From 2b97fcd797e8bc89d7f0519cb42d4e63f2e66e46 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Tue, 20 Oct 2026 12:29:17 +0200
Subject: [PATCH] Improve SRS DNS preflight output and SPF status reporting

---
 helpers/srs-dns-check.py | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/helpers/srs-dns-check.py b/helpers/srs-dns-check.py
index 9b94b61..f450f82 100644
--- a/helpers/srs-dns-check.py
+++ b/helpers/srs-dns-check.py
@@ -104,7 +104,11 @@ def check_server(ns_name, ns_ip, domain, hostname, bind4, bind6):
                 spf_records.append(text)
         except ValueError as exc:
             errors.append(str(exc))
-    if len(spf_records) != 1 or spf_records[0].lower().split() != ['v=spf1', 'mx', '-all']:
+    spf_ok = (
+        len(spf_records) == 1
+        and spf_records[0].lower().split() == ['v=spf1', 'mx', '-all']
+    )
+    if not spf_ok:
         errors.append('SPF is not the approved single-host profile: v=spf1 mx -all')
 
     mx = query(domain, 'MX')
@@ -128,10 +132,10 @@ def check_server(ns_name, ns_ip, domain, hostname, bind4, bind6):
         elif configured not in normalized:
             errors.append(f'Postfix outbound {kind} address {configured} is not published for {hostname}: {normalized}')
 
-    print(f'   Authoritative NS {ns_name} ({ns_ip}): ' + ('OK' if not errors else 'FAILED'))
+    print(f'      [ {"ok" if not errors else "failed"} ] {ns_name} ({ns_ip})')
     for err in errors:
-        print(f'      [ error ] {err}')
-    return not errors
+        print(f'         [ error ] {err}')
+    return not errors, spf_ok
 
 
 def main():
@@ -154,18 +158,31 @@ def main():
         print(f'   Expected MX host...................: {hostname}')
         print(f'   Expected SMTP IPv4.................: {bind4 or "unknown"}')
         print(f'   Expected SMTP IPv6.................: {bind6 or "unknown"}')
+        print('   Required SPF record...............: v=spf1 mx -all')
         if len(nameservers) > 8:
             raise ValueError('More than eight authoritative nameservers; manual review required')
+        print()
+        print('   Authoritative nameservers:')
         ok = True
+        spf_ok_all = True
         for ns in nameservers:
             try:
                 ip = addr_of_ns(ns)
-                if not check_server(ns, ip, domain, hostname, bind4, bind6):
+                server_ok, server_spf_ok = check_server(
+                    ns, ip, domain, hostname, bind4, bind6
+                )
+                if not server_ok:
                     ok = False
+                if not server_spf_ok:
+                    spf_ok_all = False
             except ValueError as exc:
-                print(f'   Authoritative NS {ns}: FAILED')
-                print(f'      [ error ] {exc}')
+                print(f'      [ failed ] {ns}')
+                print(f'         [ error ] {exc}')
                 ok = False
+                spf_ok_all = False
+        print()
+        print('   SPF validation.....................: ' +
+              ('OK' if spf_ok_all else 'FAILED / NOT VERIFIED'))
         print('   Public SRS DNS preflight...........: ' + ('OK' if ok else 'FAILED'))
         return 0 if ok else 1
     except ValueError as exc: