Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

[Jan Schaumann <[e-mail]>]

Scott Kitterman <[e-mail]> wrote:

> Moving forward, here's the full text specific to MX from RFC 7208, Section 
> 4.6.4:
> 
> >    When evaluating the "mx" mechanism, the number of "MX" resource
> >    records queried is included in the overall limit of 10 mechanisms/
> >    modifiers that cause DNS lookups as described above.  In addition to
> >    that limit, the evaluation of each "MX" record MUST NOT result in
> >    querying more than 10 address records -- either "A" or "AAAA"
> >    resource records.  If this limit is exceeded, the "mx" mechanism MUST
> >    produce a "permerror" result.
> 
> In the example you gave, only the +mx lookup counts against the overall limit.  
> "MX" resource records are exactly that.  The address records (A/AAAA) are 
> counted separately as clearly indicated in the sentence after the one you 
> quoted.  

> I think you need to go back and revisit you assessment of how these work as I 
> don't think it's correct.  We struggled with this in the SPFbis working group 
> as it was very difficult to come up with clear and accurate language, so I'm not 
> surprised to see it's not immediately obvious what we meant.

I'm afraid the intent is still ambiguous.

Could you clarify by example:

$ dig +short txt example.com
v=spfv1 +a +mx -all
$ dig +short mx example.com
10 a.example.com
20 b.example.com
$ 

Is it 2 (one for the 'a' lookup, and one for the
'mx'), or is it 4 (one for the 'a' lookup, one for the
'mx' lookup, and, because MX records return host names
and IP addresses, an additional lookup for each MX
record returned)?

-Jan