id: spf-limit-lookup

info:
  name: SPF record DNS lookup limit
  author: theamanrawat
  severity: info
  description: |
    SPF (Sender Policy Framework) records that exceed the 10 DNS lookup limit was detected. SPF records with more than 10 DNS-based mechanisms may cause SPF authentication failures, leading to potential email delivery issues and spoofing risks.
  reference:
    - https://dmarcly.com/blog/spf-permerror-too-many-dns-lookups-when-spf-record-exceeds-10-dns-lookup-limit
  tags: dns,spf,discovery

dns:
  - name: "{{FQDN}}"
    type: TXT

    extractors:
      - type: regex
        name: spf_record
        regex:
          - 'v=spf1[^\"]*'
        internal: true

      - type: regex
        name: spf_record_limit
        part: spf_record
        regex:
          - '(?i)(include|all):?[^ ]*?'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - len(spf_record_limit)>10
# digest: 490a004630440220282ebc2f71637eb1a86c805b3a9ce3320f92c3166786c7443b1c0d956679e7ae02200d9d68abcbd794755dbf09da5c3e9ddb2d5705df94b360f9431249bc9e8f9bef:922c64590222798bb761d5b6d8e72950