Subject: [spfbis] SPF-checking tool

From: "Frank Bulk" <[email-masked]>
Date: Wed, 26 Feb 2020 09:04:37 -0600

Can someone point me to a tool that would allow me to check a domain for its
SPF correctness?  I'm currently performing an automated daily check of a few
hundred domains (friendlies) and emailing the domain owners if there's an
issue.  

I currently use kitterman's script, but it doesn't catch all the issues that
Dmarcian does and so there's a number of domains that have issues but I'm
not alerting on them. Dmarcian doesn't appear to have an API or downloadable
version of their tool that I can run.

Frank

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 26 Feb 2020 22:20:52 +0000

Can you give me an example or two?

Scott K

On February 26, 2020 3:04:37 PM UTC, Frank Bulk <[email-masked]> wrote:
>_______________________________________________
>spfbis mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/spfbis

---

From: Stuart D Gathman <[email-masked]>
Date: Thu, 27 Feb 2020 02:36:27 -0500 (EST)

> version of their tool that I can run.

Are you checking DMARC, or SPF?

If SPF, can you give an example of an incorrect policy that is not
flagged?

---

From: "Frank Bulk" <[email-masked]>
Date: Thu, 27 Feb 2020 09:56:09 -0600

Perhaps I'm using an old version of that Python script, but here are some
examples.  My best guess is that the python script stops as soon as it
passes the check, but doesn't evaluate the whole record.

deerequipment.com: Dmarcian notes "The target name for
"include:spf.protection.outlook.com" equals an already evaluated "include"
mechanism / "redirect" modifier." 

visionnetusa.com: Dmarcian notes "Multiple SPF records found for
"visionnetusa.com". There should only be one."

ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for
"ghekkonetworks.com". There should only be one."

billtrust.com: Dmarcian notes " A DMARC record was detected under
"billtrust.com". DMARC records must be located at "_dmarc.billtrust.com",
and not directly at "billtrust.com". If DMARC was set up as a wildcard
record, that should be removed and placed only at the domain level."

zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF
record. The maximum is 10."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
ip4:66.202.101.250 ip4:65.114.230.67 ip4:64.179.27.250 ip4:64.196.161.5
ip4:13.111.0.0/23 ip4:64.18.0.0/20 ip4:64.151.112.128/28
ip4:64.151.119.32/27 ip4:64.233.160.0/19 ip4:64.235.144.0/20
ip4:66.102.0.0/20 ip4:66.231.95.0/29 ip4:66.249.80.0/20 ip4:67.59.141.128/28
ip4:64.125.230.136/32 ip4:69.43.143.32/27 ip4:69.43.143.96/27
include:spf-0024b301.pphosted.com include:email-od.com
include:_spf.salesforce.com include:_spf.google.com include:aspmx.pardot.com
include:_spf.q4press.com ~all" 66.202.101.250 [email-masked]
mail.zayo.com
result: ('pass', 250, 'sender SPF authorized') ip4:66.202.101.250
root@nagios:/usr/local/bin/spfcheck#

nocix.net: Dmarcian notes "16 DNS lookups required to evaluate the SPF
record. The maximum is 10."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 mx a
ip4:204.152.38.69/32 ip4:204.152.38.70/32 ip4:204.152.38.77/32
ip4:204.152.38.72/32 a:s101.ndevix.com a:s101.chi.ndevix.com
a:s102.ndevix.com a:s105.ndevix.com a:f0.mx.ndevix.com a:f102.mx.ndevix.com
include:ndevix.com -all" 204.152.38.87 [email-masked] mail.nocix.net
result: ('pass', 250, 'sender SPF authorized') mx
root@nagios:/usr/local/bin/spfcheck#

tivo.com: Dmarcian notes:
	Error! 30 DNS lookups required to evaluate the SPF record. The
maximum is 10.
	Error! SPF record is present, but invalid.
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com
include:spf.protection.outlook.com include:aspmx.pardot.com
include:_spf.centercode.com ~all" 204.176.49.0 [email-masked]
mail.tivo.com
result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com
root@nagios:/usr/local/bin/spfcheck#

nex-tech.com: Dmarciate notes: "SPF record is present, but invalid."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25
ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170
include:amazonses.com a:dispatch-us.ppe-hosted.com
include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com
include:azure.quotevalet.com include:spf.protection.outlook.com a -all"
208.65.144.0 [email-masked] mail.nex-tech.com
result: ('pass', 250, 'sender SPF authorized') ip4:208.65.144.0/21
root@nagios:/usr/local/bin/spfcheck#

atx.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF record.
The maximum is 10."
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
include:spf.protection.outlook.com include:aspmx.pardot.com
include:salesforce.com -all" 40.92.0.0 [email-masked] mail.atx.com
result: ('pass', 250, 'sender SPF authorized')
include:spf.protection.outlook.com
root@nagios:/usr/local/bin/spfcheck#

lewisdrug.com: Dmarciante notes:
	Error! 13 DNS lookups required to evaluate the SPF record. The
maximum is 10.
	Error! SPF record is present, but invalid.
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 mx a
ip4:216.12.181.71/32 ip4:216.12.181.72/32 include:_spf.google.com
include:spf.createsend.com include:_netblocks.mimecast.com ~all"
207.211.30.221 [email-masked] mail.lewisdrug.com
result: ('pass', 250, 'sender SPF authorized') mx
root@nagios:/usr/local/bin/spfcheck#

Frank

---

From: Stuart D Gathman <[email-masked]>
Date: Thu, 27 Feb 2020 14:52:38 -0500 (EST)

> mechanism / "redirect" modifier."

That is not an error.  That is more of a "lint" feature.

> "visionnetusa.com". There should only be one."

$ python spf.py visionnetusa.com
PermError:  Two or more type TXT spf records found.

> "ghekkonetworks.com". There should only be one."

$ python spf.py ghekkonetworks.com
PermError:  Two or more type TXT spf records found.

> record, that should be removed and placed only at the domain level."

SPF doesn't do DMARC.

> record. The maximum is 10."

$ python spf.py 1.2.3.4 [email-masked] zayo.com
result: ('permerror', 550, 'SPF Permanent Error: Too many DNS lookups')
None

Granted, the description should include the count.  Fixing now...

> root@nagios:/usr/local/bin/spfcheck#

Here's one Dmarc missed in the horribly perverted tivo.com policy (the 
sheer size of the trace should make tivo immediately erase their policy
and start over).

$ python spf.py -v 1.2.3.4 [email-masked] tivo.com
result= ('tivo.com', 'TXT')
['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3hcOixOuVcdQw==']
addcache= ('tivo.com', 'TXT')
['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3hcOixOuVcdQw==']
result= ('tivo.com', 'TXT')
['status-page-domain-verification=fq5jzb9dvx37']
addcache= ('tivo.com', 'TXT')
['status-page-domain-verification=fq5jzb9dvx37']
result= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx
include:authsmtp.com include:stspg-customer.com
include:spf.protection.outlook.com include:aspmx.pardot.com
include:_spf.centercode.com ~all']
addcache= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx
include:authsmtp.com include:stspg-customer.com
include:spf.protection.outlook.com include:aspmx.pardot.com
include:_spf.centercode.com ~all']
result= ('tivo.com', 'TXT') ['MS=ms87319732']
addcache= ('tivo.com', 'TXT') ['MS=ms87319732']
result= ('tivo.com', 'TXT')
['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5842b7']
addcache= ('tivo.com', 'TXT')
['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5842b7']
result= ('tivo.com', 'TXT')
['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22']
addcache= ('tivo.com', 'TXT')
['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22']
result= ('tivo.com', 'TXT')
['0ed1fe018ac20dca8c20624109ac0610e88f36a065']
addcache= ('tivo.com', 'TXT')
['0ed1fe018ac20dca8c20624109ac0610e88f36a065']
result= ('tivo.com', 'TXT')
['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8priX2RHbztUA==']
addcache= ('tivo.com', 'TXT')
['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8priX2RHbztUA==']
result= ('tivo.com', 'TXT')
['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129aac8a1']
addcache= ('tivo.com', 'TXT')
['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129aac8a1']
top: tivo.com "v=spf1 include:_spf.tivo.com mx include:authsmtp.com
include:stspg-customer.com include:spf.protection.outlook.com
include:aspmx.pardot.com include:_spf.centercode.com ~all"
result= ('_spf.tivo.com', 'TXT') ['v=spf1
include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com
include:_spf_netblocks3.tivo.com include:_spf.jobvite.com
include:_spf.salesforce.com include:us._netblocks.mimecast.com
include:us.confirmit.com a:secmail.ultipro.com ~all']
addcache= ('_spf.tivo.com', 'TXT') ['v=spf1
include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com
include:_spf_netblocks3.tivo.com include:_spf.jobvite.com
include:_spf.salesforce.com include:us._netblocks.mimecast.com
include:us.confirmit.com a:secmail.ultipro.com ~all']
include: _spf.tivo.com "v=spf1 include:_spf_netblocks1.tivo.com
include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com
include:_spf.jobvite.com include:_spf.salesforce.com
include:us._netblocks.mimecast.com include:us.confirmit.com
a:secmail.ultipro.com ~all"
result= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24
ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161
ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154
ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all']
addcache= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1
ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22
ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154
ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all']
include: _spf_netblocks1.tivo.com "v=spf1 ip4:204.176.49.0/24
ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161
ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154
ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all"
result= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1
ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31
ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100
ip4:65.17.254.108/31 ip4:63.131.159.146 ~all']
addcache= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1
ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31
ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100
ip4:65.17.254.108/31 ip4:63.131.159.146 ~all']
include: _spf_netblocks2.tivo.com "v=spf1 ip4:65.213.152.14/31
ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29
ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31
ip4:63.131.159.146 ~all"
result= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151
ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26
ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120
ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73
include:_spf_o365.tivo.com ~all']
addcache= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1
ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123
ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30
ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73
include:_spf_o365.tivo.com ~all']
include: _spf_netblocks3.tivo.com "v=spf1 ip4:63.131.159.151
ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26
ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120
ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73
include:_spf_o365.tivo.com ~all"
result= ('_spf_o365.tivo.com', 'TXT') ['v=spf1
include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com
include:_spf_netblockso3.tivo.com ~all']
addcache= ('_spf_o365.tivo.com', 'TXT') ['v=spf1
include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com
include:_spf_netblockso3.tivo.com ~all']
include: _spf_o365.tivo.com "v=spf1 include:_spf_netblockso.tivo.com
include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com
~all"
result= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22
ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103
ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148
ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27
~all']
addcache= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22
ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103
ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148
ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27
~all']
include: _spf_netblockso.tivo.com "v=spf1 ip4:13.111.0.0/22
ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103
ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148
ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27
~all"
result= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18
ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21
ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24
ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100
~all']
addcache= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1
ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25
ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23
ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151
ip4:64.78.17.176 ip4:65.17.254.100 ~all']
include: _spf_netblockso2.tivo.com "v=spf1 ip4:54.240.0.0/18
ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21
ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24
ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100
~all"
result= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1
ip4:65.17.254.108/31 ip4:65.213.152.14/31 include:
spf.protection.outlook.com ~all']
addcache= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1
ip4:65.17.254.108/31 ip4:65.213.152.14/31 include:
spf.protection.outlook.com ~all']
include: _spf_netblockso3.tivo.com "v=spf1 ip4:65.17.254.108/31
ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all"
result: ('permerror', 550, 'SPF Permanent Error:
_spf_netblockso3.tivo.com empty domain:: include:') None

---

From: "Frank Bulk" <[email-masked]>
Date: Thu, 27 Feb 2020 23:35:21 -0600

Thanks for you tool and this feedback.

I accept your 'lint' feedback on deerequipment.com -- but it is helpful to
be made aware of obvious redundancies.

Regarding visionnetusa.com and ghekkonetworks.com and zayo.com: it looks
like I need to do a plain check of the domain to check to certain errors?
Ideally I would have failures when performing the more complex checks, too.

I also understand your feedback billtrust.com -- but it is helpful to be
made aware of this kind of problem.

Looks like you agree that a simple and complex check that the problems in
tivo.com gets missed? 

root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py tivo.com
v=spf1 include:_spf.tivo.com mx include:authsmtp.com
include:stspg-customer.com include:spf.protection.outlook.com
include:aspmx.pardot.com include:_spf.centercode.com ~all
root@nagios:/usr/local/bin/spfcheck#
root@nagios:/usr/local/bin/spfcheck# python spf.py 204.176.49.0
[email-masked] tivo.com
result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com
root@nagios:/usr/local/bin/spfcheck#
oot@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com
include:spf.protection.outlook.com include:aspmx.pardot.com
include:_spf.centercode.com ~all" 204.176.49.0 [email-masked]
mail.tivo.com
result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com
root@nagios:/usr/local/bin/spfcheck#

Looks like errors are missed with simple and complex check of nex-tech.com?
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py nex-tech.com
v=spf1 ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25
ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170
include:amazonses.com a:dispatch-us.ppe-hosted.com
include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com
include:azure.quotevalet.com include:spf.protection.outlook.com a -all
root@nagios:/usr/local/bin/spfcheck#
root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1
ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25
ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170
include:amazonses.com a:dispatch-us.ppe-hosted.com
include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com
include:azure.quotevalet.com include:spf.protection.outlook.com a -all"
208.65.144.0 [email-masked] mail.nex-tech.com
result: ('pass', 250, 'sender SPF authorized') ip4:208.65.144.0/21
root@nagios:/usr/local/bin/spfcheck#

Regards,

Frank 

-----Original Message-----
From: Stuart D Gathman <[email-masked]> 
Sent: Thursday, February 27, 2020 1:53 PM
To: Frank Bulk <[email-masked]>
Cc: [email-masked]; 'Scott Kitterman' <[email-masked]>
Subject: Re: [spfbis] SPF-checking tool

SPF doesn't do DMARC.

['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3
hcOixOuVcdQw==']
['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3
hcOixOuVcdQw==']
['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5
842b7']
['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5
842b7']
['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8
priX2RHbztUA==']
['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8
priX2RHbztUA==']
['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a
ac8a1']
['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a
ac8a1']

---

From: "Frank Bulk" <[email-masked]>
Date: Thu, 27 Feb 2020 23:36:41 -0600

One more question: do I need to query these domains differently to get a
clean result?

boehringer-ingelheim.com: Unknown type: exists value
%{i}._i.%{d}._d.espf.dmp.cisco.com
genpt.com: Unknown type: exists value %{i}.spf.hc3618-75.iphmx.com
good-sam.com: Unknown type: exists value %{i}.spf.good-sam.iphmx.com
nationwide.com: Unknown type: exists value %{i}.spf.hc2638-63.iphmx.com
ochealthsystem.org: Unknown type: exists value %{i}.spf.hc3620-0.iphmx.com
sanfordhealth.org: Unknown type: exists value %{i}.spf.hc3620-0.iphmx.com

Frank

-----Original Message-----
From: Stuart D Gathman <[email-masked]> 
Sent: Thursday, February 27, 2020 1:53 PM
To: Frank Bulk <[email-masked]>
Cc: [email-masked]; 'Scott Kitterman' <[email-masked]>
Subject: Re: [spfbis] SPF-checking tool

SPF doesn't do DMARC.

---

From: "Frank Bulk" <[email-masked]>
Date: Thu, 27 Feb 2020 23:50:22 -0600

Sorry, that the output of my superscript -- please ignore.

Frank 

-----Original Message-----
From: spfbis <[email-masked]> On Behalf Of Frank Bulk
Sent: Thursday, February 27, 2020 11:37 PM
To: 'Stuart D Gathman' <[email-masked]>
Cc: [email-masked]; 'Scott Kitterman' <[email-masked]>
Subject: Re: [spfbis] SPF-checking tool

Frank

-----Original Message-----
From: Stuart D Gathman <[email-masked]> 
Sent: Thursday, February 27, 2020 1:53 PM
To: Frank Bulk <[email-masked]>
Cc: [email-masked]; 'Scott Kitterman' <[email-masked]>
Subject: Re: [spfbis] SPF-checking tool

SPF doesn't do DMARC.

---

From: Stuart D Gathman <[email-masked]>
Date: Sat, 29 Feb 2020 16:37:05 -0500 (EST)

> be made aware of obvious redundancies.

I agree.  But a separate tool is better for that purpose.  It is not the
purpose of the spf library.  Although maybe a lint util could be added,
but I don't know when I would write it...

> Ideally I would have failures when performing the more complex checks, too.

spf.py does not fetch and check every record that could be referenced
on a query.  In fact, it avoids doing so as much as possible.  Using
an IP that will fail most of the checks is a heuristic way to exercise
most of a policy.  A lint utility would in fact fetch all reachable
records and check them all.  (Maybe I should make time.)

> made aware of this kind of problem.

Yes, but even an SPF lint util will not pay attention to DMARC.

> Looks like you agree that a simple and complex check that the problems in

Both Dmarcian and SPF library found different errors in tivo.com.
Dmarcian said it was too big (too many lookups).  spf.py found 
a record with a syntax error also.  The tivo.com policy is definitely
a contender for the worst possible SPF policy contest.  But it is
disqualified on the grounds of not being actually legal.