About SPF Guru

I am an IT professional with more than twenty years in infrastructure, systems design and cloud technologies. Much of that has been spent on email architecture, designing and supporting mail systems for organisations of every size. I now work in cybersecurity.

The problem this solves

SPF is a foundational defence against spoofing, and it has a hard limit of ten DNS lookups. Cross that limit and the domain gets SPF PermError: failed DMARC checks, rejected mail, and deliverability problems that are tedious to diagnose.

I have watched a lot of administrators lose hours to this, either troubleshooting a broken record or hand-flattening includes to stay under the limit. Both are work that should not need doing.

Where it came from: Expurgate

In 2022 I released Expurgate, a self-hosted, Dockerised SPF macro hosting solution for administrators who wanted to run their own macro infrastructure, followed by Expurgate Solo, a single-container version. They gave people full control, and the question that kept coming back was whether it could be offered as a hosted service.

Rebuilt for the edge

Expurgate was built on rbldnsd, which depends on static configuration files. Running that as a public service would have meant accounts, logins and periodic config generation, which is the wrong shape for something that needs to be small and always up. So I redesigned it for the cloud instead.

SPF Guru runs on Bunny.net Magic Containers, deployed at the edge and reached by anycast. Whether ten people or ten thousand are querying it, resolution stays fast and close to the sender.

The evaluator underneath

Every lookup count and every trace on this site comes from spftrace, an RFC 7208 evaluator I wrote for the project and published separately under MIT. It returns the full working rather than just a verdict, which is what makes the checker and the include tree possible. What it does and why.

Who pays for it

I do. I cannot promise it stays free forever, but the intention is to run and maintain it until at least 2030, depending on demand.

If it saves you an afternoon and you want to help with the hosting bill, there is buymeacoffee.com/smc83, or you can host your own project on Bunny.net with this referral link.

Why bother

Fewer failed DMARC checks, fewer legitimate messages rejected, and less time spent on a problem that has a known answer. That is the whole ambition.

- Scott