trailofbits / spf-query Goto Github PK

Ruby SPF Parser

License: MIT License

Ruby 100.00%

spf-query's Introduction

spf-query

The spf-query library searches the SPF records for a host. We assume the host uses standard spf 'selectors', and also check if they use their own 'selector'.

Features

Queries and parses SPF records.
Supports querying both TXT and SPF records.

Examples

require 'spf/query'

SPF::Query::Record.query('twitter.com')
# => #<SPF::Query::Record: v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 ip4:8.25.194.0/23 ip4:8.25.196.0/23 ip4:204.92.114.203 ip4:204.92.114.204/31 ip4:107.20.52.15 ip4:23.21.83.90 include:_spf.google.com include:_thirdparty.twitter.com -all>

SPF::Query::Record.parse("v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 ip4:8.25.194.0/23 ip4:8.25.196.0/23 ip4:204.92.114.203 ip4:204.92.114.204/31 ip4:107.20.52.15 ip4:23.21.83.90 include:_spf.google.com include:_thirdparty.twitter.com -all")
# => #<SPF::Query::Record: v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 ip4:8.25.194.0/23 ip4:8.25.196.0/23 ip4:204.92.114.203 ip4:204.92.114.204/31 ip4:107.20.52.15 ip4:23.21.83.90 include:_spf.google.com include:_thirdparty.twitter.com -all>

Synopsis

Query a domain:

spf-query google.com
____________________________
SPF record search for google.com
  - found SPF record for google.com at google.com:
  v=spf1 include:_spf.google.com ip4:216.73.93.70/31 ip4:216.73.93.72/31 ~all
____________________________

Query multiple domains:

spf-query trailofbits.com facebook.com yahoo.com
____________________________
SPF record search for trailofbits.com
  - found SPF record for trailofbits.com at trailofbits.com:
  v=spf1 include:_spf.google.com ~all
____________________________

____________________________
SPF record search for facebook.com
  - found SPF record for facebook.com at facebook.com:
  v=spf1 redirect=_spf.facebook.com
____________________________

____________________________
SPF record search for yahoo.com
  - found SPF record for yahoo.com at yahoo.com:
  v=spf1 redirect=_spf.mail.yahoo.com
____________________________

Requirements

ruby >= 1.9.1
parslet ~> 1.0

Install

$ gem install spf-query

License

See the {file:LICENSE.txt} file.

spf-query's People

Contributors

Stargazers

Watchers

Forkers

thiago-sydow chrismear amenezes evserykh mrmugiwara powerticmkt willemnviljoen planio-gmbh geetfun 5l1v3r1 luizeof stjordanis rjkaes amplemarket

spf-query's Issues

Add a full parser

Completely parse the SPF record into structured data.

SPF record type discontinued

Heys guys,

First of all, thank you for this incredible gem. It saved a lot of our time.

I've noticed that spf-query checks for SPF type records in https://github.com/trailofbits/spf-query/blob/master/lib/spf/query/query.rb#L23.

Since SPF record type was discontinued at RFC 7208, I think would a great idea to remove this verification or provide an alternative that allows us to skip it.

that make sense?

Configurable DNS servers

It would be nice to have configurable DNS servers. Unfortunately I'm not a ruby dev but looking at the code it should be fairly easy (famous last words)!

👍

Do not silently use _spf.DOMAIN.EXT

Since f838afb, the gem prioritizes a query to _spf.DOMAIN.EXT instead of using a query to the requested domain itself. This produces invalid results in case a domain publishes SPF records on both _spf.DOMAIN.EXT as well as DOMAIN.EXT.

In general, the only valid SPF record for a domain is in the TXT record of the domain itself. Nowhere in the spec (as far as I'm aware) does it specify that the _spf.DOMAIN.EXT record should be used in preference (or is even valid without explicit rules) rather than the record of the domain itself. Per the RFC, if _spf.DOMAIN.EXT is to be used, it has to be referenced on the domain itself via e.g. an include or redirect rule.

Thus, the automatic check for _spf.#{domain} in SPF::Query.query should preferably be removed completely there since it produced incorrect results for some domain. It even contradicts the examples from the README.md for e.g. facebook.com.

If it is not possible to remove this check for any reason, it should at least be de-prioritized from the check of the passed domain itself and controlled via a flag.

I'd be happy to provide a pull request to remove or deprioritize this check for _spf.DOMAIN.EXT.

Parsing issue for a and mx mechinism

I've noticed an issue when parsing a particular record. In my client's DNS his current SPF record is (with blanked out IP):

v=spf1 a mx ip4:0.0.0.0 ~all

But for some reason spf-query is returning the following:

SPF record search for *******
  - found SPF record for *******
    v=spf1
    a:
    mx:
    ip4:0.0.0.0
    ~all

It appears to be adding a semi colon after the a and mx parts, which is actually an invalid record!