id: spoofable-spf-records-ptr

info:
  name: Spoofable SPF Records with PTR Mechanism
  author: binaryfigments
  severity: info
  description: SPF records in DNS containing a PTR mechanism are spoofable.
  reference:
    - https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: dns,spf

dns:
  - name: "{{FQDN}}"
    type: TXT
    matchers:
      - type: word
        words:
          - "v=spf1"
          - " ptr "
        condition: and
# digest: 490a0046304402205db2464b5a702857d30775b25f61f312a8fb1e6586cef7fd3e226b1e68202d9d02203ce1ee037b0e8c4be474aa4730a60fe546824f5f8e5a942f2f0d2ee2165bfd11:922c64590222798bb761d5b6d8e72950