SPF record generation or validation in code

Without programmatic SPF validation, you have no guarantee that your sending domain's SPF record is correctly published — or published at all. RFC7208 alignment is a prerequisite for DMARC enforcement: if SPF fails, email from your domain reaches the spam folder or is rejected outright. Manual DNS management introduces silent misconfiguration: a deployment that adds a new sending IP without updating the SPF record will quietly fail authentication for weeks before anyone notices the deliverability drop.

Add startup or health-check validation using Node's built-in dns module — no third-party dependency required. Check that the SPF record is present and ends with ~all or -all, not the dangerously permissive +all.

import { promises as dns } from 'node:dns'

export async function validateSpfRecord(sendingDomain: string): Promise<void> {
  const records = await dns.resolveTxt(sendingDomain)
  const spfRecord = records.flat().find(r => r.startsWith('v=spf1'))

  if (!spfRecord) throw new Error(`No SPF record found for ${sendingDomain}`)
  if (!spfRecord.includes('~all') && !spfRecord.includes('-all')) {
    throw new Error(`SPF record for ${sendingDomain} uses +all — too permissive`)
  }
}

For a SendGrid-only sender the record is v=spf1 include:sendgrid.net ~all; for SES in us-east-1 use v=spf1 include:amazonses.com ~all. Version-control both the record value and this validation call so SPF gaps surface in CI before reaching production.