spf

README

go-spf

RFC 7208 compliant Go library for parsing and evaluating SPF records.

Requires go 1.23.x or later

Warning This is not a production grade library. it's a project to understand RFC 7208 specs. You might want to look at albertito/spf for a full production grade SPF library.

Installation

go get github.com/t0gun/go-spf

Usage

Checking a host

package main

import (
	"fmt"
	"net"

	"github.com/t0gun/go-spf"
)

func main() {
	ip := net.ParseIP("192.0.2.1")
	res, err := spf.CheckHost(ip, "example.com", "alice@example.com")
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Code)
}

Parsing a record

The parser lives in its own subpackage and can be used directly if you only need to read an SPF record.

import "github.com/t0gun/go-spf/parser"

rec, err := parser.Parse("v=spf1 ip4:203.0.113.0/24 -all")
if err != nil {
// handle parse error
}
fmt.Printf("%+v\n", rec)

Contributing

Please feel free to submit issues, fork the repository and send pull requests!

License

This project is licensed under the terms of the MIT license.

Documentation

Index

• Constants
• type CheckHostResult
  • func CheckHost(ip net.IP, domain, sender string) (CheckHostResult, error)
• type Checker
  • func NewChecker(r *dns.Resolver) *Checker
  • func (c *Checker) CheckHost(ctx context.Context, ip net.IP, domain, sender string) (CheckHostResult, error)
• type Result

Constants

const (
	MaxDNSLookups  = 10 // any mechanism that triggers DNS counts
	MaxVoidLookups = 2  // DNS look‑ups returning no usable data
)

Limits from RFC 7208 section 4.6.4.

Types

type CheckHostResult

type CheckHostResult struct {
	Code  Result
	Cause error
}

CheckHostResult contains the result code and optional cause returned by

func CheckHost

func CheckHost(ip net.IP, domain, sender string) (CheckHostResult, error)

CheckHost is a convenience wrapper around Checker.CheckHost for callers that do not require custom configuration.

type Checker

type Checker struct {
	Resolver       *dns.Resolver
	MaxLookups     int
	MaxVoidLookups int
	Lookups        int
	Voids          int
}

Checker implements a full RFC 7208–compliant SPF policy evaluator.

func NewChecker

func NewChecker(r *dns.Resolver) *Checker

NewChecker returns a Checker that uses the given TXTResolver.

func (*Checker) CheckHost

func (c *Checker) CheckHost(ctx context.Context, ip net.IP, domain, sender string) (CheckHostResult, error)

CheckHost implements the "check_host" algorithm from RFC 7208 section 4.6. The domain parameter is the name where SPF evaluation begins. Typically this is the EHLO hostname or the domain part of MAIL FROM. The sender parameter is the full MAIL FROM address ("<>" for bounces) and is used only for macro expansion.

type Result

type Result string

Result is the outcome of an SPF evaluation (RFC 7208 section 2.6).

const (
	None      Result = "none"
	Neutral   Result = "neutral"   // policy exists but gives no assertion
	Pass      Result = "pass"      // client is authorized
	Fail      Result = "fail"      // client is NOT authorized
	SoftFail  Result = "softfail"  // not authorized, but weak assertion
	TempError Result = "temperror" // transient DNS error
	PermError Result = "permerror" // perm error in record or >10 look‑ups
)