SPFJack
Email spoofing is dead, but misconfiguration never dies.
Purpose
This project is designed to take in domain names and review their SPF records for any issues that could result in email spoofing becoming possible.
The list of planned misconfigurations is as follows:
+all
mechanism existing.ip4
,ip6
, ora
mechanisms with hosts containing open SMTP relays.a
,mx
, andptr
mechanisms for domains that are not registered.exists
mechanisms existing. This can be a bit more complicated, see the SPF Domain spec and the_spf.salesforce.com
recordinclude
mechanisms for domains that are not registered. Recursively evaluate the SPF record for theinclude
specified domain.redirect
modifier for domains that are not registered. Recursively evaluate the SPF record for theredirect
specified domain.