Re: [spfbis] RFC6147 and RFC7208 interoperability issues

[Ángel <[e-mail]>]

On 2022-02-06 at 18:39 +0000, Klaus Frank wrote:
> >> Like:
> >> If the DNS64 server receives a SPF-record (within either the TXT-
> RR or the SPF-RR [RFC4408]) containing the "ip4" mechanism it MUST
> rewrites the ipv4 address according to the same rules as A-records
> are and synthesizes a new SPF record within the response that
> contains additional "ip6" entries. The original "ip4" should not be
> removed from the response.
> > I agree there is a problem. However, I can think of “interesting”
> problems to solve, like: what if the ip4 contains a prefix, like
> 192.168.1.0/25. How would you translate this into IPv6 prefix by the
> DNS-64?
> Literally, your address of 192.168.1.0 would be e.g.
> ::ffff:c0a8:0100 and the prefix would just be 25+96

Ok, what about a component of "exists:%{ir}.list.dnswl.org" ?


A rewriting DNS64 dns server would need to keep track of spf queries,
learn that *.list.dnswl.org is special with a %{ir} pattern, and
rewrite queries matching that pattern with their ipv6 prefix into the
ipv4 one. Maybe they could rewrite into a pattern
like exists:%{ir}.list.dnswl.org.spfirexists.theirdomain.com which
tells it how it should be mapped, but it gets ugly really quick.

Having the SPF validator know about their IPv6 prefix -or, simply,
translate the IPv6 back into IPv4 before passing the address to the SPF
module- looks like a cleaner approach.

Best regards