Subject: [spfbis] New issue: limit recursive use of the include mechanism

From: Alessandro Vesely <[email-masked]>
Date: Fri, 06 Jul 2012 14:58:44 +0200

9.1.1. *DNS Resource Considerations*

Is it worth to add an example for very large organizations that need
to split authorization management into a number of departments?  If
they "include" internally the chains grow too long.  IMHO, they'd
better use "exists" and move authorization management to a purposely
implemented whitelist-publishing tool.

Consider a domain with three external smart hosts, corresponding to as
many organizations.  Thus we may have:

  domain.example.       TXT   "v=spf1 redirect=_spf.domain.example"
  _spf.domain.example.  TXT ( "v=spf1 ip4:192.0.2.3 "
                              "include:org1.example "
                              "include:org2.example "
                              "include:org3.example "
                              "-all" )

Each orgX.example may use up to two queries, because using three or
more would exceed the limit of 10.

The client domain, who is publishing three "include"s, must not in
turn provide relaying services to third parties.  Before doing that,
it should set up a mashup of the relevant zones and use "exists".
Ditto if they want more than three external smart hosts.

Thoughts?

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 06 Jul 2012 09:46:46 -0400

> Ditto if they want more than three external smart hosts.

I don't object to additional examples.  I'm not sure that we should 
specifically recommend exists: as it brings it's own set of burdens.  I think 
it's worthwhile to say that in these cases the included records really ought 
to use ip4/ip6 mechanisms.  

Similarly, we should probably say something similar in section 9.3.  If your 
record is going to be included in someone else's record ip4/ip6 is essential.  
I had this exact problem come up with an ISP server I used to use.  Their 
record was OK, but it used the exact limit of 10, so if anyone included it, 
that record failed.  Fortunately I was able explain it to them and fix it, but 
some guidance on this seems prudent.

Scott K