Re: [spfbis] [dmarc-ietf] SPF doesn't accommodate third level .name domains?

While _spf suffix is cleaner and good practice it is not even necessary. 
It would be enough to just have:
  bustos.name. IN TXT "v=spf1 include:%{l}.bustos.name ?all

Seems to me users should be responsible for maintaining their SPF 
records under .name subdomains which this person does:
;; ANSWER SECTION:
david.bustos.name.      3600    IN      TXT     "v=spf1 
include:spf.messagingengine.com ?all"

And .name could potentially even do it using a single catch-all TXT 
record at .name root (I think it would work, correct me if not):
*.name. IN TXT "v=spf1 include:%{l}.%{o} ?all"
I doubt .name wants it universally for all its subdomains though.

To be fair, this is hardly the first time someone finds that when they 
use another email provider for reading and sending emails but have a 
forwarded email address, they may have issues. Google had allowed it for 
a long time but recently changed it so that when you use them for email 
and want to reply back from another (forwarded) email address, you must 
provide google the SMTP server authentication information for your email 
provider and they then forward email through them first. One of the 
reasons may have been that many people did not have SPF records that 
included google servers.

On 2022-06-03 13:02, John Levine wrote:

> [[ replies once again directed to spfbis ]]
> 
>> SPF should be able to handle this situation using macros anyway:
>> 
>> bustos.name. IN TXT "v=spf1 include:%{l}._spf.bustos.name -all"
>> david._spf.bustos.name. IN TXT "v=spf1 
>> redirect=david's-email-provider"
> 
> Except, as we may have mentioned a few times, the .name ICANN contract
> has no provision for adding SPF records like this. The registry only
> forwards incoming mail. It doesn't handle outgoing mail.
> 
> Since they've been forwarding incoming .name mail for 20 years, and 
> this is the first
> time we've seen a complaint about outgoing .name mail, perhaps this is 
> not a problem
> that needs solving.
> 
> If David used david@david.bustos.name, the domain would point to his 
> own nameservers
> and he can do whatever SPF, DKIM, or DMARC he wants.  Or if it wants a 
> 2LD, he could
> get davidbustos.name and manage the NS.  What you can't do is manage 
> the NS on a .name
> 2LD which is a last name.
> 
> R's,
> John
> 
> _______________________________________________
> spfbis mailing list
> spfbis@ietf.org
> https://www.ietf.org/mailman/listinfo/spfbis