glocktober / r53spflat Goto Github PK

Have you considered updating r53 records using the SPF exists: rule pattern? From what I'm understanding, this would be a much more scalable solution as you don't end up hitting TXT character limits in DNS records if the scanned include: records result in a large number of IPs or IPv6s.

There was a good description of the pattern in a Reddit post.

Basically take the scanned IPs (1.2.3.4) and build out DNS A records in the form 4.3.2.1.spf.yourdomain.com A 127.0.0.2
Then with an SPF rule like exists:%{ir}.spf.yourdomain.com you'll get a pass as that record will exist.