Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

[Mark Alley <[e-mail]>]

Apologies - clarifying missed typos, results should reflect the below.

Permerror on >10 IP addresses total across all MX name records (sum) - No
Permerror on >10 IP addresses per MX name A record result - No

On 1/15/2023 11:23 AM, Mark Alley wrote:
>
> I did some experimenting with several receivers to determine major 
> consumer ESPs/filters interpretations of the MX lookup section I 
> brought up before. Below are the various potential interpretation 
> results (including incorrect ones).
>
> It appears that most receivers do not implement this particular 
> section at all for an unknown reason. So far, of the filters I've 
> tested/had access to, Proofpoint and SpamAssassin both interpret the 
> second section of the MX lookups as expected (Permerror on >10 MX name 
> A records), but *no* ESP I have tested with appears to include the MX 
> RRs to the SPF record DNS lookup count as one would expect per the 
> existing language.
>
> Perhaps is there a valid reason there seems to be this many 
> inconsistencies with this particular section's implementation?
>
>
> *SpamAssassin:*
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - *Yes*
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Proofpoint:*
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - *Yes*
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Google:*
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Exchange Online:*
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Outlook:*
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Yahoo:*
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Zohomail: *
> Permerror on 10 IP addresses total across all MX name records (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *Fastmail:*
> Permerror on 10 IP addresses total across all MX name name records 
> (sum) - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
> *AOL:*
> Permerror on 10 IP addresses sum total across all MX name records - No
> Permerror on 10 IP addresses per MX name A record result - No
> Permerror on >10 MX name A records - No
> Permerror on 9 MX name records and 2 or more additional DNS term 
> lookups - No
>
>
> - Mark Alley
>
> On 1/13/2023 2:09 PM, Mark Alley wrote:
>>
>> Hi all, I have two questions about section 4.6.4 regarding "mx" 
>> mechanism DNS lookup counts during SPF evaluation that I would like 
>> some guidance on. I haven't been able to find anything regarding this 
>> topic specifically in the ML archive aside from one niche topic 
>> relating to the MX AAAA ipv6 queries counting as void lookups.
>>
>> ------------------------------------
>>
>> First, checking logic implementations of the "mx" mechanism DNS 
>> lookup count of various SPF validator tools compared to the logic 
>> described in section 4.6.4, I discovered implementation 
>> inconsistencies that have led me to question what the "correct" logic 
>> is for counting MX lookups in an SPF record. There are 12 SPF 
>> validators on the internet that seem to skip over this during lookup 
>> counting (many from well-established vendors), and only 3 that do not.
>>
>> So, given this, based on the below information, which is the correct 
>> counting interpretation?
>>
>> There is a domain - katrinafox.com - which has an SPF record that 
>> looks like this:
>>
>> /v=spf1 +a +mx +ip4:35.213.205.66 include:_spf.mailspamprotection.com 
>> ~all/
>>
>> Breaking down DNS lookups manually, we get this:
>>
>> 1 - "a" mechanism
>>
>> 4 - "mx" mechanism (1 initial MX record lookup, +3 A/AAAA MX names 
>> returned)
>>
>> 4 - "include" mechanism (1 initial include lookup, +3 recursive includes)
>>
>> Per the first paragraph of section 4.6.4, it reads as such: "/When 
>> evaluating the "mx" mechanism, the number of "MX" resource//records 
>> queried is included in the overall limit of 10 mechanisms///modifiers 
>> that cause DNS lookups as described above."/
>>
>> My interpretation is that the language is clear; the MX names (A/AAAA 
>> RRs) returned by the MX query are counted against the overall 10 
>> lookup count of the evaluated SPF record. Leaving this domain's SPF 
>> record with a total of 9 lookups. However, the overwhelming majority 
>> of SPF validator tools (and I haven't even started researching 
>> receiver-side logic implementations of this yet) seem to implement 
>> this /skipping/ the MX query returned names as part of the lookup 
>> count, which leaves the lookup count for this domain at 6.
>>
>> ------------------------------------
>>
>> Second, addressing the second sentence of the second paragraph in 
>> 4.6.4 (which continues the context of the last above question): "/In 
>> addition to that limit, the evaluation of each "MX" record MUST NOT 
>> result in querying more than 10 address records -- either "A" or 
>> "AAAA" resource records./"
>>
>> There seems to be the same inconsistencies among SPF validator tools 
>> for this logic as well. Three tools, one being MXtoolbox, say this 
>> domain has "too many IP addresses returned from the MX query" (of 
>> which there are well over 10 total), which results in their 
>> evaluation returning "permerror".
>>
>> It seems some implementors have interpreted the "10 address records" 
>> phrase to mean "/the number of IP address records //resulting //from 
>> an MX name A/AAAA RR query/", rather than "/the total sum of the MX 
>> names themselves/", as would seem described by the section's 
>> language. Of my interpretation from this section's language, it would 
>> seem this domain should exceed neither the SPF lookup count, nor the 
>> MX A/AAAA query count.
>>
>> Which is the most accurate interpretation of this section?
>>
>> Thanks,
>>
>> - Mark Alley
>>
>>
>>
>>