IETF Logo Mail Archive

Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies

Jan Schaumann <jschauma@netmeister.org> Sun, 15 January 2023 23:17 UTC

Return-Path: <jschauma@netmeister.org>
X-Original-To: spfbis@ietfa.amsl.com
Delivered-To: spfbis@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E4E5C14F74E for <spfbis@ietfa.amsl.com>; Sun, 15 Jan 2023 15:17:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=netmeister.org
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9k9Vuaf1bSay for <spfbis@ietfa.amsl.com>; Sun, 15 Jan 2023 15:17:36 -0800 (PST)
Received: from panix.netmeister.org (panix.netmeister.org [IPv6:2001:470:30:84:e276:63ff:fe72:3900]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6BE24C14E511 for <spfbis@ietf.org>; Sun, 15 Jan 2023 15:17:35 -0800 (PST)
Received: by panix.netmeister.org (Postfix, from userid 1000) id 9841885861; Sun, 15 Jan 2023 18:17:34 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=netmeister.org; s=2023; t=1673824654; bh=YUb7+seOkG6BU4Q6tLjSUIVnYUpu5jXqun/Dffct3rA=; h=From:To:Subject:Content-Type:From:To:Subject; b=NUVRqwGM5j/pNNTlt7QEgFu9M0n85To6UMVEHB6nRRJxu3s9917IRuXcotrgkrlLj E9SWotSbwEpYlEmNpz3pkDwzoJmsLn0owR1+phdj6cDNQSGnaTIAMMfQV+xlmFbixJ 1oHmSax93w9WyDSZ8CzijR4DM1ZnQd1aXsvhXzU6diVLDPB6nWWhdGHm6G1nOiDogg 8hYheQmWKjLpOKODWvwRg1y7GMGM34i15lsu0Xd7WYZAhjItKH1O/BarKBT2Ams+ZV 41/6Uel4lY3+UUwpd/sdcPaIAHEj+tpZ6zq0TV4sOydY/x9cDIkXnPU6T+25lerNYU IbbK5kpMn9xVw==
Date: Sun, 15 Jan 2023 18:17:34 -0500
From: Jan Schaumann <jschauma@netmeister.org>
To: spfbis@ietf.org
Message-ID: <Y8SJjkQTFZO/Id/Z@netmeister.org>
References: <79ac443e-b0ee-6598-cec0-9cf32c3dc1d1@tekmarc.com> <2052933.pCZHq2v93S@localhost> <Y8SCz4bC15iRa/tB@netmeister.org> <4155095.WaQZGZ3z5Y@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <4155095.WaQZGZ3z5Y@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spfbis/fIJ6H2BG6-c2WpcWzNxtJythx9k>
Subject: Re: [spfbis] RFC7208 4.6.4 Interpretation - MX Lookup Count Inconsistencies
X-BeenThere: spfbis@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: SPFbis discussion list <spfbis.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spfbis>, <mailto:spfbis-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spfbis/>
List-Post: <mailto:spfbis@ietf.org>
List-Help: <mailto:spfbis-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spfbis>, <mailto:spfbis-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 15 Jan 2023 23:17:40 -0000

Scott Kitterman <spf2@kitterman.com> wrote:

> There is the "overall" limit.  The count against the overall limit is two ('a' 
> and 'mx').

Thanks for clarifying.

I find this _very_ counterintuitive, fwiw.

My logic was roughly:

"Well, the limit should limit how many lookups I have
to make in the worst case before I can decide.  Doing
an 'mx' lookup by itself doesn't help me at all in
making that decision -- I absolutely _have_ to turn
any hostnames I get into IP addresses, so I must
necessarily perform additional lookups."

So if I'm at a DNS lookup limit of 9 when I reach the
'mx' part, and the domain has 10 MX records, I perform
10 additional lookups (which don't count to the total
limit, meaning I perform a total of 19 lookups) and
move on.

But if I'm at a DNS lookup limit of 0 when I reach the
'mx' part, and the domain has 11 MX records, then the
'mx' evaluation yields permerror and I abort.

But if that's what it is, then that's what it is. :-)

-Jan

v2.23.0 | Report a Bug | By Email