Re: [spfbis] Fwd: RFC 7208 SPF - 4.6.4. DNS Lookup Limits increase

[Simon Gnieslaw <[e-mail]>]

Thanks for the reply John,

I am primarily a sysadmin and therefore my focus to put in a solution which
is for the most part just set and forget.

These workarounds to automate or semi-automate the spf flattening have a
lot of moving parts, take effort to understand and set up on a somewhere,
give favouritism to popular DNS providers (who have APIs), and there is a
high potential for failure if not monitored, especially as failures could
be subtle by not realising that only some email is failing SPF/going to
spam or some recipient servers are being strict about the 10 record limit.

I am not familiar with IETF prossesses, is there a pathway that these
relatively small changes can be discussed and amended?

What bought this on for me last year was an overzealous ISP popular for
their email address rejecting emails due to the 10 lookup limit and when
trying to discuss it with them got the old "We are just following the spec!
It is you who is wrong".

They are technically correct (The best kind) but that still leaves regular
folk without a good solution because at the end of the day their email is
not getting delivered to those who need it because of a technicality, and
isn't an easy fix. It annoyed me a bit that the spec was putting me into
this position.

Computational power is ever increasing and the cost of DNS queries is
cheap. Even just loading a typical webpage these days would probably result
in dozens of DNS queries, I think that a few extra from email could be
handled by just fine especially as it's already common to exceed the 10.

And besides, if we want to be efficient with queries, we should be
mandating that it's the 3rd party provider who maintains the include: to be
the ones who flatten, then we could pull in up to 10 pre-flattened records.

Simon.

On Mon, 25 Apr. 2022, 3:37 am John Levine, <[e-mail]> wrote:

> It appears that Simon Gnieslaw  <[e-mail]> said:
> >Basically I just have a small issue with "4.6.4.  DNS Lookup Limits"
> >limited to just 10 lookups.
>
> I agree that if we were designing SPF now we would probably make the
> limit larger. But there are currently no plans to update RFC 7408 so it's
> not likely to change any time soon.
>
> If you care about this, it is not hard to fix. The excess lookups are
> invariably due to nested includes, so if you flatten the records,
> you're well under the limit. There are lots of packages to do the
> flattening automatically, e.g.:
>
> https://pypi.org/project/sender-policy-flattener/
>
> https://pypi.org/project/cfspflat/
>
> https://github.com/spf-tools/spf-tools
>
> R's,
> John
>