Re: [dnsext] loads of TXT records for fun and profit

[Phil Pennock <[e-mail]>]

If folks can read this message, then it appears that my posting problems are
caused by the IETF mail-system silently discarding mail with a BATV/PRVS
sender.  Reposting with that disabled.

On 2013-05-03 at 08:59 -0700, David Conrad wrote:
> Not really. The ABNF of SPF does not take into account the order of
> RRs within an RRset is not guaranteed. The "v=spf1" version
> discriminator does not prefix each "term", it only prefixes a "record"
> and SPF terms can be split over multiple TXT records.

That is not my understanding as a reader of RFC4408 and as someone who
worked with the coder (and documented the results) for the handling of
TXT records in a widespread MTA to be as flexible as possible and to
support SPF-style lookups.  (Exim, ${dnsdb...} stuff, used in some
minimal setups when libspf2 is not used.)

SPF can be split over multiple strings within a single TXT record but
can not be split over multiple RR of type TXT.

RFC 4408:
----------------------------8< cut here >8------------------------------
3.  SPF Records

   An SPF record is a DNS Resource Record (RR) that declares which hosts
   are, and are not, authorized to use a domain name for the "HELO" and
   "MAIL FROM" identities.  Loosely, the record partitions all hosts
   into permitted and not-permitted sets (though some hosts might fall
   into neither category).
[...]
3.1.2.  Multiple DNS Records


   A domain name MUST NOT have multiple records that would cause an
   authorization check to select more than one record.  See Section 4.5
   for the selection rules.

3.1.3.  Multiple Strings in a Single DNS record
[...]
4.5.  Selecting Records

   Records begin with a version section:

   record           = version terms *SP
   version          = "v=spf1"

   Starting with the set of records that were returned by the lookup,
   record selection proceeds in two steps:

   1. Records that do not begin with a version section of exactly
      "v=spf1" are discarded.  Note that the version section is
      terminated either by an SP character or the end of the record.  A
      record with a version section of "v=spf10" does not match and must
      be discarded.

   2. If any records of type SPF are in the set, then all records of
      type TXT are discarded.

   After the above steps, there should be exactly one record remaining
   and evaluation can proceed.  If there are two or more records
   remaining, then check_host() exits immediately with the result of
   "PermError".

   If no matching records are returned, an SPF client MUST assume that
   the domain makes no SPF declarations.  SPF processing MUST stop and
   return "None".
----------------------------8< cut here >8------------------------------