check-dns: expect SPF (v=spf1 a -all) on the backup relay; normalise quoted TXT from dig (b1f7229)

commit

8419232

parent

41d963f

author

date

2026-10-09T12:23:05Z

check-dns

expect SPF (v=spf1 a -all) on the backup relay; normalise quoted TXT from dig (b1f7229)

1 files changed, +10, -1

M scripts/check-dns.sh

 1@@ -10,6 +10,10 @@
 2 #                                              serves on :25 right now
 3 #   relay (hosts.json, role sovrn-relay, settings.sovrnRelay.hostname)
 4 #     <relay>                   A / AAAA       the host's ipv4 / ipv6
 5+#     <relay>                   TXT v=spf1 a -all
 6+#                                              its DSNs go out direct (null
 7+#                                              sender: SPF checks the HELO
 8+#                                              name; bug b1f7229)
 9 #     _25._tcp.<relay>          no TLSA        the backup MX fails open
10 #                                              (bug 209274a): it must be a
11 #                                              validated NXDOMAIN, not a record
12@@ -68,6 +72,8 @@ norm() {
13       v = a[1] " " a[2] " " a[3] " " tolower(hex)
14     }
15     else if (t == "AAAA") v = tolower(v)
16+    # dig quotes TXT data and splits long values into strings; Marque does not.
17+    else if (t == "TXT") { gsub(/" "/, "", v); gsub(/^"|"$/, "", v) }
18     print n, t, v
19   }'
20 }
21@@ -116,7 +122,10 @@ addrs() { # host -> A/AAAA lines for name $2
22     fi
23   done
24   jq -r 'to_entries[] | select(.value.roles | index("sovrn-relay")) | [.key, .value.settings.sovrnRelay.hostname] | @tsv' "$INVENTORY" |
25-    while IFS=$'\t' read -r host relay; do addrs "$host" "$relay"; done
26+    while IFS=$'\t' read -r host relay; do
27+      addrs "$host" "$relay"
28+      printf '%s\tTXT\tv=spf1 a -all\n' "$relay"
29+    done
30   addrs "$root_host" "$zone"
31   printf '%s\tMX\t10 %s\n' "$zone" "$root_host"
32   printf 'dkim.%s\tCNAME\tdkim.smtp2go.net\n' "$zone"