Download the PHP package mlocati/spf-lib without Composer

SPF (Sender Policy Framework) Library

This PHP library allows you to:

• get the SPF record from a domain name
• decode and validate the SPF record
• create the value of a TXT record
• check if domains and IP addresses satisfy the SPF records

The implementation is based on RFC 7208.

AFAIK this is the only PHP library that passes the Open SPF Test Suite for RFC 7208.

This library supports any PHP from PHP 7.1 to 8.3.

Short introduction about SPF

Here's a very simplified short description of the purpose of the SPF protocol.

When an email client contacts an email server in order to delivery an email message, the email server has this information:

1. the IP address of the email client that is sending the email
2. the domain that the email client specified at the beginning of the SMTP delivery (after the HELO/EHLO SMTP command)
3. the sender email address (as specified in the MAIL FROM SMTP command)

The email server can use the SPF protocol to determine if the client is allowed or not to send email addresses with the specified domains (the HELO/EHLO domain and/or the domain after the @ in the MAIL FROM email address).

This is done by querying the SPF DNS records of the domain(s) being checked, which can tell the server if the client is allowed/non-allowed/probably not allowed to send the email.

You can use this PHP library to build, validate and check the SPF records.

Installation

You can install this library with Composer:

Usage

Validating domains and IP addresses

Let's assume that the email client has the IP address 1.2.3.4, specified helo.domain with the HELO/EHLO SMTP command, and specified [email protected] in the MAIL FROM email address.

These data are represented by the SPFLib\Check\Environment class: you can create it with:

To check the SPF records, you can use the SPFLib\Checker class:

By default, the check() method checks both the HELO/EHLO and the MAIL FROM domains (if both are available and if they are different). You can check just one by specifying \SPFLib\Checker::FLAG_CHECK_HELODOMAIN or \SPFLib\Checker::FLAG_CHECK_MAILFROADDRESS as the second argument of the check() method. Otherwise you can specify an empty string in the related Environment constructor (for example: new Environment($ip, $domain) will check only the HELO/EHLO domain, new Environment($ip, '', $mailFromAddress) will check only the domain of the MAIL FROM email address).

$checkResult is an instance of SPFLib\Term\Mechanism\Result, that provides:

• the check result ($checkResult->getCode()), which is one of the values specified in the RFC.
• the SPF mechanism that provided the result, if available ($checkResult->getMatchedMechanism())
• the failure description, if provided by the SPF records ($checkResult->getFailExplanation())
• optional relevant messages from the check process ($checkResult->getMessages())

So, the simplest example is:

which outputs

Retrieving the SPF record from a domain name

An SPF record is composed by zero or more terms. Every term can be a mechanism or a modifier.

This library allows you to inspect them:

Please note that:

• all mechanisms extend the SPFLib\Term\Mechanism abstract class.
• all modifiers extend the SPFLib\Term\Modifier abstract class.
• both mechanisms and modifiers implement the SPFLib\Term interface.

Decoding the SPF record from the value of a TXT DNS record

Creating the value of an SPF record

Output:

Checking problems with an SPF record

Output:

Please note that every item in the array returned by the validate method is an instance of the SPFLib\Semantic\Issue class.

Checking problems with an SPF record in real world

The SemanticValidator only look for issues in an SPF record, without inspecting include (or redirected-to) records.

In order to check an SPF record and all the referenced records you can use the OnlineSemanticValidator:

The result of these methods are arrays of SPFLib\Semantic\OnlineIssue instances, which are very similar to the SPFLib\Semantic\Issue instances returned by the offline SemanticValidator.

Do you want to really say thank you?

You can offer me a monthly coffee or a one-time coffee :wink: