Managed SPF & DKIM security — operate your authentication, don’t just monitor it

SpoofSentry recursively resolves your SPF record, following every Live include, redirect, and exists mechanism to build a complete picture of your authorized sending infrastructure. The parser counts DNS lookups against the RFC 7208 10-lookup limit and flags records that are at or over the threshold.

Each mechanism is annotated with the service it belongs to (Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES, and hundreds more). Orphaned includes that no longer resolve are flagged for cleanup. The full include tree is visualized in the dashboard with lookup counts at each level.

SpoofSentry evaluates SPF health across six dimensions: Live lookup exhaustion (proximity to the 10-lookup limit), stale dependencies (includes pointing to decommissioned services), fragility (single-point-of-failure chains), shadow senders (authorized IPs with no DMARC report traffic), permissiveness (overly broad CIDR ranges or +all qualifiers), and maintenance burden (frequency of required updates).

The composite score is presented alongside per-factor breakdowns so you can prioritize remediation. Historical scoring tracks how SPF health changes over time as services are added, removed, or migrated.

The optimization engineLive reduces DNS lookups by flattening include chains into direct IP addresses and CIDR ranges, deduplicating overlapping entries, and collapsing adjacent CIDRs into larger blocks. The engine respects the 255-character TXT record limit and automatically splits into multiple SPF-safe records when needed.

Every optimization pass runs safety checks: the optimized record is compared against the original to confirm semantic equivalence (same set of authorized IPs), the lookup count is validated to be within limits, and a dry-run DNS resolution confirms the result parses correctly. No optimization is applied without passing all checks.

SpoofSentry supports five deployment modes to match your operational maturity. AdvisoryLive mode generates recommendations without touching DNS. GuidedLive mode provides step-by-step instructions for manual application. PreviewLive mode shows the exact DNS change that will be made. Apply with approvalLive requires a human to approve the change before SpoofSentry writes to DNS. Auto-applyBetaEnterprise (Enterprise only) applies optimizations automatically when safety checks pass.

All modes that write to DNS go through the same preview, safety check, and post-apply verification pipeline. The difference is whether a human approval step is required before the write happens.

Every SPF change made through SpoofSentry is versioned.Live The previous record state is preserved and available for automatic rollback from the dashboard or API. Rollback re-applies the previous record and runs post-apply verification to confirm the revert took effect.

Drift detection monitors your SPF records for out-of-band changes made outside SpoofSentry (for example, by another team member editing DNS directly). When drift is detected, SpoofSentry alerts via your configured notification channels and flags the record for review. This prevents silent breakage from uncoordinated DNS edits.

Managed SPF works with SpoofSentry's DNS provider integrations: CloudflareLive, AWS Route 53Live, Azure DNSLive, Google Cloud DNSLive, and GoDaddyLive. Each integration supports the full lifecycle: preview, apply, verify propagation, and rollback.

For DNS providers not directly integrated, SpoofSentry generates the exact record values with copy-to-clipboard support and provides verification once the change is applied manually.

Every SPF change is protected by multiple safety layers.Live Preview before apply shows the exact before/after DNS state. Semantic equivalence checks confirm the optimized record authorizes the same IP ranges as the original. Lookup count validation ensures the result stays within the 10-lookup limit. Approval workflows (maker-checker, MSSP dual approval, or emergency override) gate changes in production.

Post-apply, SpoofSentry re-resolves the published record with retries to confirm the change propagated correctly. If verification fails, the operator is alerted immediately and rollback is offered.

SPF is only half of authentication. SpoofSentry audits every DKIM selector it discovers for key strength (flagging weak or legacy keys below 2048-bit RSA), missing or revoked keys, and selectors that appear in your DMARC reports but resolve to nothing. Weak and stale keys are surfaced as remediation items, not buried in a report.

Where SpoofSentry hosts or manages the signing key, it runs scheduled rotation — Protect includes two rotation schedules, Enforce ten, and Enterprise is unlimited. Where your mail platform owns the key — Microsoft 365, Google Workspace, and Zoho keep their DKIM private keys and rotate them themselves — SpoofSentry tracks the rotation cadence, flags staleness, and continuously validates each selector instead of holding the key. Either way your DKIM posture is operated, not just reported.

For teams that run their own outbound mail infrastructure — a self-hosted MTA or a relay that can sign with an externally supplied key — hosted DKIM removes the burden of operating the signing keys yourself. SpoofSentry generates the key pair, you delegate the selector with a one-time CNAME, and SpoofSentry handles publication, verification, and ongoing rotation — the full lifecycle — without you touching DNS again. This is an advanced option, not the default DKIM experience: mainstream managed platforms (Microsoft 365, Google Workspace, Zoho) sign with their own keys and cannot use an external one — for those, the managed DKIM lifecycle above is the fit.

Hosted signing is rolling out and completing production verification. It is an optional advanced capability for compatible mail infrastructure — an MTA or relay that can sign with an externally supplied key. Mainstream platforms (Microsoft 365, Google Workspace, Zoho) sign with their own keys, so for those SpoofSentry manages and validates the provider’s DKIM instead. The DKIM lifecycle management above is available today; contact us to confirm hosted signing for your setup.