Package: r53spflat
Route53 SPF Flattenerr53spflatis an extension tosender-policy-flattenerwhich is a different project maintaind bycentanu.r53spflatcan update the SPF TXT records inAmazon Route53r53spflatwas adapted fromcfspflat- which provides the same capability for Cloudflare DNSSPF FlatteningSender Policy Framework(SPF) has certain restricitionson the number of DNS lookups (10) to validate a sender is authorized by SPF.Organizations utilizing vendors and SaaS products that send email on their behalf. They do this by adding anincludefor an SPF record the vendor provides - and manages.The vendor managed SPF record contains theip4andip6records for that vendors email infrastrucure and often contains additionalincludestatements.As each vendor SPF record is included to your SPF it requires more DNS lookups.  This can exceed the SPF protocol limit of 10 lookups. When this happens, your email can be rejected by recipients because the authorized sender's IP was never reached.SPF Flattening is the process of resolving the authorized senders SPFincluderecords intoip4andip6records to reduce the number of DNS lookups.Converting theincluderecords toip4andip6statements can be a problem if the vendor modifies their SPF record. How do you keep them in sync?sender-policy-flattenerdetects these changes and reports them by email.r53spflatusessender-policy-flattener, but includes an--updatecapability.r53spflat- Route53 Sender Policy FlattenerQuick overview:%r53spflat-h
usage:r53spflat[-h][-cCONFIG][-oOUTPUT][--update-records][--force-update][--no-email]AscriptthatcrawlsandcompactsSPFrecordsintoIPnetworks.Thishelpsto
avoidexceedingtheDNSlookuplimitoftheSenderPolicyFramework(SPF)https://tools.ietf.org/html/rfc7208#section-4.6.4

optionalarguments:-h,--helpshowthishelpmessageandexit-cCONFIG,--configCONFIGName/pathofJSONconfigurationfile(default:spfs.json)-oOUTPUT,--outputOUTPUTName/pathofoutputfile(defaultspf_sums.json)--update-recordsUpdateSPFrecordsinRoute53--force-updateForceanupdateofSPFrecordsinRoute53--no-emaildon'tsendtheemailThesender-policy-flattenerpython module is installed as part ofr53spflatThe existing core ofspflatis kept mostly intact, so the basic features are maintained byr53spflat.The changes to accomodater53spflatwere in the parameter handling and adding the Route53 updates to the processing look.Theboto3library, with some abstraction classes, is used to make the zone updates in Route53.r53spflateliminates many of the command arguments of spflat in favor of using the json config file.Rotue53 TXT records are automatically generated and updated when the configuration changes.Withr53spflatyou can completely automate your SPF flattening using cfspflat with the--updateswitch in a cron job, even silently with the--no-emailswitchInstalling and Configuringr53spflat1. pip install the r53spflat module%pipinstallr53spflatBut it's advisable to do this in its own venv:%python3-mvenvspfenv
%sourcespfenv/bin/activate
%pipinstallr53spflatpip will install the prerequisites, including thesender-policy-flattner(spflat),dnspython,netaddr, andboto3python modules.The executable is installed in bin of the venv asr53spflat2. Create an anchor SPF record for the zone apex in Route53Create the TXT SPF record on zone apex used (e.g. example.com), At the end of this anchor record include the first SPF record that slpat will write - spf0.example.comwe also include our ownip4andip6entries in this anchor record.example.com TXT "v=spf1 mx include:spf0.example.com -all"This anchor record is never changed byr53spflat. It's purpose is to link to the first SPF record in the chain thatr53spflatmanages.2. Edit the r53spflat configuration fileCreate a spfs.json file.  Add all the entries required:r53spflatuses the same configuration and sums file formats as the originalspflat.If you already use spflat you can use those files as is with r53spflat.There is one extension - the "update_subject" entry containing the subject of the email sent when r53spflat has updated your SPF records.  This message will contain the same detail spflat provides.spfs.jsonis the default name of the config file, but it can be specified with the--configswitch.Here is an example config file:Example spfs.json configuration file:{"sending domains":{"example.edu":{"amazonses.com":"txt","goodwebsolutions.net":"txt",....moresenderspf'shere...."delivery.xyz.com":"txt","spf.protection.outlook.com":"txt"}},"resolvers":["1.1.1.1","8.8.8.8"],"email":{"to":"dnsadmins@example.com","from":"spf_monitor@example.com","subject":"[WARNING] SPF Records for {zone} have changed and should be updated.","update_subject":"[NOTICE] SPF Records for {zone} have been updated.","server":"smtp.example.com"},"output":"monitor_sums.json"}Config file detailsThesending domainssection isrequiredand contains sending domain entries: this is your sender domain (e.g. example.com forj.smith@example.com, noreply.example.com fordeals@noreply.example.com)  There can be multiple sending domains in the config file.Each sending domain contains dns spf records for the dnsincluderecords of your approved senders.These dns names are resolved and flattened:These entries are in the key-value pairs of  : .Record type can be "txt" (other SPF records),  "A" and "AAAA" records (for specific hosts).Theresolverssection isoptional(using the system default DNS resolvers if none are supplied)Theemailstanza isrequiredand is global (i.e. for allsending domains).  This section includes:subject(optional)is the email subject if a change was detected but no updates were made. The default message is the one shown in the example.update_subject(optional)is the email subject if a change was detected and the dns records were updated. The default message is shown in the example.to- isrequired- this is the destination for emails sent byr53spflatfrom- isrequired- the source email of the messagesr53spflatsendsserver- isrequired- your mail relay.outputis the file that maintains the existing state and checksum of sender records. If this is not specifiedspfs_sum.jsonis used.Output file detailsTheoutputfile is a JSON file only updated if it is new (empty) or the records have been updated.Likewise the default output file isspf_sums.jsonbut can be changed in the config file or by the--outputswitch.This contains the list of flattened spf records and a checksum used to assess changes in senders records.Because you recieve emails of detected changes or updates, there is little reason to care about the output file.3. Create a credentials file for AWSThe AWS user or role used forr53spflatmust have these permissions to make updates:route53:ListHostedZonesto Route53route53:ChangeResourceRecordSetsandroute53:ListResourceRecordSetsto the zones that will be updatedIfr53spflatrun on an AWS EC2 instance, an IAM role with the required privileges can be attached to the instance.Ifr53spflatruns on prem, API keys are required to make the AWS Route53 updates and placed in a configuation file.Configuring this beyond our scope: refere toAWS cliRoute53 is a global service, so any region can be specified.These credentials are typically in~/.aws/credentialsand~/.aws/configIt's also possible to pass the credentials as environment variables.4. Runr53spflatto build the sums file and SPF entriesRun r53spflat twice:%r53spflat--no-email
%r53spflat--forceThe first time constructs the base records and the second time forces the dns updates.With force update the DNS records are created even if a change hasn't been detected.A list of the records will be sent to your email.5. Automater53spflatto the level you are comfortable withYou are up and running:You can runr53spflatin advisory mode (likespflat) sending you emails notifying of changesOr you can run it with the--update-recordsswitch and update your records automatically whenever they change (still giving you notifications of the changes made.)Example email formatExample fromsender-policy-flattenerREADMEThis would be in