Auditing SPF and DMARC for a whole list of domains: p=none, ~all and the other ways a "pass" misleads you
Checking one domain's email authentication takes a minute in a terminal. Checking 300 customer, supplier or portfolio domains is where people script it, and where most scripts quietly report the wrong thing. Below are the checks that matter, with Node code using only the built-in dns module. Disclosure: SpellzCode, the brand behind this account, sells a tool that runs all of this in bulk (linked…
Auditing SPF and DMARC for multiple domains requires careful handling of the records found in TXT records. A script using Node's built-in dns module can efficiently check these records for each domain. Here are the key points to consider when auditing email authentication for a list of domains:
1. Read the records, not just their existence. SPF records live in a TXT record on the domain itself, while DMARC records are found in a TXT record under the _dmarc subdomain. The script handles TXT records split into 255-character chunks to ensure complete data extraction.
2. Two SPF records are the same as none. If a domain publishes two v=spf1 records, the system treats SPF as a permanent error. This often occurs after a mail-provider switch. Flag any SPF record count greater than one as broken rather than simply indicating the presence of SPF.
3. The policy is the last word in SPF records. There are four possible policies: -all (fail), ~all (softfail), ?all (neutral), and +all (pass-everyone). -all (fail) requires mail from anywhere not listed to be rejected. ~all (softfail) indicates mail likely not from the domain, usually delivered to spam or accepted. +all means anyone may send as the domain, treated as no SPF at all.
4. DMARC p=none means "watching," not "protected." It only requests reports without enforcing any actions. DMARC p=reject or p=quarantine with a percentage (pct) indicates enforcement. When auditing, sort domains into four categories: enforced, monitoring only, SPF only, and nothing.
5. Domains that send no mail should also be audited. A parked domain with no SPF or DMARC is easy to spoof. The recommended fix is to set a record with v=spf1 -all and p=reject, clearly indicating nothing sends from the domain. An example is example.com, which shows SPF fail and DMARC reject despite having no mail servers, demonstrating the correct and safe setup.
6. The mail's origin is indicated in the MX records. The mail exchanger (MX) records help identify the domain responsible for sending emails. Ensure the MX records align with the domains being audited for consistent and accurate results.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
