Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

[Scott Kitterman <[e-mail]>]

On Sunday, January 15, 2023 5:48:47 PM EST Jan Schaumann wrote:
> Scott Kitterman <[e-mail]> wrote:
> > Moving forward, here's the full text specific to MX from RFC 7208, Section
> > 
> > 4.6.4:
> > >    When evaluating the "mx" mechanism, the number of "MX" resource
> > >    records queried is included in the overall limit of 10 mechanisms/
> > >    modifiers that cause DNS lookups as described above.  In addition to
> > >    that limit, the evaluation of each "MX" record MUST NOT result in
> > >    querying more than 10 address records -- either "A" or "AAAA"
> > >    resource records.  If this limit is exceeded, the "mx" mechanism MUST
> > >    produce a "permerror" result.
> > 
> > In the example you gave, only the +mx lookup counts against the overall
> > limit. "MX" resource records are exactly that.  The address records
> > (A/AAAA) are counted separately as clearly indicated in the sentence
> > after the one you quoted.
> > 
> > I think you need to go back and revisit you assessment of how these work
> > as I don't think it's correct.  We struggled with this in the SPFbis
> > working group as it was very difficult to come up with clear and accurate
> > language, so I'm not surprised to see it's not immediately obvious what
> > we meant.
> 
> I'm afraid the intent is still ambiguous.
> 
> Could you clarify by example:
> 
> $ dig +short txt example.com
> v=spfv1 +a +mx -all
> $ dig +short mx example.com
> 10 a.example.com
> 20 b.example.com
> $
> 
> Is it 2 (one for the 'a' lookup, and one for the
> 'mx'), or is it 4 (one for the 'a' lookup, one for the
> 'mx' lookup, and, because MX records return host names
> and IP addresses, an additional lookup for each MX
> record returned)?

There are two distinct limits in play here.  That's part of what makes it 
difficult to explain clearly and correctly.

There is the "overall" limit.  The count against the overall limit is two ('a' 
and 'mx').

There is a per 'mx' limit as well.  In this example the 'mx' mechanism yields 
two address records (a.example.com and b.example.com), so the per 'mx' count 
in this example is also two.  These do not count against the overall limit.

Scott K