Offensive SPF: How to Automate Anti-Phishing Reconnaissance Using Sender Policy Framework

**Executive Summary:** This blog post describes a proof-of-concept defensive/offensive technique called AutoRecon that uses the SPF 'exists' macro to induce DNS queries containing the originating IP of unauthenticated mail; a dedicated BIND9 service logs those queries and a script enriches them (e.g., via Shodan) and triggers alerts or blocking actions. The post includes configuration steps, example SPF and zone files, operational cautions (legal and mail-delivery risks), and ideas for extending the system with Nmap, Fail2Ban, and automation.