SPF DNS Lookup Audit (Google DoH) for Gmail & Slack Alerts

Spot missing or risky SPF DNS lookups—get daily Gmail & Slack alerts

This n8n workflow audits your domain SPF DNS lookup usage using Google DNS-over-HTTPS (DoH), then sends a prioritized digest to Slack and Gmail when records are missing, unsafe, or approaching/over the 10-lookup limit.

What this workflow does

• Runs daily at 07:00 (or you can execute it manually).
• Reads a comma-separated domain list plus alert destinations (a Slack channel and an email recipient) from configuration values.
• Queries Google’s DNS-over-HTTPS endpoint to fetch each domain’s SPF TXT record.
• Follows SPF include and redirect targets for two additional DNS resolution rounds to build the full lookup tree.
• Replays the RFC 7208 SPF lookup counting rules offline to calculate the total DNS lookups per domain.
• Flags actionable issues such as missing SPF, absence of +all, multiple SPF records, macro-based targets, and SPF trees that are near/over the lookup limit.
• Generates a Slack Block Kit message and an HTML email digest, prioritizing the most severe findings.
• Sends to Slack and sends the Gmail email only when there is something actionable (manual runs always produce a report).

Use cases

• SaaS operators monitoring SPF safety before deliverability problems hit.
• Automation engineers validating SPF includes/redirects after migrations or vendor changes.
• Security-focused teams auditing domains that send to Gmail while tracking the 10-lookup limit risk.

Technical details

• Schedule: 07:00 daily (configurable) or manual execution.
• Integrations/nodes: http request (Google DNS-over-HTTPS), code (SPF lookup counting logic), slack (Slack OAuth2), gmail (email delivery), plus set and sticky note.