Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

[John R Levine <[e-mail]>]

> May be the more relevant question is would these large companies with many 
> MXs use "mx" in their SPF record?

I agree that it's unlikely to find MX in any but the smallest mail 
systems, since it means they use the same host for inbound and outbound 
mail.



>
> ;; ANSWER SECTION:
> comcast.net.        7200    IN    TXT    "v=spf1 ip4:96.103.146.48/28 
> ip4:96.102.19.32/28 ip4:96.102.200.0/28 include:_spfv6.comcast.net 
> include:_spf.mdp.comcast.net ~all"
>
> efficient with precise and small ip block space for their mail servers
>
> ;; ANSWER SECTION:
> yahoo.com.        1137    IN    TXT 
> "_globalsign-domain-verification=8DPEanqC-w2Z26VeL5Sn4zBI7cZPCFqrNU5dMKMKeP"
> yahoo.com.        1137    IN    TXT 
> "google-site-verification=xoBvU6aKxP0gYgNL0iXqF0EccAg6nFrO7XxsHnc3iNQ"
> yahoo.com.        1137    IN    TXT 
> "google-site-verification=w4N2bNopAWw1xYrdXKORILxx-WW3_LIiyX6dIMIidgk"
> yahoo.com.        1137    IN    TXT 
> "google-site-verification=Z3-Vh6zqUMgybVH4wQl1GxKSKN7JE13kyCyeZ3TZZ-I"
> yahoo.com.        1137    IN    TXT    "v=spf1 redirect=_spf.mail.yahoo.com"
> yahoo.com.        1137    IN    TXT    "edb3bff2c0d64622a9b2250438277a59"
> yahoo.com.        1137    IN    TXT    "Zoom=13284637"
> yahoo.com.        1137    IN    TXT 
> "facebook-domain-verification=gysqrcd69g0ej34f4jfn0huivkym1p"
> yahoo.com.        1137    IN    TXT 
> "google-site-verification=2b8irRvU5a2h4Mb-H_fdqNrqWjS00qmPfPcWqm8BhxI"
>
> What a horrific example of TXT record pollution, the door to which was opened 
> by SPF ....
>
> ;; ANSWER SECTION:
> _spf.mail.yahoo.com.    1094    IN    TXT    "v=spf1 ptr:yahoo.com 
> ptr:yahoo.net ?all"
>
> On 2023-01-22 19:51, Tim Wicinski wrote:
>
>> I am always happy when I'm proven wrong. Thanks Mr. John.
>> 
>> tim
>> 
>> On Sun, Jan 22, 2023 at 10:13 PM John Levine <[e-mail]> wrote:
>> 
>>> It appears that Tim Wicinski  <[e-mail]> said:
>>>> I also feel that technology stacks have matured over time.  Jan, do you 
>>>> see
>>>> real world examples of a domain with 11 MX servers?
>>> 
>>> Well, there's Comcast:
>>> 
>>> $ host -t mx comcast.net [1]
>>> comcast.net [1] mail is handled by 50 mx1a1.comcast.net [2].
>>> comcast.net [1] mail is handled by 5 mx2.mxge.comcast.net [3].
>>> comcast.net [1] mail is handled by 50 mx2a1.comcast.net [4].
>>> comcast.net [1] mail is handled by 50 mx1c1.comcast.net [5].
>>> comcast.net [1] mail is handled by 5 mx1.mxge.comcast.net [6].
>>> comcast.net [1] mail is handled by 50 mx2c1.comcast.net [7].
>>> comcast.net [1] mail is handled by 50 mx1h1.comcast.net [8].
>>> comcast.net [1] mail is handled by 50 mx2h1.comcast.net [9].
>>> 
>>> And there's Yahoo, but its MX is only four lookups:
>>> 
>>> $ host -t mx yahoo.com [10]
>>> yahoo.com [10] mail is handled by 1 mta6.am0.yahoodns.net [11].
>>> yahoo.com [10] mail is handled by 1 mta7.am0.yahoodns.net [12].
>>> yahoo.com [10] mail is handled by 1 mta5.am0.yahoodns.net [13].
>>> 
>>> $ host mta5.am0.yahoodns.net [13].
>>> mta5.am0.yahoodns.net [13] has address 67.195.228.109
>>> mta5.am0.yahoodns.net [13] has address 98.136.96.76
>>> mta5.am0.yahoodns.net [13] has address 67.195.204.72
>>> mta5.am0.yahoodns.net [13] has address 67.195.204.79
>>> mta5.am0.yahoodns.net [13] has address 67.195.228.111
>>> mta5.am0.yahoodns.net [13] has address 98.136.96.77
>>> mta5.am0.yahoodns.net [13] has address 67.195.228.110
>>> mta5.am0.yahoodns.net [13] has address 98.136.96.91
>>> $ host mta6.am0.yahoodns.net [11].
>>> mta6.am0.yahoodns.net [11] has address 67.195.204.74
>>> mta6.am0.yahoodns.net [11] has address 98.136.96.76
>>> mta6.am0.yahoodns.net [11] has address 67.195.228.110
>>> mta6.am0.yahoodns.net [11] has address 67.195.204.79
>>> mta6.am0.yahoodns.net [11] has address 67.195.204.77
>>> mta6.am0.yahoodns.net [11] has address 67.195.228.111
>>> mta6.am0.yahoodns.net [11] has address 67.195.228.94
>>> mta6.am0.yahoodns.net [11] has address 98.136.96.77
>>> $ host mta7.am0.yahoodns.net [12].
>>> mta7.am0.yahoodns.net [12] has address 67.195.204.79
>>> mta7.am0.yahoodns.net [12] has address 67.195.204.77
>>> mta7.am0.yahoodns.net [12] has address 98.136.96.91
>>> mta7.am0.yahoodns.net [12] has address 67.195.228.111
>>> mta7.am0.yahoodns.net [12] has address 67.195.228.106
>>> mta7.am0.yahoodns.net [12] has address 67.195.228.94
>>> mta7.am0.yahoodns.net [12] has address 67.195.204.72
>>> mta7.am0.yahoodns.net [12] has address 98.136.96.77
>>> 
>>> And Charter:
>>> 
>>> $ host -t mx charter.com [14]
>>> charter.com [14] mail is handled by 10 nce.mail.chartercom.com [15].
>>> charter.com [14] mail is handled by 10 ncw.mail.chartercom.com [16].
>>> 
>>> $ host nce.mail.chartercom.com [15].
>>> nce.mail.chartercom.com [15] has address 142.136.234.134
>>> nce.mail.chartercom.com [15] has address 142.136.234.135
>>> nce.mail.chartercom.com [15] has address 142.136.234.136
>>> nce.mail.chartercom.com [15] has address 142.136.234.137
>>> nce.mail.chartercom.com [15] has address 142.136.234.138
>>> nce.mail.chartercom.com [15] has address 142.136.234.139
>>> nce.mail.chartercom.com [15] has address 142.136.234.142
>>> nce.mail.chartercom.com [15] has address 142.136.234.143
>>> nce.mail.chartercom.com [15] has address 142.136.234.144
>>> 
>>> $ host ncw.mail.chartercom.com [16].
>>> ncw.mail.chartercom.com [16] has address 142.136.235.134
>>> ncw.mail.chartercom.com [16] has address 142.136.235.135
>>> ncw.mail.chartercom.com [16] has address 142.136.235.136
>>> ncw.mail.chartercom.com [16] has address 142.136.235.137
>>> ncw.mail.chartercom.com [16] has address 142.136.235.138
>>> ncw.mail.chartercom.com [16] has address 142.136.235.139
>>> ncw.mail.chartercom.com [16] has address 142.136.235.142
>>> ncw.mail.chartercom.com [16] has address 142.136.235.143
>>> ncw.mail.chartercom.com [16] has address 142.136.235.144
>>> 
>>> I occasionally see spammy looking hosts with a lot
>>> of MX'es but if their SPF checks fail, who cares.
>>> 
>>> R's,
>>> John
>> 
>> _______________________________________________
>> spfbis mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/spfbis
>
>
> Links:
> ------
> [1] http://comcast.net
> [2] http://mx1a1.comcast.net
> [3] http://mx2.mxge.comcast.net
> [4] http://mx2a1.comcast.net
> [5] http://mx1c1.comcast.net
> [6] http://mx1.mxge.comcast.net
> [7] http://mx2c1.comcast.net
> [8] http://mx1h1.comcast.net
> [9] http://mx2h1.comcast.net
> [10] http://yahoo.com
> [11] http://mta6.am0.yahoodns.net
> [12] http://mta7.am0.yahoodns.net
> [13] http://mta5.am0.yahoodns.net
> [14] http://charter.com
> [15] http://nce.mail.chartercom.com
> [16] http://ncw.mail.chartercom.com

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly