More Info:
AWS Route 53 hosted zones should have a TXT DNS record that contains a corresponding Sender Policy Framework (SPF) value set for each MX record available.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Route 53 Hosted Zones Should Have Sender Policy Framework Record Present” in AWS using the AWS console, follow these steps:
- Log in to the AWS Management Console and navigate to the Route 53 dashboard.
- Click on the Hosted Zones option in the left-hand navigation menu.
- Select the hosted zone for which you want to add a Sender Policy Framework (SPF) record.
- Click on the Create Record Set button at the top of the page.
- In the Create Record Set dialog box, enter the following details:
- Name: Enter the name of the domain or subdomain for which you want to create an SPF record (e.g., example.com or mail.example.com).
- Type: Select TXT from the drop-down list.
- Value: Enter the SPF record value. The value should be in the following format: “v=spf1 include:_spf.example.com ~all”. Replace “_spf.example.com” with the domain name of your email service provider.
- Click on the Create button to save the record set.
- Verify that the new record set appears in the hosted zone record list.
- Repeat the above steps for any other hosted zones that require an SPF record.
Using CLI
Using CLI
To remediate this misconfiguration for AWS using AWS CLI, follow these steps:
- Open your terminal or command prompt and ensure that you have the AWS CLI installed.
-
Run the following command to list all the hosted zones in your AWS account:
- Identify the hosted zone that needs to have the Sender Policy Framework (SPF) record present.
-
Create a JSON file with the following information:
Replace
example.comwith the name of your hosted zone, and"v=spf1 include:_spf.google.com ~all"with the SPF record you want to add. -
Run the following command to add the SPF record to the hosted zone:
Replace
HOSTED_ZONE_IDwith the ID of your hosted zone, andpath/to/file.jsonwith the path to the JSON file you created in step 4. -
Verify that the SPF record has been added to the hosted zone by running the following command:
Replace
HOSTED_ZONE_IDwith the ID of your hosted zone.
Using Python
Using Python
To remediate the misconfiguration in AWS Route 53 hosted zones, we need to create a Sender Policy Framework (SPF) record. Here are the step-by-step instructions to do so using Python:
-
First, we need to install the AWS SDK for Python (Boto3) using pip. Run the following command in your terminal:
-
Next, we need to authenticate our AWS account using AWS access keys. You can set up access keys by going to the AWS IAM console and creating a new user with programmatic access. Once you have the access keys, you can set them up in your Python code using the following snippet:
Replace
YOUR_ACCESS_KEY,YOUR_SECRET_KEY, andYOUR_REGIONwith your own AWS access keys and region. -
Now, we can create the SPF record using the
change_resource_record_setsmethod of theroute53client. Here’s an example code snippet to create an SPF record:ReplaceYOUR_HOSTED_ZONE_ID,YOUR_DOMAIN_NAME, andspf_valuewith your own values.spf_valueshould be set to the SPF record value you want to create. - Finally, you can run the Python script to create the SPF record in your AWS Route 53 hosted zone. Once the script has run successfully, you should see the new SPF record in your hosted zone in the AWS console. Note: Make sure to test your SPF record to ensure that it is working as expected and not causing any email delivery issues.

