Subject: [spfbis] a tool to map/diagnose SPF records

From: Tim Draegen <[email-masked]>
Date: Sun, 16 Dec 2012 21:34:12 -0500

Heyo WG,

I just finished pushing out a tool to help map and diagnose SPF records.  I made this to help in my quest to demystify how SPF records work (and how they break and therefore need to be fixed).

Here are three domains that show errors of different sorts.  I've already reached out to appropriate parties about these errors.  I am in no ways trying to shame any organizations, merely trying to show that more tools are needed to help people do the right thing.

FSROUND.ORG
http://dmarcian.com/spf-survey/fsround.org

OUTLOOK.COM
http://dmarcian.com/spf-survey/outlook.com

EXACTTARGET.COM
http://dmarcian.com/spf-survey/exacttarget.com

Have fun!
=- Tim

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Mon, 17 Dec 2012 22:15:50 +0100

Hi, Tim,

On 12/17/2012 03:34 AM, Tim Draegen wrote:
> Heyo WG,
>
> I just finished pushing out a tool to help map and diagnose SPF 
> records.  I made this to help in my quest to demystify how SPF records 
> work (and how they break and therefore need to be fixed).
>
> Here are three domains that show errors of different sorts.  I've 
> already reached out to appropriate parties about these errors.  I am 
> in no ways trying to shame any organizations, merely trying to show 
> that more tools are needed to help people do the right thing.
>
>
> FSROUND.ORG <http://fsround.org/>
> OUTLOOK.COM <http://outlook.com/>
> EXACTTARGET.COM <http://exacttarget.com/>

thanks for providing this tool. Like the other tools you provide us 
with, it looks great! One question: if I check my own domain 
(sonnection.nl), I get a correct result with '1 DNS queries required to 
resolve record'. However, the 'mx' part of the SPF record is not 
resolved to IP address(es). Resolving mx would result in additional DNS 
lookups and the total number would be more than 1. Am I misinterpreting 
the output of the tool, or should mx resolution be part of the picture?

Regards,
/rolf

---

From: Tim Draegen <[email-masked]>
Date: Mon, 17 Dec 2012 17:03:41 -0500

On Dec 17, 2012, at 4:15 PM, "Rolf E. Sonneveld" <[email-masked]> wrote:
> thanks for providing this tool. Like the other tools you provide us with, it looks great! One question: if I check my own domain (sonnection.nl), I get a correct result with '1 DNS queries required to resolve record'. However, the 'mx' part of the SPF record is not resolved to IP address(es). Resolving mx would result in additional DNS lookups and the total number would be more than 1. Am I misinterpreting the output of the tool, or should mx resolution be part of the picture?

Thanks rolf!

If you click on the node, it'll expand to show all of the "leaf" IP addresses for the various mechanisms.  Doing that will show:

mx:88.198.59.243
mx:88.198.59.230
mx:88.198.59.241
mx:78.46.16.237
mx:78.46.16.213
mx:78.46.16.236

HTH,
=- Tim

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Mon, 17 Dec 2012 23:27:03 +0100

On 12/17/2012 11:03 PM, Tim Draegen wrote:
> On Dec 17, 2012, at 4:15 PM, "Rolf E. Sonneveld" 
> <[email-masked] <mailto:[email-masked]>> wrote:
>> (sonnection.nl <http://sonnection.nl/>), I get a correct result with 
>> '1 DNS queries required to resolve record'. However, the 'mx' part of 
>> the SPF record is not resolved to IP address(es). Resolving mx would 
>> result in additional DNS lookups and the total number would be more 
>> than 1. Am I misinterpreting the output of the tool, or should mx 
>> resolution be part of the picture?
>
> Thanks rolf!
>
> If you click on the node, it'll expand to show all of the "leaf" IP 
> addresses for the various mechanisms.  Doing that will show:
>
> mx:88.198.59.243
>
> 	
> mx:88.198.59.230
>
> 	
> mx:88.198.59.241
>
> 	
> mx:78.46.16.237
>
> 	
> mx:78.46.16.213
>
> 	
> mx:78.46.16.236
>
>
> HTH,

Sure! So, the '1 DNS queries required' is pertaining to the MX lookup, 
not the TXT/SPF query for the domain?

/rolf