Documentation
How Aezue approaches managed SPF.
This public guide covers the product model without requiring production credentials, provider secrets, or customer DNS changes.
1. Analyze before publishing
Aezue evaluates SPF mechanisms, modifiers, recursive dependencies, DNS-query budgets, void lookups, cycles, malformed records, and DNS failure outcomes before a managed candidate can be considered safe.
2. Keep control plane and DNS separate
Monitoring and publication decisions happen in the control plane. Live authoritative DNS serves prevalidated data and does not recursively resolve provider SPF records on the query path.
3. Activate only verified candidates
A candidate must pass parsing and safety checks, be published, and then be verified through authoritative DNS before it can replace the active version.
4. Preserve the last-known-good record
Failed validation, provider uncertainty, or an incomplete publication attempt must not remove or replace the current active DNS state.
5. Automate through stable boundaries
Customer and developer operations are designed for authenticated, tenant-scoped APIs and retry-safe asynchronous workflows. Provider credentials and deployment secrets remain server-side.