1
example.com.  300  IN  TXT  "v=spf1 ip4:203.0.113.0/24 include:_spf.example.net -all"

1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
2
  d=example.com; s=2026; t=1793000000;
3
  h=from:to:subject:date:message-id;
4
  bh=base64-of-body-hash;
5
  b=base64-of-signature

1
2026._domainkey.example.com.  300  IN  TXT
2
  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

1
_dmarc.example.com.  300  IN  TXT
2
  "v=DMARC1; p=quarantine; sp=reject; pct=100;
3
   rua=mailto:dmarc-reports@example.com;
4
   adkim=r; aspf=r"

1
From:            billing@example.com
2
MAIL FROM:       bounce@mailer.example.com
3
DKIM d=:         example.com
4
DMARC:           p=reject; aspf=r; adkim=r

1
import { Resolver } from "node:dns/promises";
2

3
const resolver = new Resolver();
4
resolver.setServers(["1.1.1.1", "8.8.8.8"]);
5

6
// 只有这些 term 在求值时触发 DNS 查询，计入 10 次上限
7
// 注意先去掉可选的限定符（+ - ~ ?），再匹配机制名
8
const QUERYING = /^(include:|a(?::|\/|$)|mx(?::|\/|$)|ptr(?::|$)|exists:|redirect=)/i;
9

10
function terms(record) {
11
  return record.replace(/^v=spf1\s*/i, "").trim().split(/\s+/).filter(Boolean);
12
}
13

14
function bare(term) {
15
  return term.replace(/^[+\-~?]/, "");
16
}
17

18
async function txt(name) {
19
  try {
20
    const rows = await resolver.resolveTxt(name);
21
    return rows.map((chunks) => chunks.join(""));
22
  } catch (err) {
23
    if (err.code === "ENOTFOUND" || err.code === "ENODATA") return [];
24
    throw err;
25
  }
26
}
27

28
async function walk(domain, depth = 0) {
29
  if (depth > 10) return { count: 0, errors: [`${domain}: include 嵌套过深`] };
30

31
  const records = (await txt(domain)).filter((r) => /^v=spf1(\s|$)/i.test(r));
32
  if (records.length === 0) {
33
    return { count: 0, errors: [`${domain}: 没有 SPF 记录（include 会得到 permerror）`] };
34
  }
35
  if (records.length > 1) {
36
    return { count: 0, errors: [`${domain}: 存在 ${records.length} 条 SPF 记录（permerror）`] };
37
  }
38

39
  let count = 0;
40
  const errors = [];
41
  const hasAll = terms(records[0]).some((t) => /^[+\-~?]?all$/i.test(t));
42

43
  for (const term of terms(records[0])) {
44
    const t = bare(term);
45
    if (!QUERYING.test(t)) continue;
46
    // 有 all 时 redirect 会被忽略，不参与求值
47
    if (hasAll && /^redirect=/i.test(t)) continue;
48
    count += 1;
49

50
    if (/^include:/i.test(t)) {
51
      const sub = await walk(t.slice("include:".length), depth + 1);
52
      count += sub.count;
53
      errors.push(...sub.errors);
54
    } else if (/^redirect=/i.test(t)) {
55
      const sub = await walk(t.slice("redirect=".length), depth + 1);
56
      count += sub.count;
57
      errors.push(...sub.errors);
58
    }
59
  }
60
  return { count, errors };
61
}
62

63
const domain = process.argv[2];
64
if (!domain) {
65
  console.error("用法: node spf-count.mjs <domain>");
66
  process.exit(2);
67
}
68

69
const result = await walk(domain);
70
console.log(`${domain}: ${result.count} 次 DNS 查询（上限 10）`);
71
for (const e of result.errors) console.log(`  ! ${e}`);
72
process.exit(result.count > 10 || result.errors.length > 0 ? 1 : 0);

1
import gzip
2
import sys
3
import xml.etree.ElementTree as ET
4
from collections import Counter
5

6
path = sys.argv[1]
7
opener = gzip.open if path.endswith((".gz", ".gzip")) else open
8

9
with opener(path, "rb") as f:
10
    root = ET.parse(f).getroot()
11

12
published = root.findtext("policy_published/domain", "(unknown)")
13

14
rows = []
15
for record in root.findall("record"):
16
    ip = record.findtext("row/source_ip", "?")
17
    count = int(record.findtext("row/count", "1"))
18
    pe = record.find("row/policy_evaluated")
19
    spf = pe.findtext("spf", "?") if pe is not None else "?"
20
    dkim = pe.findtext("dkim", "?") if pe is not None else "?"
21
    header_from = record.findtext("identifiers/header_from", "?")
22
    # policy_evaluated 已经是对齐后的结论
23
    dmarc = "pass" if "pass" in (spf, dkim) else "fail"
24
    rows.append((ip, count, spf, dkim, dmarc, header_from))
25

26
total = sum(r[1] for r in rows)
27
passed = sum(r[1] for r in rows if r[4] == "pass")
28
print(f"domain={published} messages={total} dmarc_pass={passed} dmarc_fail={total - passed}")
29
print(f"{'source_ip':<16}{'count':>7}  {'spf':<5}{'dkim':<5}{'dmarc':<6}header_from")
30
for ip, count, spf, dkim, dmarc, header_from in sorted(rows, key=lambda r: -r[1]):
31
    print(f"{ip:<16}{count:>7}  {spf:<5}{dkim:<5}{dmarc:<6}{header_from}")
32

33
by_from = Counter()
34
for ip, count, spf, dkim, dmarc, header_from in rows:
35
    if dmarc == "fail":
36
        by_from[header_from] += count
37

38
if by_from:
39
    print("\nfailures by header_from:")
40
    for domain, count in by_from.most_common():
41
        print(f"  {domain}: {count}")

1
domain=example.com messages=155 dmarc_pass=120 dmarc_fail=35
2
source_ip         count  spf  dkim dmarc header_from
3
203.0.113.10        120  pass pass pass  example.com
4
198.51.100.7         35  fail fail fail  example.com
5

6
failures by header_from:
7
  example.com: 35