Subject: [spfbis] Issue: Section 5.7 "Exists" - needs clarification

From: Hector Santos <[email-masked]>
Date: Fri, 10 Aug 2012 16:08:58 -0400

A major banking customer had a problem sending mail to us today and 
reviewing the issue, it appears they are now outsourcing outbound mail 
with another service as part of their hardfail SPF policy.

It turned out our SPF implementation of the EXISTS mechanism (section 
5.7) followed that of an A mechanism with the misunderstanding it was 
looking for a A record MATCH of the connecting of IP.

Working with Scott off list to get clarification, I believe this 
section needs some work.

First, the statement in the section:

    This mechanism enables queries that mimic the style of tests that
    existing anti-spam DNS blacklists (DNSBL) use.

Would only be correct if the -exists (prefixed with negative) is used. 
Only then, would it be mimicking an RBL operation to emulate the idea 
of lack of an record.  With the implicit +exists behavior, the 
existing of a record is the positive result.

I only wish to point out the possible confusion and look to others to 
prepare some proposed text to clarify it. Here is some starting points 
I think needs to be made:

    The specific -exists mechanism (negative qualifier) enables 
queries that
    mimic the style of tests that existing anti-spam DNS blacklists 
(DNSBL) use
    which suggest the lack of a record is a negative result and ends 
any further
    mechanism processing.  If the implicit positive qualifier is used, 
then the
    existence of a reply yields a match for the mechanism.

If I have the following logic correct, I would consider adding an 
binary logic table too if that make sense and easier for coders to follow:

               SPF result for exists command
+-----------------------------------------------+
|            | -exists        |  +exists        |
|===============================================|
| reply      | negative/exit  |  positive/exit  |
|------------+----------------+-----------------|
| no reply   | continue       |  continue       |
+-----------------------------------------------+

I'm sure others can write this better than I can.

-- 
HLS

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 14 Aug 2012 08:45:02 +0200

On Fri 10/Aug/2012 22:08:58 +0200 Hector Santos wrote:
> prepare some proposed text to clarify it.

It is enough to s/DNS blacklists/DNS-based lists/.  To informatively
cite RFC 6371 may be a useful addition.

I hope Scott will fix this issue as soon as he posts 4408bis-04.

I agree further clarifications on the use of "exists" with whitelists
are also needed.  But they deserve additional discussion, and will
most likely go in different sections of the document.  Hence, they
belong to a different issue.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 14 Aug 2012 12:26:40 -0700

> cite RFC 6371 may be a useful addition.

That's an MPLS RFC.  Which one did you mean?

-MSK

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 15 Aug 2012 09:56:12 +0200

> That's an MPLS RFC.  Which one did you mean?

Ooops, I meant 6471, Overview of Best Email DNS-Based List (DNSBL)
Operational Practices.  Its title already ratifies the use of a
color-free acronym expansion.

Thanks for the catch