id: spoofable-spf-records-ptr

info:
  name: Spoofable SPF Records with PTR Mechanism
  author: binaryfigments
  severity: info
  description: SPF records in DNS containing a PTR mechanism are spoofable.
  reference:
    - https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability
  classification:
    cwe-id: CWE-200
  tags: dns,spf
  metadata:
    max-request: 1

dns:
  - name: "{{FQDN}}"
    type: TXT

    matchers:
      - type: word
        words:
          - "v=spf1"
          - " ptr "
        condition: and