; 允许域名的 MX 记录中的服务器发送
example.com. IN TXT "v=spf1 mx -all"

; 允许域名的 A 记录中的服务器发送
example.com. IN TXT "v=spf1 a -all"

; 允许 MX 和 A 记录中的服务器发送
example.com. IN TXT "v=spf1 mx a -all"

; 只允许一台服务器发送
example.com. IN TXT "v=spf1 ip4:203.0.113.10 -all"

; 允许多台服务器发送
example.com. IN TXT "v=spf1 ip4:203.0.113.10 ip4:203.0.113.11 ip4:203.0.113.12 -all"

; 允许自己的服务器和 Google Workspace
example.com. IN TXT "v=spf1 mx a include:_spf.google.com -all"

; 允许 MX、特定 IP、第三方服务
example.com. IN TXT "v=spf1 mx ip4:203.0.113.0/24 include:_spf.google.com include:spf.protection.outlook.com -all"

# 安装 Python SPF 测试工具
pip install pyspf pydns

# 或使用在线工具
# https://www.kitterman.com/spf/validate.html

# 使用 dig 查询 SPF 记录
dig TXT example.com +short

# 使用 nslookup
nslookup -type=TXT example.com

# 使用 Python 验证 SPF
python3 -c "
import spf
result, explanation = spf.check2(i='203.0.113.10', s='[email protected]', h='mail.example.com')
print(f'SPF 结果: {result}')
print(f'解释: {explanation}')
"

#!/bin/bash
# spf-check.sh — SPF 记录检查脚本

DOMAIN="$1"

if [ -z "$DOMAIN" ]; then
    echo "用法: $0 <域名>"
    exit 1
fi

echo "=== SPF 记录检查: $DOMAIN ==="

# 1. 查询 SPF 记录
echo "[1/4] 查询 SPF TXT 记录..."
SPF_RECORD=$(dig +short TXT $DOMAIN | grep "v=spf1")

if [ -z "$SPF_RECORD" ]; then
    echo "  ❌ 未找到 SPF 记录"
    exit 1
else
    echo "  ✅ SPF 记录: $SPF_RECORD"
fi

# 2. 检查 SPF 版本
echo "[2/4] 检查 SPF 版本..."
if echo "$SPF_RECORD" | grep -q "^v=spf1"; then
    echo "  ✅ SPF 版本正确: v=spf1"
else
    echo "  ❌ SPF 版本格式错误"
fi

# 3. 检查默认策略
echo "[3/4] 检查默认策略..."
if echo "$SPF_RECORD" | grep -q "\-all"; then
    echo "  ✅ 默认策略: -all (Fail，推荐)"
elif echo "$SPF_RECORD" | grep -q "~all"; then
    echo "  ⚠️ 默认策略: ~all (SoftFail，建议使用 -all)"
elif echo "$SPF_RECORD" | grep -q "?all"; then
    echo "  ⚠️ 默认策略: ?all (Neutral，不推荐)"
elif echo "$SPF_RECORD" | grep -q "+all"; then
    echo "  ❌ 默认策略: +all (Pass，危险！)"
else
    echo "  ⚠️ 未找到默认策略"
fi

# 4. 检查 DNS 查询次数
echo "[4/4] 估算 DNS 查询次数..."
QUERY_COUNT=0
for mech in include mx a; do
    COUNT=$(echo "$SPF_RECORD" | grep -o "$mech" | wc -l)
    if [ "$mech" = "mx" ]; then
        QUERY_COUNT=$((QUERY_COUNT + COUNT * 2))
    else
        QUERY_COUNT=$((QUERY_COUNT + COUNT))
    fi
done
echo "  估算查询次数: $QUERY_COUNT / 10"

if [ $QUERY_COUNT -gt 10 ]; then
    echo "  ❌ 超过 SPF 查询限制（10 次）"
else
    echo "  ✅ 查询次数在限制内"
fi

echo ""
echo "=== 检查完成 ==="

# 安装 postsrsd
sudo apt install -y postsrsd

# 配置 Postfix
sudo postconf -e "sender_canonical_maps = tcp:127.0.0.1:10001"
sudo postconf -e "sender_canonical_classes = envelope_sender"
sudo postconf -e "recipient_canonical_maps = tcp:127.0.0.1:10002"
sudo postconf -e "recipient_canonical_classes = envelope_recipient"

# 启动 postsrsd
sudo systemctl enable --now postsrsd

# 重新加载 Postfix
sudo systemctl reload postfix

# 安装 SPF 检查工具
sudo apt install -y postfix-policyd-spf-python

# /etc/postfix/main.cf
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    check_policy_service unix:private/policyd-spf,
    reject_rbl_client zen.spamhaus.org

# /etc/postfix/master.cf — 添加 SPF 策略服务
policyd-spf  unix  -       n       n       -       0       spawn
    user=policyd-spf argv=/usr/bin/policyd-spf

; 企业 SPF 记录
example.com. IN TXT "v=spf1 \
    ip4:203.0.113.10/32 \
    include:_spf.google.com \
    include:spf.protection.outlook.com \
    include:sendgrid.net \
    include:mail.zendesk.com \
    -all"

# 检查 SPF 记录
dig TXT example.com +short

# 检查发送服务器 IP
curl -s ifconfig.me

# 验证 IP 是否在 SPF 记录中
# 使用在线工具: https://www.kitterman.com/spf/validate.html