[spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

[Mark Alley <[e-mail]>]

Hi all, I have two questions about section 4.6.4 regarding "mx" 
mechanism DNS lookup counts during SPF evaluation that I would like some 
guidance on. I haven't been able to find anything regarding this topic 
specifically in the ML archive aside from one niche topic relating to 
the MX AAAA ipv6 queries counting as void lookups.

------------------------------------

First, checking logic implementations of the "mx" mechanism DNS lookup 
count of various SPF validator tools compared to the logic described in 
section 4.6.4, I discovered implementation inconsistencies that have led 
me to question what the "correct" logic is for counting MX lookups in an 
SPF record. There are 12 SPF validators on the internet that seem to 
skip over this during lookup counting (many from well-established 
vendors), and only 3 that do not.

So, given this, based on the below information, which is the correct 
counting interpretation?

There is a domain - katrinafox.com - which has an SPF record that looks 
like this:

/v=spf1 +a +mx +ip4:35.213.205.66 include:_spf.mailspamprotection.com ~all/

Breaking down DNS lookups manually, we get this:

1 - "a" mechanism

4 - "mx" mechanism (1 initial MX record lookup, +3 A/AAAA MX names returned)

4 - "include" mechanism (1 initial include lookup, +3 recursive includes)

Per the first paragraph of section 4.6.4, it reads as such: "/When 
evaluating the "mx" mechanism, the number of "MX" resource//records 
queried is included in the overall limit of 10 mechanisms///modifiers 
that cause DNS lookups as described above."/

My interpretation is that the language is clear; the MX names (A/AAAA 
RRs) returned by the MX query are counted against the overall 10 lookup 
count of the evaluated SPF record. Leaving this domain's SPF record with 
a total of 9 lookups. However, the overwhelming majority of SPF 
validator tools (and I haven't even started researching receiver-side 
logic implementations of this yet) seem to implement this /skipping/ the 
MX query returned names as part of the lookup count, which leaves the 
lookup count for this domain at 6.

------------------------------------

Second, addressing the second sentence of the second paragraph in 4.6.4 
(which continues the context of the last above question): "/In addition 
to that limit, the evaluation of each "MX" record MUST NOT result in 
querying more than 10 address records -- either "A" or "AAAA" resource 
records./"

There seems to be the same inconsistencies among SPF validator tools for 
this logic as well. Three tools, one being MXtoolbox, say this domain 
has "too many IP addresses returned from the MX query" (of which there 
are well over 10 total), which results in their evaluation returning 
"permerror".

It seems some implementors have interpreted the "10 address records" 
phrase to mean "/the number of IP address records //resulting //from an 
MX name A/AAAA RR query/", rather than "/the total sum of the MX names 
themselves/", as would seem described by the section's language. Of my 
interpretation from this section's language, it would seem this domain 
should exceed neither the SPF lookup count, nor the MX A/AAAA query count.

Which is the most accurate interpretation of this section?

Thanks,

- Mark Alley