SolidSPF

Security model

  • No passwords. Authentication is passkeys (WebAuthn) and email magic links only.
  • Least privilege. Our Cloudflare API token can edit DNS only on the dedicated SPF‑hosting zone — never your zone.
  • Domain separation. The application domain and the SPF‑hosting domain are separate for security and deliverability.
  • SSRF protection. The resolver refuses IP literals and private‑use names, so DNS features can't probe internal networks.
  • Signed webhooks. Stripe webhooks are signature‑verified and idempotent.
  • Audit logging. Domain, billing, auth, and publication changes are all audited.

← All docs