Detect Too Many SPF records

[spf-tools]

Detect Too Many SPF records

[jsarenik]

Thanks for this! I will have a look.

[jsarenik]

@itxpress please have a look at the patch and try to reproduce now. Thanks!

[itxpress]

That avoids the bogus DNS record attempt, but the scripts still continue on, referencing an spf10 DNS record that will never exist. Maybe a NULL test on the first jq execution would be a good place to break out...

Tested with ./despf.sh spforig.itxpress.biz | ./simplify.sh | ./mkblocks.sh itxpress.biz | ./mkzoneent.sh | ./cloudflare.sh

spforig.itxpress.biz record:

v=spf1 a:itxpress.biz/20 include:_spf.google.com include:servers.mcsv.net include:mail.zendesk.com include:secureserver.net ~all

[Removed all the IP lookup info - no errors to this point]

Too many DNS lookups!
jq: error (at :0): Cannot iterate over null (null)
Changing spf9.itxpress.biz with id ... OK
Changing spf8.itxpress.biz with id ... OK
Changing spf7.itxpress.biz with id ... OK
Changing spf6.itxpress.biz with id ... OK
Changing spf5.itxpress.biz with id ... OK
Changing spf4.itxpress.biz with id ... OK
Changing spf3.itxpress.biz with id ... OK
Changing spf2.itxpress.biz with id ... OK
Changing spf1.itxpress.biz with id ... OK
Changing itxpress.biz with id ... OK

Looking at the cloudflare tmp files:
spf9 will reference spf10

spf9.itxpress.biz. 1 IN TXT "v=spf1 ip4:65.55.88.0/24 ip4:66.102.0.0/20 ip4:66.246.252.57 ip4:66.249.80.0/20 ip4:66.98.158.77 ip4:68.178.213.0/24 ip4:68.178.232.0/24 ip4:68.178.252.0/24 ip4:68.232.128.0/19 ip4:68.233.77.16 ip4:69.64.33.132 include:spf10.itxpress.biz ~all"

My reason for bringing this up is if you have this setup to run via cron, your SPF could break if an ISP (cough GoDaddy cough) adds even MORE IPs to their SPF and you not realize it if you didn't catch the Too Many DNS Lookups error in a cron log email.

Ideally cloudflare.sh should quit with an error and no cloudflare update if you end up with > 10 SPF records, which would fail.