Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

[Mark Alley <[e-mail]>]

I did some experimenting with several receivers to determine major 
consumer ESPs/filters interpretations of the MX lookup section I brought 
up before. Below are the various potential interpretation results 
(including incorrect ones).

It appears that most receivers do not implement this particular section 
at all for an unknown reason. So far, of the filters I've tested/had 
access to, Proofpoint and SpamAssassin both interpret the second section 
of the MX lookups as expected (Permerror on >10 MX name A records), but 
*no* ESP I have tested with appears to include the MX RRs to the SPF 
record DNS lookup count as one would expect per the existing language.

Perhaps is there a valid reason there seems to be this many 
inconsistencies with this particular section's implementation?


*SpamAssassin:*
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - *Yes*
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Proofpoint:*
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - *Yes*
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Google:*
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Exchange Online:*
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Outlook:*
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Yahoo:*
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Zohomail: *
Permerror on 10 IP addresses total across all MX name records (sum) - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*Fastmail:*
Permerror on 10 IP addresses total across all MX name name records (sum) 
- No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No

*AOL:*
Permerror on 10 IP addresses sum total across all MX name records - No
Permerror on 10 IP addresses per MX name A record result - No
Permerror on >10 MX name A records - No
Permerror on 9 MX name records and 2 or more additional DNS term lookups 
- No


- Mark Alley

On 1/13/2023 2:09 PM, Mark Alley wrote:
>
> Hi all, I have two questions about section 4.6.4 regarding "mx" 
> mechanism DNS lookup counts during SPF evaluation that I would like 
> some guidance on. I haven't been able to find anything regarding this 
> topic specifically in the ML archive aside from one niche topic 
> relating to the MX AAAA ipv6 queries counting as void lookups.
>
> ------------------------------------
>
> First, checking logic implementations of the "mx" mechanism DNS lookup 
> count of various SPF validator tools compared to the logic described 
> in section 4.6.4, I discovered implementation inconsistencies that 
> have led me to question what the "correct" logic is for counting MX 
> lookups in an SPF record. There are 12 SPF validators on the internet 
> that seem to skip over this during lookup counting (many from 
> well-established vendors), and only 3 that do not.
>
> So, given this, based on the below information, which is the correct 
> counting interpretation?
>
> There is a domain - katrinafox.com - which has an SPF record that 
> looks like this:
>
> /v=spf1 +a +mx +ip4:35.213.205.66 include:_spf.mailspamprotection.com 
> ~all/
>
> Breaking down DNS lookups manually, we get this:
>
> 1 - "a" mechanism
>
> 4 - "mx" mechanism (1 initial MX record lookup, +3 A/AAAA MX names 
> returned)
>
> 4 - "include" mechanism (1 initial include lookup, +3 recursive includes)
>
> Per the first paragraph of section 4.6.4, it reads as such: "/When 
> evaluating the "mx" mechanism, the number of "MX" resource//records 
> queried is included in the overall limit of 10 mechanisms///modifiers 
> that cause DNS lookups as described above."/
>
> My interpretation is that the language is clear; the MX names (A/AAAA 
> RRs) returned by the MX query are counted against the overall 10 
> lookup count of the evaluated SPF record. Leaving this domain's SPF 
> record with a total of 9 lookups. However, the overwhelming majority 
> of SPF validator tools (and I haven't even started researching 
> receiver-side logic implementations of this yet) seem to implement 
> this /skipping/ the MX query returned names as part of the lookup 
> count, which leaves the lookup count for this domain at 6.
>
> ------------------------------------
>
> Second, addressing the second sentence of the second paragraph in 
> 4.6.4 (which continues the context of the last above question): "/In 
> addition to that limit, the evaluation of each "MX" record MUST NOT 
> result in querying more than 10 address records -- either "A" or 
> "AAAA" resource records./"
>
> There seems to be the same inconsistencies among SPF validator tools 
> for this logic as well. Three tools, one being MXtoolbox, say this 
> domain has "too many IP addresses returned from the MX query" (of 
> which there are well over 10 total), which results in their evaluation 
> returning "permerror".
>
> It seems some implementors have interpreted the "10 address records" 
> phrase to mean "/the number of IP address records //resulting //from 
> an MX name A/AAAA RR query/", rather than "/the total sum of the MX 
> names themselves/", as would seem described by the section's language. 
> Of my interpretation from this section's language, it would seem this 
> domain should exceed neither the SPF lookup count, nor the MX A/AAAA 
> query count.
>
> Which is the most accurate interpretation of this section?
>
> Thanks,
>
> - Mark Alley
>
>
>
>