status()
    for record in r.json().get("result", []):
        if record.get("content", "").lower().startswith("v=spf1") or \
           record.get("content", "").lower().startswith('"v=spf1'):
            return record["id"]
    return None


def replace_spf_record(domain, record_id, corrected_content):
    """Replace the malformed SPF TXT record with the corrected content."""
    import requests

    headers = {"Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}", "Content-Type": "application/json"}
    url = f"{CF_API}/zones/{CLOUDFLARE_ZONE_ID}/dns_records/{record_id}"

    if DRY_RUN:
        log.info("[dry run] would update TXT record %s at %s to: %s", record_id, domain, corrected_content)
        return

    requests.patch(
        url, headers=headers,
        json={"type": "TXT", "name": domain, "content": corrected_content},
        timeout=30,
    ).raise_for_status()
    log.info("Updated SPF record for %s", domain)


def run():
    spf_record = fetch_spf_record(DNS_DOMAIN)
    if not spf_record:
        log.warning("No v=spf1 TXT record found for %s", DNS_DOMAIN)
        return

    result = check_spf_all_mechanism(spf_record)
    log.info("SPF for %s: %s", DNS_DOMAIN, result)

    if result["ok"]:
        log.info("Nothing to repair.")
        return

    corrected = rebuild_spf_record(spf_record, qualifier="-")
    log.info("Proposed corrected record: %s", corrected)

    if not (CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID):
        log.warning("Issue found but no Cloudflare credentials set. Skipping repair.")
        return

    record_id = find_spf_record_id(DNS_DOMAIN)
    if not record_id:
        log.warning("Could not find the SPF TXT record via the Cloudflare API.")
        return

    replace_spf_record(DNS_DOMAIN, record_id, corrected)


if __name__ == "__main__":
    run()

/**
 * Detect a duplicate or misplaced all mechanism in an SPF record and
 * optionally repair it via Cloudflare. Safe by default. Set DRY_RUN=false
 * to let it write.
 */
import { pathToFileURL } from "node:url";

const DNS_DOMAIN = process.env.DNS_DOMAIN || "example.com";
const CLOUDFLARE_API_TOKEN = process.env.CLOUDFLARE_API_TOKEN || "";
const CLOUDFLARE_ZONE_ID = process.env.CLOUDFLARE_ZONE_ID || "";
const DRY_RUN = (process.env.DRY_RUN || "true").toLowerCase() === "true";
const CF_API = "https://api.cloudflare.com/client/v4";

/**
 * Pure decision function. No I/O.
 *
 * Input: raw SPF TXT record string, e.g.
 *   'v=spf1 include:_spf.google.com ~all include:sendgrid.net -all'
 *
 * Output: {
 *   ok: boolean,
 *   allCount: number,
 *   allPositionOk: boolean,     // true if the (first) all-token is the last token
 *   unreachableTokens: string[],// tokens after the first all-token
 *   issue: string | null        // 'duplicate_all' | 'all_not_last' | null
 * }
 */
export function checkSpfAllMechanism(spfRecord) {
  let tokens = spfRecord.trim().split(/\s+/);
  if (tokens.length && tokens[0].toLowerCase() === "v=spf1") {
    tokens = tokens.slice(1);
  }

  const allIndexes = [];
  tokens.forEach((t, i) => {
    if (t.replace(/^[+\-~?]/, "").toLowerCase() === "all") allIndexes.push(i);
  });
  const allCount = allIndexes.length;

  if (allCount === 0) {
    return { ok: false, allCount: 0, allPositionOk: false, unreachableTokens: [], issue: "all_not_last" };
  }

  const firstAllIndex = allIndexes[0];
  const allPositionOk = firstAllIndex === tokens.length - 1;
  const unreachableTokens = tokens.slice(firstAllIndex + 1);

  let issue = null;
  if (allCount > 1) issue = "duplicate_all";
  else if (!allPositionOk) issue = "all_not_last";

  return { ok: issue === null, allCount, allPositionOk, unreachableTokens, issue };
}

/** Rebuild a corrected record: dedupe/move all to the end with the chosen qualifier. */
export function rebuildSpfRecord(spfRecord, qualifier = "-") {
  let tokens = spfRecord.trim().split(/\s+/);
  let prefix = ["v=spf1"];
  if (tokens.length && tokens[0].toLowerCase() === "v=spf1") {
    prefix = [tokens[0]];
    tokens = tokens.slice(1);
  }
  const kept = tokens.filter((t) => t.replace(/^[+\-~?]/, "").toLowerCase() !== "all");
  return [...prefix, ...kept, `${qualifier}all`].join(" ");
}

/** Query TXT records and return the one starting with v=spf1. Requires network. */
async function fetchSpfRecord(domain) {
  const dns = await import("node:dns/promises");
  const records = await dns.resolveTxt(domain);
  for (const chunks of records) {
    const text = chunks.join("");
    if (text.toLowerCase().startsWith("v=spf1")) return text;
  }
  return null;
}

/** Find the SPF TXT record via the Cloudflare API. */
async function findSpfRecordId(domain) {
  const url = `${CF_API}/zones/${CLOUDFLARE_ZONE_ID}/dns_records?type=TXT&name=${domain}`;
  const res = await fetch(url, { headers: { Authorization: `Bearer ${CLOUDFLARE_API_TOKEN}` } });
  if (!res.ok) throw new Error(`Cloudflare list failed: ${res.status}`);
  const body = await res.json();
  for (const record of body.result || []) {
    const content = (record.content || "").toLowerCase();
    if (content.startsWith("v=spf1") || content.startsWith('"v=spf1')) return record.id;
  }
  return null;
}

/** Replace the malformed SPF TXT record with the corrected content. */
async function replaceSpfRecord(domain, recordId, correctedContent) {
  const headers = {
    Authorization: `Bearer ${CLOUDFLARE_API_TOKEN}`,
    "Content-Type": "application/json",
  };
  const url = `${CF_API}/zones/${CLOUDFLARE_ZONE_ID}/dns_records/${recordId}`;

  if (DRY_RUN) {
    console.log(`[dry run] would update TXT record ${recordId} at ${domain} to: ${correctedContent}`);
    return;
  }

  const res = await fetch(url, {
    method: "PATCH",
    headers,
    body: JSON.stringify({ type: "TXT", name: domain, content: correctedContent }),
  });
  if (!res.ok) throw new Error(`Cloudflare update failed: ${res.status}`);
  console.log(`Updated SPF record for ${domain}`);
}

async function run() {
  const spfRecord = await fetchSpfRecord(DNS_DOMAIN);
  if (!spfRecord) {
    console.warn(`No v=spf1 TXT record found for ${DNS_DOMAIN}`);
    return;
  }

  const result = checkSpfAllMechanism(spfRecord);
  console.log(`SPF for ${DNS_DOMAIN}:`, result);

  if (result.ok) {
    console.log("Nothing to repair.");
    return;
  }

  const corrected = rebuildSpfRecord(spfRecord, "-");
  console.log(`Proposed corrected record: ${corrected}`);

  if (!(CLOUDFLARE_API_TOKEN && CLOUDFLARE_ZONE_ID)) {
    console.warn("Issue found but no Cloudflare credentials set. Skipping repair.");
    return;
  }

  const recordId = await findSpfRecordId(DNS_DOMAIN);
  if (!recordId) {
    console.warn("Could not find the SPF TXT record via the Cloudflare API.");
    return;
  }

  await replaceSpfRecord(DNS_DOMAIN, recordId, corrected);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => {
    console.error(err);
    process.exit(1);
  });
}

from spf_all_mechanism import check_spf_all_mechanism


def test_ok_when_single_all_last():
    record = "v=spf1 include:_spf.google.com include:sendgrid.net -all"
    result = check_spf_all_mechanism(record)
    assert result["ok"] is True
    assert result["all_count"] == 1
    assert result["all_position_ok"] is True
    assert result["issue"] is None


def test_duplicate_all_flagged():
    record = "v=spf1 include:_spf.google.com ~all include:sendgrid.net -all"
    result = check_spf_all_mechanism(record)
    assert result["ok"] is False
    assert result["all_count"] == 2
    assert result["issue"] == "duplicate_all"
    assert result["unreachable_tokens"] == ["include:sendgrid.net", "-all"]


def test_all_not_last_flagged():
    record = "v=spf1 all include:_spf.google.com -all"
    result = check_spf_all_mechanism(record)
    assert result["ok"] is False
    assert result["all_count"] == 2
    assert result["all_position_ok"] is False
    assert result["issue"] == "duplicate_all"


def test_two_all_tokens_anywhere():
    record = "v=spf1 a mx -all ~all"
    result = check_spf_all_mechanism(record)
    assert result["all_count"] == 2
    assert result["issue"] == "duplicate_all"

import { test } from "node:test";
import assert from "node:assert/strict";
import { checkSpfAllMechanism } from "./spf-all-mechanism.js";

test("ok when single all last", () => {
  const record = "v=spf1 include:_spf.google.com include:sendgrid.net -all";
  const result = checkSpfAllMechanism(record);
  assert.equal(result.ok, true);
  assert.equal(result.allCount, 1);
  assert.equal(result.allPositionOk, true);
  assert.equal(result.issue, null);
});

test("duplicate all flagged", () => {
  const record = "v=spf1 include:_spf.google.com ~all include:sendgrid.net -all";
  const result = checkSpfAllMechanism(record);
  assert.equal(result.ok, false);
  assert.equal(result.allCount, 2);
  assert.equal(result.issue, "duplicate_all");
  assert.deepEqual(result.unreachableTokens, ["include:sendgrid.net", "-all"]);
});

test("all not last flagged", () => {
  const record = "v=spf1 all include:_spf.google.com -all";
  const result = checkSpfAllMechanism(record);
  assert.equal(result.ok, false);
  assert.equal(result.allCount, 2);
  assert.equal(result.allPositionOk, false);
  assert.equal(result.issue, "duplicate_all");
});

test("two all tokens anywhere", () => {
  const record = "v=spf1 a mx -all ~all";
  const result = checkSpfAllMechanism(record);
  assert.equal(result.allCount, 2);
  assert.equal(result.issue, "duplicate_all");
});