SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are authorized to send email on behalf of a domain. To verify the SPF configuration for the domain example.com and identfiy its permitted IP ranges, follow these steps:

Step 1: Query the Domain's SPF Record

Use DNS lookup tools like dig or nslookup to retrieve the SPF record for the domain.

Using the dig Command

dig txt example.com

Using the nslookup Command

nslookup -type=txt example.com

Step 2: Identify the SPF Record

In the query results, look for the TXT record containing "v=spf1". For example:

example.com.  3600  IN  TXT  "v=spf1 include:spf.example.com ~all"

Step 3: Resolve Included Domains

The SPF record may include references to other domains. In this case, we need to query the included domain (spf.example.com) to retrieve its SPF configuration.

Query the Included Domain

dig txt spf.example.com

or

nslookup -type=txt spf.example.com

Step 4: Extract Authorized IP Ranges

From the SPF record of the included domain, identify all IP address ranges. For example:

spf.example.com.  3600  IN  TXT  "v=spf1 ip4:192.168.5.0/24 ip4:10.0.10.0/24 ip4:172.16.20.0/24 ~all"

Step 5: Document Authorized IPs

The following IP ranges are authorized to send email on behalf of the domain:

• 192.168.5.0/24
• 10.0.10.0/24
• 172.16.20.0/24

Practical Example

Querying the Primary Domain

dig txt example.com

Sample output:

; <<>> DiG 9.11.3-1ubuntu1.17-Ubuntu <<>> txt example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54321
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;example.com.                    IN      TXT

;; ANSWER SECTION:
example.com.         3600    IN      TXT     "v=spf1 include:spf.example.com ~all"

;; Query time: 45 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Nov 07 14:23:45 UTC 2023
;; MSG SIZE  rcvd: 98

Querying the Included SPF Domain

dig txt spf.example.com

Sample output:

; <<>> DiG 9.11.3-1ubuntu1.17-Ubuntu <<>> txt spf.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 87654
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;spf.example.com.                IN      TXT

;; ANSWER SECTION:
spf.example.com.     3600    IN      TXT     "v=spf1 ip4:192.168.5.0/24 ip4:10.0.10.0/24 ip4:172.16.20.0/24 ~all"

;; Query time: 52 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Nov 07 14:24:02 UTC 2023
;; MSG SIZE  rcvd: 140

Extracting IP Ranges

The SPF record contains the following authorized IP ranges:

ip4:192.168.5.0/24
ip4:10.0.10.0/24
ip4:172.16.20.0/24

Alternative Approach with Online Tools

Beyond command-line tools, you can use online SPF validators to check domain configurations. These tools provide visual representations of SPF records and their authorized IP ranges, making it easier to understand complex SPF setups.

Verifying SPF Configuration

After identifying the authorized IP ranges, you can verify that your email servers are properly configured by:

1. Checking that all outbound email servers appear in the authorized IP list
2. Ensuring no unauthorized servers are sending email on behalf of the domain
3. Regularly testing SPF validation using tools like mail-tester.com