From nobody Wed Feb 26 07:04:44 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 414F53A08F6 for ; Wed, 26 Feb 2020 07:04:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.578 X-Spam-Level: ** X-Spam-Status: No, score=2.578 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FREEMAIL_FROM=0.001, FROM_LOCAL_NOVOWEL=0.5, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, KHOP_HELO_FCRDNS=0.276, SPF_FAIL=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3tyjq_RY8bAf for ; Wed, 26 Feb 2020 07:04:41 -0800 (PST) Received: from premieronline.net (mail.premieronline.net [IPv6:2607:fe28:0:4000::10]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33AF63A08E1 for ; Wed, 26 Feb 2020 07:04:41 -0800 (PST) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=199.120.69.4; envelope-from=; Received: from FBULKPC (unverified [199.120.69.4]) by premieronline.net (SurgeMail 7.4f) with ESMTP id 12387137-1729245 for ; Wed, 26 Feb 2020 09:04:38 -0600 From: "Frank Bulk" To: Date: Wed, 26 Feb 2020 09:04:37 -0600 Message-ID: <000001d5ecb6$106efd90$314cf8b0$@iname.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdXstTWAX0UO2VeETfGQ8rkT9QwrKg== Content-Language: en-us X-Originating-IP: 199.120.69.4 X-Vpipe: restarted=25 started /var/surgemail/scavs.pl (/var/surgemail/scavs.pl) X-SpamDetect: : 0.0 sd=0.0 0.04(X-myrbl:Color=white) X-LangGuess: English X-MyRbl: Color=White (rbl) Age=0 Spam=0 Notspam=0 Stars=0 Good=109 Friend=0 Surbl=0 Catch=0 r=0 ip=199.120.69.4 X-IP-stats: Incoming Last 0, First 106, in=23356, out=0, spam=0 ip=199.120.69.4 Archived-At: Subject: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Feb 2020 15:04:42 -0000 Can someone point me to a tool that would allow me to check a domain for its SPF correctness? I'm currently performing an automated daily check of a few hundred domains (friendlies) and emailing the domain owners if there's an issue. I currently use kitterman's script, but it doesn't catch all the issues that Dmarcian does and so there's a number of domains that have issues but I'm not alerting on them. Dmarcian doesn't appear to have an API or downloadable version of their tool that I can run. Frank From nobody Wed Feb 26 14:21:00 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FCA13A0913 for ; Wed, 26 Feb 2020 14:20:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=kitterman.com header.b=zhObUf1x; dkim=pass (2048-bit key) header.d=kitterman.com header.b=hAIsQTTU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ERPwYpgHUvkU for ; Wed, 26 Feb 2020 14:20:56 -0800 (PST) Received: from interserver.kitterman.com (interserver.kitterman.com [64.20.48.66]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A49913A0911 for ; Wed, 26 Feb 2020 14:20:56 -0800 (PST) Received: from interserver.kitterman.com (interserver.kitterman.com [IPv6:2604:a00:6:1039:225:90ff:feaa:b169]) by interserver.kitterman.com (Postfix) with ESMTPS id 381EEF8028D; Wed, 26 Feb 2020 17:20:55 -0500 (EST) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903e; t=1582755655; h=date : in-reply-to : references : mime-version : content-type : content-transfer-encoding : subject : to : from : message-id : from; bh=OeEwjddR8wPbQLJVuWOvgEO6bGwpt3onNfAQfGmjk5o=; b=zhObUf1xLGzpdEQj3MYBQY6ghLKf5z+saHn5e7eUPoxf2cb+uHTI8Mv51jXJbQSSYy6I8 E14RIb3JKuAH+v0DQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kitterman.com; i=@kitterman.com; q=dns/txt; s=201903r; t=1582755655; h=date : in-reply-to : references : mime-version : content-type : content-transfer-encoding : subject : to : from : message-id : from; bh=OeEwjddR8wPbQLJVuWOvgEO6bGwpt3onNfAQfGmjk5o=; b=hAIsQTTUu19gZxeQKxAyKATYtS8/lEgdLzhVN+QTaEegeNwiqtfz8fBsCw54jO+zFPFyl WuQOa5dSzp1HSRdkwrtuQDXWnQul/4a+PvxIyeN/uTFo0L1Py0I17WpRwjFe+pocfLWeGXr d3ymOQ2+bVVu9bFKUNreFcUBdkGaaL4xjxLb6csVtn5PBopfDGHJQ+XTifMkTRsMYzyL0an Zp5qySVvb+qUkWztQvgs+iAnYAY/G6ofvjlySSduzMeLPrJ+iz4TJasL9rFxNllrbbxKiuY fu84blGyybQpaZ15X8Ds0b6Df2tqGRYCbaTJCg+Dbj70qworY0I4hrCxE9sg== Received: from [10.98.203.233] (mobile-166-170-33-249.mycingular.net [166.170.33.249]) by interserver.kitterman.com (Postfix) with ESMTPSA id BECF8F801FB; Wed, 26 Feb 2020 17:20:54 -0500 (EST) Date: Wed, 26 Feb 2020 22:20:52 +0000 In-Reply-To: <000001d5ecb6$106efd90$314cf8b0$@iname.com> References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable To: spfbis@ietf.org,Frank Bulk From: Scott Kitterman Message-ID: <77BD5EFF-1B66-4AD9-ADC0-4F0F94ED7BB8@kitterman.com> Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Feb 2020 22:20:58 -0000 Can you give me an example or two? Scott K On February 26, 2020 3:04:37 PM UTC, Frank Bulk wrot= e: >Can someone point me to a tool that would allow me to check a domain >for its >SPF correctness? I'm currently performing an automated daily check of >a few >hundred domains (friendlies) and emailing the domain owners if there's >an >issue=2E =20 > >I currently use kitterman's script, but it doesn't catch all the issues >that >Dmarcian does and so there's a number of domains that have issues but >I'm >not alerting on them=2E Dmarcian doesn't appear to have an API or >downloadable >version of their tool that I can run=2E > >Frank=20 > >_______________________________________________ >spfbis mailing list >spfbis@ietf=2Eorg >https://www=2Eietf=2Eorg/mailman/listinfo/spfbis From SRS0=cpUQ2=4P==stuart@gathman.org Wed Feb 26 23:36:34 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A83423A1411 for ; Wed, 26 Feb 2020 23:36:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=gathman.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iQbBgJTwJ-_0 for ; Wed, 26 Feb 2020 23:36:33 -0800 (PST) Received: from mail.gathman.org (wiki.gathman.org [IPv6:2001:470:8:809::1010]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 613B83A13F1 for ; Wed, 26 Feb 2020 23:36:33 -0800 (PST) Authentication-Results: mail.gathman.org; iprev=pass policy.iprev="2001:470:8:809::1010" (wiki.gathman.org); auth=pass (CRAM-MD5 sslbits=256) smtp.auth=stuart DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gathman.org; i=@gathman.org; q=dns/txt; s=default; t=1582788991; h=date : from : to : cc : subject : in-reply-to : message-id : references : mime-version : content-type : date : from : subject; bh=IngGj7Q4X31kBf3uxVrujkyagiyvSjC4EgFN+7WTME8=; b=ZEzszwTL/ScWd1Ujz3xcIBpIE9PUFUnc7P0D+rSIZSEujZ+gY+ypMsmF D3T8pMYUWGZoC480DeAJLj2jL+TjFyVm3Pim5bFtdunfEi/5dPZLeOjGNp XqYRJB7jkfc8w59QbtfFluqWqRP10sRfWWuq5D2+MAP+TzNfh35fTCnc0= Received: from wiki.gathman.org (wiki.gathman.org [IPv6:2001:470:8:809::1010]) (authenticated bits=0) by mail.gathman.org (8.14.7/8.14.7) with ESMTP id 01R7aRD8002130 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 27 Feb 2020 02:36:30 -0500 Date: Thu, 27 Feb 2020 02:36:27 -0500 (EST) From: Stuart D Gathman To: Frank Bulk cc: spfbis@ietf.org In-Reply-To: <000001d5ecb6$106efd90$314cf8b0$@iname.com> Message-ID: References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Feb 2020 07:38:22 -0000 On Wed, 26 Feb 2020, Frank Bulk wrote: > I currently use kitterman's script, but it doesn't catch all the issues that > Dmarcian does and so there's a number of domains that have issues but I'm > not alerting on them. Dmarcian doesn't appear to have an API or downloadable > version of their tool that I can run. Are you checking DMARC, or SPF? If SPF, can you give an example of an incorrect policy that is not flagged? From nobody Thu Feb 27 07:58:31 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDCDC3A0BA1 for ; Thu, 27 Feb 2020 07:58:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.297 X-Spam-Level: X-Spam-Status: No, score=-0.297 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, FROM_LOCAL_NOVOWEL=0.5, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_FAIL=0.001, URIBL_BLOCKED=0.001, URI_HEX=0.1] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iF3ZI_p6pkDO for ; Thu, 27 Feb 2020 07:58:28 -0800 (PST) Received: from premieronline.net (mail.premieronline.net [IPv6:2607:fe28:0:4000::10]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D73CF3A0BA0 for ; Thu, 27 Feb 2020 07:58:27 -0800 (PST) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=199.120.69.4; envelope-from=; Received: from FBULKPC (unverified [199.120.69.4]) by premieronline.net (SurgeMail 7.4f) with ESMTP id 12508003-1729245 for multiple; Thu, 27 Feb 2020 09:56:10 -0600 From: "Frank Bulk" To: "'Stuart D Gathman'" Cc: , "'Scott Kitterman'" References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> In-Reply-To: Date: Thu, 27 Feb 2020 09:56:09 -0600 Message-ID: <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdXstTWAX0UO2VeETfGQ8rkT9QwrKgAvbOWAAAIkEGA= Content-Language: en-us X-Originating-IP: 199.120.69.4 X-Vpipe: restarted=25 started /var/surgemail/scavs.pl (/var/surgemail/scavs.pl) X-SpamDetect: : -2.8 sd=-2.8 0.04(X-myrbl:Color=white) 0.74(Received:for multiple) [nnot=1, ng=1, nsum=0, nb=0, nw=1, -6.78] X-LangGuess: English X-MyRbl: Color=White (rbl) Age=0 Spam=0 Notspam=0 Stars=0 Good=40 Friend=0 Surbl=0 Catch=0 r=0 ip=199.120.69.4 X-IP-stats: Incoming Last 0, First 107, in=23547, out=0, spam=0 ip=199.120.69.4 Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Feb 2020 15:58:30 -0000 Perhaps I'm using an old version of that Python script, but here are some examples. My best guess is that the python script stops as soon as it passes the check, but doesn't evaluate the whole record. deerequipment.com: Dmarcian notes "The target name for "include:spf.protection.outlook.com" equals an already evaluated "include" mechanism / "redirect" modifier." visionnetusa.com: Dmarcian notes "Multiple SPF records found for "visionnetusa.com". There should only be one." ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for "ghekkonetworks.com". There should only be one." billtrust.com: Dmarcian notes " A DMARC record was detected under "billtrust.com". DMARC records must be located at "_dmarc.billtrust.com", and not directly at "billtrust.com". If DMARC was set up as a wildcard record, that should be removed and placed only at the domain level." zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF record. The maximum is 10." root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 ip4:66.202.101.250 ip4:65.114.230.67 ip4:64.179.27.250 ip4:64.196.161.5 ip4:13.111.0.0/23 ip4:64.18.0.0/20 ip4:64.151.112.128/28 ip4:64.151.119.32/27 ip4:64.233.160.0/19 ip4:64.235.144.0/20 ip4:66.102.0.0/20 ip4:66.231.95.0/29 ip4:66.249.80.0/20 ip4:67.59.141.128/28 ip4:64.125.230.136/32 ip4:69.43.143.32/27 ip4:69.43.143.96/27 include:spf-0024b301.pphosted.com include:email-od.com include:_spf.salesforce.com include:_spf.google.com include:aspmx.pardot.com include:_spf.q4press.com ~all" 66.202.101.250 postmaster@zayo.com mail.zayo.com result: ('pass', 250, 'sender SPF authorized') ip4:66.202.101.250 root@nagios:/usr/local/bin/spfcheck# nocix.net: Dmarcian notes "16 DNS lookups required to evaluate the SPF record. The maximum is 10." root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 mx a ip4:204.152.38.69/32 ip4:204.152.38.70/32 ip4:204.152.38.77/32 ip4:204.152.38.72/32 a:s101.ndevix.com a:s101.chi.ndevix.com a:s102.ndevix.com a:s105.ndevix.com a:f0.mx.ndevix.com a:f102.mx.ndevix.com include:ndevix.com -all" 204.152.38.87 postmaster@nocix.net mail.nocix.net result: ('pass', 250, 'sender SPF authorized') mx root@nagios:/usr/local/bin/spfcheck# tivo.com: Dmarcian notes: Error! 30 DNS lookups required to evaluate the SPF record. The maximum is 10. Error! SPF record is present, but invalid. root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all" 204.176.49.0 postmaster@tivo.com mail.tivo.com result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com root@nagios:/usr/local/bin/spfcheck# nex-tech.com: Dmarciate notes: "SPF record is present, but invalid." root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25 ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170 include:amazonses.com a:dispatch-us.ppe-hosted.com include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com include:azure.quotevalet.com include:spf.protection.outlook.com a -all" 208.65.144.0 postmaster@nex-tech.com mail.nex-tech.com result: ('pass', 250, 'sender SPF authorized') ip4:208.65.144.0/21 root@nagios:/usr/local/bin/spfcheck# atx.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF record. The maximum is 10." root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 include:spf.protection.outlook.com include:aspmx.pardot.com include:salesforce.com -all" 40.92.0.0 postmaster@atx.com mail.atx.com result: ('pass', 250, 'sender SPF authorized') include:spf.protection.outlook.com root@nagios:/usr/local/bin/spfcheck# lewisdrug.com: Dmarciante notes: Error! 13 DNS lookups required to evaluate the SPF record. The maximum is 10. Error! SPF record is present, but invalid. root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 mx a ip4:216.12.181.71/32 ip4:216.12.181.72/32 include:_spf.google.com include:spf.createsend.com include:_netblocks.mimecast.com ~all" 207.211.30.221 postmaster@lewisdrug.com mail.lewisdrug.com result: ('pass', 250, 'sender SPF authorized') mx root@nagios:/usr/local/bin/spfcheck# Frank -----Original Message----- From: Stuart D Gathman Sent: Thursday, February 27, 2020 1:36 AM To: Frank Bulk Cc: spfbis@ietf.org Subject: Re: [spfbis] SPF-checking tool On Wed, 26 Feb 2020, Frank Bulk wrote: > I currently use kitterman's script, but it doesn't catch all the issues that > Dmarcian does and so there's a number of domains that have issues but I'm > not alerting on them. Dmarcian doesn't appear to have an API or downloadable > version of their tool that I can run. Are you checking DMARC, or SPF? If SPF, can you give an example of an incorrect policy that is not flagged? From nobody Thu Feb 27 11:52:49 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 362183A0A8C for ; Thu, 27 Feb 2020 11:52:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.7 X-Spam-Level: X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=gathman.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2CCmyBjJSRWW for ; Thu, 27 Feb 2020 11:52:44 -0800 (PST) Received: from mail.gathman.org (mail.gathman.org [IPv6:2001:470:8:809::1010]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8612D3A0A93 for ; Thu, 27 Feb 2020 11:52:44 -0800 (PST) Authentication-Results: mail.gathman.org; iprev=pass policy.iprev="2001:470:8:809::1010" (wiki.gathman.org); auth=pass (CRAM-MD5 sslbits=256) smtp.auth=stuart DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gathman.org; i=@gathman.org; q=dns/txt; s=default; t=1582833162; h=date : from : to : cc : subject : in-reply-to : message-id : references : mime-version : content-type : date : from : subject; bh=svicQ/Np4FOSqZqL1tRebRzGAbEcExNoIvfwQxPi8u8=; b=ModHEEosA8sP83L5MsAtsXnrHRxwAR7qwwgME0P5unxzxYHldXaijkWB sC3WRm12OmAyMLpWi6elelYVuGDlvJc9g2TI8/aqyn9ct09EEEGeHaX0k/ ds7rpAjQ2TsnUfl8lSZg8jXTWAdsIwrt9k9LUgo54GeKInvbel02jDAJc= Received: from mail.gathman.org (wiki.gathman.org [IPv6:2001:470:8:809::1010]) (authenticated bits=0) by mail.gathman.org (8.14.7/8.14.7) with ESMTP id 01RJqcWv005632 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 27 Feb 2020 14:52:41 -0500 Date: Thu, 27 Feb 2020 14:52:38 -0500 (EST) From: Stuart D Gathman To: Frank Bulk cc: spfbis@ietf.org, "'Scott Kitterman'" In-Reply-To: <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> Message-ID: References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Feb 2020 19:52:48 -0000 On Thu, 27 Feb 2020, Frank Bulk wrote: > Perhaps I'm using an old version of that Python script, but here are some > examples. My best guess is that the python script stops as soon as it > passes the check, but doesn't evaluate the whole record. > > > deerequipment.com: Dmarcian notes "The target name for > "include:spf.protection.outlook.com" equals an already evaluated "include" > mechanism / "redirect" modifier." That is not an error. That is more of a "lint" feature. > visionnetusa.com: Dmarcian notes "Multiple SPF records found for > "visionnetusa.com". There should only be one." $ python spf.py visionnetusa.com PermError: Two or more type TXT spf records found. > ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for > "ghekkonetworks.com". There should only be one." $ python spf.py ghekkonetworks.com PermError: Two or more type TXT spf records found. > > billtrust.com: Dmarcian notes " A DMARC record was detected under > "billtrust.com". DMARC records must be located at "_dmarc.billtrust.com", > and not directly at "billtrust.com". If DMARC was set up as a wildcard > record, that should be removed and placed only at the domain level." SPF doesn't do DMARC. > zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF > record. The maximum is 10." $ python spf.py 1.2.3.4 root@zayo.com zayo.com result: ('permerror', 550, 'SPF Permanent Error: Too many DNS lookups') None Granted, the description should include the count. Fixing now... > tivo.com: Dmarcian notes: > Error! 30 DNS lookups required to evaluate the SPF record. The > maximum is 10. > Error! SPF record is present, but invalid. > root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 > include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com > include:spf.protection.outlook.com include:aspmx.pardot.com > include:_spf.centercode.com ~all" 204.176.49.0 postmaster@tivo.com > mail.tivo.com > result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com > root@nagios:/usr/local/bin/spfcheck# Here's one Dmarc missed in the horribly perverted tivo.com policy (the sheer size of the trace should make tivo immediately erase their policy and start over). $ python spf.py -v 1.2.3.4 root@tivo.com tivo.com result= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3hcOixOuVcdQw=='] addcache= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3hcOixOuVcdQw=='] result= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] addcache= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] result= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] addcache= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] result= ('tivo.com', 'TXT') ['MS=ms87319732'] addcache= ('tivo.com', 'TXT') ['MS=ms87319732'] result= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5842b7'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5842b7'] result= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] addcache= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] result= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] addcache= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] result= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8priX2RHbztUA=='] addcache= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8priX2RHbztUA=='] result= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129aac8a1'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129aac8a1'] top: tivo.com "v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all" result= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] addcache= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] include: _spf.tivo.com "v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all" result= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] addcache= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] include: _spf_netblocks1.tivo.com "v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all" result= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] addcache= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] include: _spf_netblocks2.tivo.com "v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all" result= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] addcache= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] include: _spf_netblocks3.tivo.com "v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all" result= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] addcache= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] include: _spf_o365.tivo.com "v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all" result= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] addcache= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] include: _spf_netblockso.tivo.com "v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all" result= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] addcache= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] include: _spf_netblockso2.tivo.com "v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all" result= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] addcache= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] include: _spf_netblockso3.tivo.com "v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all" result: ('permerror', 550, 'SPF Permanent Error: _spf_netblockso3.tivo.com empty domain:: include:') None From nobody Thu Feb 27 21:37:45 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CFAC3A1043 for ; Thu, 27 Feb 2020 21:37:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.297 X-Spam-Level: X-Spam-Status: No, score=-0.297 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, FROM_LOCAL_NOVOWEL=0.5, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_FAIL=0.001, URIBL_BLOCKED=0.001, URI_HEX=0.1] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PkXjwWUwrLcz for ; Thu, 27 Feb 2020 21:37:41 -0800 (PST) Received: from premieronline.net (mail.premieronline.net [IPv6:2607:fe28:0:4000::10]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6ACA93A1047 for ; Thu, 27 Feb 2020 21:37:41 -0800 (PST) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=199.120.69.4; envelope-from=; Received: from FBULKPC (unverified [199.120.69.4]) by premieronline.net (SurgeMail 7.4f) with ESMTP id 12578095-1729245 for multiple; Thu, 27 Feb 2020 23:35:22 -0600 From: "Frank Bulk" To: "'Stuart D Gathman'" Cc: , "'Scott Kitterman'" References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> In-Reply-To: Date: Thu, 27 Feb 2020 23:35:21 -0600 Message-ID: <001501d5edf8$de80c130$9b824390$@iname.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdXstTWAX0UO2VeETfGQ8rkT9QwrKgAvbOWAAAIkEGAAF5HuAAAFBuyA Content-Language: en-us X-Originating-IP: 199.120.69.4 X-Vpipe: restarted=25 started /var/surgemail/scavs.pl (/var/surgemail/scavs.pl) X-SpamDetect: : 0.1 sd=0.1 0.04(X-myrbl:Color=white) 0.81(X-PhraseHits:verify) 0.74(Received:for multiple) [nnot=1, ng=1, nsum=0, nb=0, nw=1, -3.87] X-LangGuess: English X-MyRbl: Color=White (rbl) Age=0 Spam=0 Notspam=0 Stars=0 Good=29 Friend=0 Surbl=0 Catch=0 r=0 ip=199.120.69.4 X-IP-stats: Incoming Last 0, First 107, in=23648, out=0, spam=0 ip=199.120.69.4 Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Feb 2020 05:37:44 -0000 Thanks for you tool and this feedback. I accept your 'lint' feedback on deerequipment.com -- but it is helpful to be made aware of obvious redundancies. Regarding visionnetusa.com and ghekkonetworks.com and zayo.com: it looks like I need to do a plain check of the domain to check to certain errors? Ideally I would have failures when performing the more complex checks, too. I also understand your feedback billtrust.com -- but it is helpful to be made aware of this kind of problem. Looks like you agree that a simple and complex check that the problems in tivo.com gets missed? root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py tivo.com v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all root@nagios:/usr/local/bin/spfcheck# root@nagios:/usr/local/bin/spfcheck# python spf.py 204.176.49.0 root@tivo.com tivo.com result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com root@nagios:/usr/local/bin/spfcheck# oot@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all" 204.176.49.0 postmaster@tivo.com mail.tivo.com result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com root@nagios:/usr/local/bin/spfcheck# Looks like errors are missed with simple and complex check of nex-tech.com? root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py nex-tech.com v=spf1 ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25 ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170 include:amazonses.com a:dispatch-us.ppe-hosted.com include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com include:azure.quotevalet.com include:spf.protection.outlook.com a -all root@nagios:/usr/local/bin/spfcheck# root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 ip4:208.65.144.0/21 ip4:208.81.64.0/21 ip4:24.225.0.0/25 ip4:24.225.11.128/25 ip4:24.225.12.66 ip4:52.240.150.170 include:amazonses.com a:dispatch-us.ppe-hosted.com include:449074.spf10.hubspotemail.net include:_spf.bigcommerce.com include:azure.quotevalet.com include:spf.protection.outlook.com a -all" 208.65.144.0 postmaster@nex-tech.com mail.nex-tech.com result: ('pass', 250, 'sender SPF authorized') ip4:208.65.144.0/21 root@nagios:/usr/local/bin/spfcheck# Regards, Frank -----Original Message----- From: Stuart D Gathman Sent: Thursday, February 27, 2020 1:53 PM To: Frank Bulk Cc: spfbis@ietf.org; 'Scott Kitterman' Subject: Re: [spfbis] SPF-checking tool On Thu, 27 Feb 2020, Frank Bulk wrote: > Perhaps I'm using an old version of that Python script, but here are some > examples. My best guess is that the python script stops as soon as it > passes the check, but doesn't evaluate the whole record. > > > deerequipment.com: Dmarcian notes "The target name for > "include:spf.protection.outlook.com" equals an already evaluated "include" > mechanism / "redirect" modifier." That is not an error. That is more of a "lint" feature. > visionnetusa.com: Dmarcian notes "Multiple SPF records found for > "visionnetusa.com". There should only be one." $ python spf.py visionnetusa.com PermError: Two or more type TXT spf records found. > ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for > "ghekkonetworks.com". There should only be one." $ python spf.py ghekkonetworks.com PermError: Two or more type TXT spf records found. > > billtrust.com: Dmarcian notes " A DMARC record was detected under > "billtrust.com". DMARC records must be located at "_dmarc.billtrust.com", > and not directly at "billtrust.com". If DMARC was set up as a wildcard > record, that should be removed and placed only at the domain level." SPF doesn't do DMARC. > zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF > record. The maximum is 10." $ python spf.py 1.2.3.4 root@zayo.com zayo.com result: ('permerror', 550, 'SPF Permanent Error: Too many DNS lookups') None Granted, the description should include the count. Fixing now... > tivo.com: Dmarcian notes: > Error! 30 DNS lookups required to evaluate the SPF record. The > maximum is 10. > Error! SPF record is present, but invalid. > root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 > include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com > include:spf.protection.outlook.com include:aspmx.pardot.com > include:_spf.centercode.com ~all" 204.176.49.0 postmaster@tivo.com > mail.tivo.com > result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com > root@nagios:/usr/local/bin/spfcheck# Here's one Dmarc missed in the horribly perverted tivo.com policy (the sheer size of the trace should make tivo immediately erase their policy and start over). $ python spf.py -v 1.2.3.4 root@tivo.com tivo.com result= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3 hcOixOuVcdQw=='] addcache= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3 hcOixOuVcdQw=='] result= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] addcache= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] result= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] addcache= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] result= ('tivo.com', 'TXT') ['MS=ms87319732'] addcache= ('tivo.com', 'TXT') ['MS=ms87319732'] result= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5 842b7'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5 842b7'] result= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] addcache= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] result= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] addcache= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] result= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8 priX2RHbztUA=='] addcache= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8 priX2RHbztUA=='] result= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a ac8a1'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a ac8a1'] top: tivo.com "v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all" result= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] addcache= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] include: _spf.tivo.com "v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all" result= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] addcache= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] include: _spf_netblocks1.tivo.com "v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all" result= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] addcache= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] include: _spf_netblocks2.tivo.com "v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all" result= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] addcache= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] include: _spf_netblocks3.tivo.com "v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all" result= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] addcache= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] include: _spf_o365.tivo.com "v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all" result= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] addcache= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] include: _spf_netblockso.tivo.com "v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all" result= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] addcache= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] include: _spf_netblockso2.tivo.com "v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all" result= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] addcache= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] include: _spf_netblockso3.tivo.com "v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all" result: ('permerror', 550, 'SPF Permanent Error: _spf_netblockso3.tivo.com empty domain:: include:') None From nobody Thu Feb 27 21:38:57 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 965FE3A1048 for ; Thu, 27 Feb 2020 21:38:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.397 X-Spam-Level: X-Spam-Status: No, score=-0.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, FROM_LOCAL_NOVOWEL=0.5, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_FAIL=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gauvvt_F61ns for ; Thu, 27 Feb 2020 21:38:53 -0800 (PST) Received: from premieronline.net (mail.premieronline.net [IPv6:2607:fe28:0:4000::10]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A4DC3A1043 for ; Thu, 27 Feb 2020 21:38:53 -0800 (PST) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=199.120.69.4; envelope-from=; Received: from FBULKPC (unverified [199.120.69.4]) by premieronline.net (SurgeMail 7.4f) with ESMTP id 12578112-1729245 for multiple; Thu, 27 Feb 2020 23:36:41 -0600 From: "Frank Bulk" To: "'Stuart D Gathman'" Cc: , "'Scott Kitterman'" References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> In-Reply-To: Date: Thu, 27 Feb 2020 23:36:41 -0600 Message-ID: <001601d5edf9$0e1e8b20$2a5ba160$@iname.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdXstTWAX0UO2VeETfGQ8rkT9QwrKgAvbOWAAAIkEGAAF5HuAAAHkjjw Content-Language: en-us X-Originating-IP: 199.120.69.4 X-Vpipe: restarted=25 started /var/surgemail/scavs.pl (/var/surgemail/scavs.pl) X-SpamDetect: : -3.4 sd=-3.4 0.02(X-SpamContent:clean) 0.04(X-myrbl:Color=white) 0.81(X-PhraseHits:verify) 0.74(Received:for multiple) [nnot=2, ng=2, nsum=0, nb=0, nw=2, -7.42] X-SpamContent: Clean X-LangGuess: English X-MyRbl: Color=White (rbl) Age=0 Spam=0 Notspam=0 Stars=0 Good=30 Friend=0 Surbl=0 Catch=0 r=0 ip=199.120.69.4 X-IP-stats: Incoming Last 0, First 107, in=23649, out=0, spam=0 ip=199.120.69.4 Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Feb 2020 05:38:56 -0000 One more question: do I need to query these domains differently to get a clean result? boehringer-ingelheim.com: Unknown type: exists value %{i}._i.%{d}._d.espf.dmp.cisco.com genpt.com: Unknown type: exists value %{i}.spf.hc3618-75.iphmx.com good-sam.com: Unknown type: exists value %{i}.spf.good-sam.iphmx.com nationwide.com: Unknown type: exists value %{i}.spf.hc2638-63.iphmx.com ochealthsystem.org: Unknown type: exists value %{i}.spf.hc3620-0.iphmx.com sanfordhealth.org: Unknown type: exists value %{i}.spf.hc3620-0.iphmx.com Frank -----Original Message----- From: Stuart D Gathman Sent: Thursday, February 27, 2020 1:53 PM To: Frank Bulk Cc: spfbis@ietf.org; 'Scott Kitterman' Subject: Re: [spfbis] SPF-checking tool On Thu, 27 Feb 2020, Frank Bulk wrote: > Perhaps I'm using an old version of that Python script, but here are some > examples. My best guess is that the python script stops as soon as it > passes the check, but doesn't evaluate the whole record. > > > deerequipment.com: Dmarcian notes "The target name for > "include:spf.protection.outlook.com" equals an already evaluated "include" > mechanism / "redirect" modifier." That is not an error. That is more of a "lint" feature. > visionnetusa.com: Dmarcian notes "Multiple SPF records found for > "visionnetusa.com". There should only be one." $ python spf.py visionnetusa.com PermError: Two or more type TXT spf records found. > ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for > "ghekkonetworks.com". There should only be one." $ python spf.py ghekkonetworks.com PermError: Two or more type TXT spf records found. > > billtrust.com: Dmarcian notes " A DMARC record was detected under > "billtrust.com". DMARC records must be located at "_dmarc.billtrust.com", > and not directly at "billtrust.com". If DMARC was set up as a wildcard > record, that should be removed and placed only at the domain level." SPF doesn't do DMARC. > zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF > record. The maximum is 10." $ python spf.py 1.2.3.4 root@zayo.com zayo.com result: ('permerror', 550, 'SPF Permanent Error: Too many DNS lookups') None Granted, the description should include the count. Fixing now... > tivo.com: Dmarcian notes: > Error! 30 DNS lookups required to evaluate the SPF record. The > maximum is 10. > Error! SPF record is present, but invalid. > root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 > include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com > include:spf.protection.outlook.com include:aspmx.pardot.com > include:_spf.centercode.com ~all" 204.176.49.0 postmaster@tivo.com > mail.tivo.com > result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com > root@nagios:/usr/local/bin/spfcheck# Here's one Dmarc missed in the horribly perverted tivo.com policy (the sheer size of the trace should make tivo immediately erase their policy and start over). $ python spf.py -v 1.2.3.4 root@tivo.com tivo.com result= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3 hcOixOuVcdQw=='] addcache= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3 hcOixOuVcdQw=='] result= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] addcache= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] result= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] addcache= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] result= ('tivo.com', 'TXT') ['MS=ms87319732'] addcache= ('tivo.com', 'TXT') ['MS=ms87319732'] result= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5 842b7'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5 842b7'] result= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] addcache= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] result= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] addcache= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] result= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8 priX2RHbztUA=='] addcache= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8 priX2RHbztUA=='] result= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a ac8a1'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a ac8a1'] top: tivo.com "v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all" result= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] addcache= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] include: _spf.tivo.com "v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all" result= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] addcache= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] include: _spf_netblocks1.tivo.com "v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all" result= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] addcache= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] include: _spf_netblocks2.tivo.com "v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all" result= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] addcache= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] include: _spf_netblocks3.tivo.com "v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all" result= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] addcache= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] include: _spf_o365.tivo.com "v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all" result= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] addcache= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] include: _spf_netblockso.tivo.com "v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all" result= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] addcache= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] include: _spf_netblockso2.tivo.com "v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all" result= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] addcache= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] include: _spf_netblockso3.tivo.com "v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all" result: ('permerror', 550, 'SPF Permanent Error: _spf_netblockso3.tivo.com empty domain:: include:') None From nobody Thu Feb 27 21:50:32 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B8B13A1087 for ; Thu, 27 Feb 2020 21:50:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.397 X-Spam-Level: X-Spam-Status: No, score=-0.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, FROM_LOCAL_NOVOWEL=0.5, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_FAIL=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LzOHHqIld4nC for ; Thu, 27 Feb 2020 21:50:25 -0800 (PST) Received: from premieronline.net (mail.premieronline.net [IPv6:2607:fe28:0:4000::10]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98DFA3A10C4 for ; Thu, 27 Feb 2020 21:50:25 -0800 (PST) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=199.120.69.4; envelope-from=; Received: from FBULKPC (unverified [199.120.69.4]) by premieronline.net (SurgeMail 7.4f) with ESMTP id 12578321-1729245 for multiple; Thu, 27 Feb 2020 23:50:23 -0600 From: "Frank Bulk" To: "'Stuart D Gathman'" Cc: , "'Scott Kitterman'" References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> <001601d5edf9$0e1e8b20$2a5ba160$@iname.com> In-Reply-To: <001601d5edf9$0e1e8b20$2a5ba160$@iname.com> Date: Thu, 27 Feb 2020 23:50:22 -0600 Message-ID: <001701d5edfa$f79bd6d0$e6d38470$@iname.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdXstTWAX0UO2VeETfGQ8rkT9QwrKgAvbOWAAAIkEGAAF5HuAAAHkjjwAACjwtA= Content-Language: en-us X-Originating-IP: 199.120.69.4 X-Vpipe: restarted=25 started /var/surgemail/scavs.pl (/var/surgemail/scavs.pl) X-SpamDetect: : -3.4 sd=-3.4 0.02(X-SpamContent:clean) 0.04(X-myrbl:Color=white) 0.81(X-PhraseHits:verify) 0.74(Received:for multiple) [nnot=2, ng=2, nsum=0, nb=0, nw=2, -7.42] X-SpamContent: Clean X-LangGuess: English X-MyRbl: Color=White (rbl) Age=0 Spam=0 Notspam=0 Stars=0 Good=31 Friend=0 Surbl=0 Catch=0 r=0 ip=199.120.69.4 X-IP-stats: Incoming Last 0, First 107, in=23650, out=0, spam=0 ip=199.120.69.4 Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Feb 2020 05:50:29 -0000 Sorry, that the output of my superscript -- please ignore. Frank -----Original Message----- From: spfbis On Behalf Of Frank Bulk Sent: Thursday, February 27, 2020 11:37 PM To: 'Stuart D Gathman' Cc: spfbis@ietf.org; 'Scott Kitterman' Subject: Re: [spfbis] SPF-checking tool One more question: do I need to query these domains differently to get a clean result? boehringer-ingelheim.com: Unknown type: exists value %{i}._i.%{d}._d.espf.dmp.cisco.com genpt.com: Unknown type: exists value %{i}.spf.hc3618-75.iphmx.com good-sam.com: Unknown type: exists value %{i}.spf.good-sam.iphmx.com nationwide.com: Unknown type: exists value %{i}.spf.hc2638-63.iphmx.com ochealthsystem.org: Unknown type: exists value %{i}.spf.hc3620-0.iphmx.com sanfordhealth.org: Unknown type: exists value %{i}.spf.hc3620-0.iphmx.com Frank -----Original Message----- From: Stuart D Gathman Sent: Thursday, February 27, 2020 1:53 PM To: Frank Bulk Cc: spfbis@ietf.org; 'Scott Kitterman' Subject: Re: [spfbis] SPF-checking tool On Thu, 27 Feb 2020, Frank Bulk wrote: > Perhaps I'm using an old version of that Python script, but here are some > examples. My best guess is that the python script stops as soon as it > passes the check, but doesn't evaluate the whole record. > > > deerequipment.com: Dmarcian notes "The target name for > "include:spf.protection.outlook.com" equals an already evaluated "include" > mechanism / "redirect" modifier." That is not an error. That is more of a "lint" feature. > visionnetusa.com: Dmarcian notes "Multiple SPF records found for > "visionnetusa.com". There should only be one." $ python spf.py visionnetusa.com PermError: Two or more type TXT spf records found. > ghekkonetworks.com: Dmarcian notes "Multiple SPF records found for > "ghekkonetworks.com". There should only be one." $ python spf.py ghekkonetworks.com PermError: Two or more type TXT spf records found. > > billtrust.com: Dmarcian notes " A DMARC record was detected under > "billtrust.com". DMARC records must be located at "_dmarc.billtrust.com", > and not directly at "billtrust.com". If DMARC was set up as a wildcard > record, that should be removed and placed only at the domain level." SPF doesn't do DMARC. > zayo.com: Dmarcian notes "12 DNS lookups required to evaluate the SPF > record. The maximum is 10." $ python spf.py 1.2.3.4 root@zayo.com zayo.com result: ('permerror', 550, 'SPF Permanent Error: Too many DNS lookups') None Granted, the description should include the count. Fixing now... > tivo.com: Dmarcian notes: > Error! 30 DNS lookups required to evaluate the SPF record. The > maximum is 10. > Error! SPF record is present, but invalid. > root@nagios:/usr/local/bin/spfcheck# /usr/bin/python spf.py "v=spf1 > include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com > include:spf.protection.outlook.com include:aspmx.pardot.com > include:_spf.centercode.com ~all" 204.176.49.0 postmaster@tivo.com > mail.tivo.com > result: ('pass', 250, 'sender SPF authorized') include:_spf.tivo.com > root@nagios:/usr/local/bin/spfcheck# Here's one Dmarc missed in the horribly perverted tivo.com policy (the sheer size of the trace should make tivo immediately erase their policy and start over). $ python spf.py -v 1.2.3.4 root@tivo.com tivo.com result= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3 hcOixOuVcdQw=='] addcache= ('tivo.com', 'TXT') ['RqJZ70Pn6J6AZTMjXGsp7DlGJ33V/G8i8mDWYfTLXWqRkvOqwFsSqQsX3QuDUNvjFaB9Tttla3 hcOixOuVcdQw=='] result= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] addcache= ('tivo.com', 'TXT') ['status-page-domain-verification=fq5jzb9dvx37'] result= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] addcache= ('tivo.com', 'TXT') ['v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all'] result= ('tivo.com', 'TXT') ['MS=ms87319732'] addcache= ('tivo.com', 'TXT') ['MS=ms87319732'] result= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5 842b7'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=49af2b9098b2d30a71235cbf8a9855eb4846e62fcc95c9e47a8cdf9d5e5 842b7'] result= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] addcache= ('tivo.com', 'TXT') ['onetrust-domain-verification=b96d88a367b2449c9b0f6062e3815b22'] result= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] addcache= ('tivo.com', 'TXT') ['0ed1fe018ac20dca8c20624109ac0610e88f36a065'] result= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8 priX2RHbztUA=='] addcache= ('tivo.com', 'TXT') ['e2cPMIx634wXtI6x2tFVmwNehpMoYRQ/Zt2xcek117k3drOPYN6uuCUDSC23Y9I4INWmUN4OF8 priX2RHbztUA=='] result= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a ac8a1'] addcache= ('tivo.com', 'TXT') ['pardot_43592_*=dfc113dde72c0a055d749915158b6234505740355598dd31d53be2f129a ac8a1'] top: tivo.com "v=spf1 include:_spf.tivo.com mx include:authsmtp.com include:stspg-customer.com include:spf.protection.outlook.com include:aspmx.pardot.com include:_spf.centercode.com ~all" result= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] addcache= ('_spf.tivo.com', 'TXT') ['v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all'] include: _spf.tivo.com "v=spf1 include:_spf_netblocks1.tivo.com include:_spf_netblocks2.tivo.com include:_spf_netblocks3.tivo.com include:_spf.jobvite.com include:_spf.salesforce.com include:us._netblocks.mimecast.com include:us.confirmit.com a:secmail.ultipro.com ~all" result= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] addcache= ('_spf_netblocks1.tivo.com', 'TXT') ['v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all'] include: _spf_netblocks1.tivo.com "v=spf1 ip4:204.176.49.0/24 ip4:209.34.86.213/31 ip4:208.73.180.0/22 ip4:69.25.59.161 ip4:198.61.141.237 ip4:216.23.184.197 ip4:207.38.45.154 ip4:204.14.232.64/28 ip4:202.129.242.64/31 ip4:156.45.254.11 ~all" result= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] addcache= ('_spf_netblocks2.tivo.com', 'TXT') ['v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all'] include: _spf_netblocks2.tivo.com "v=spf1 ip4:65.213.152.14/31 ip4:216.136.162.124/31 ip4:156.45.254.31 ip4:156.45.254.32/29 ip4:50.57.43.233 ip4:64.78.17.176 ip4:65.17.254.100 ip4:65.17.254.108/31 ip4:63.131.159.146 ~all" result= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] addcache= ('_spf_netblocks3.tivo.com', 'TXT') ['v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all'] include: _spf_netblocks3.tivo.com "v=spf1 ip4:63.131.159.151 ip4:216.157.16.107 ip4:216.136.162.123 ip4:207.106.123.26 ip4:192.237.163.108 ip4:66.150.161.30 ip4:108.166.45.120 ip4:50.31.43.169 ip4:50.57.175.27 ip4:166.78.203.73 include:_spf_o365.tivo.com ~all" result= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] addcache= ('_spf_o365.tivo.com', 'TXT') ['v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all'] include: _spf_o365.tivo.com "v=spf1 include:_spf_netblockso.tivo.com include:_spf_netblockso2.tivo.com include:_spf_netblockso3.tivo.com ~all" result= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] addcache= ('_spf_netblockso.tivo.com', 'TXT') ['v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all'] include: _spf_netblockso.tivo.com "v=spf1 ip4:13.111.0.0/22 ip4:13.111.53.0/24 ip4:13.111.54.0/24 ip4:23.253.182.103 ip4:23.253.183.145 ip4:23.253.183.146/31 ip4:23.253.183.148 ip4:23.253.183.150 ip4:50.31.43.169 ip4:50.57.43.233 ip4:50.57.175.27 ~all" result= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] addcache= ('_spf_netblockso2.tivo.com', 'TXT') ['v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all'] include: _spf_netblockso2.tivo.com "v=spf1 ip4:54.240.0.0/18 ip4:62.13.128.0/24 ip4:62.13.129.128/25 ip4:62.13.136.0/21 ip4:62.13.144.0/21 ip4:62.13.152.0/23 ip4:63.128.21.0/24 ip4:63.131.159.146 ip4:63.131.159.151 ip4:64.78.17.176 ip4:65.17.254.100 ~all" result= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] addcache= ('_spf_netblockso3.tivo.com', 'TXT') ['v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all'] include: _spf_netblockso3.tivo.com "v=spf1 ip4:65.17.254.108/31 ip4:65.213.152.14/31 include: spf.protection.outlook.com ~all" result: ('permerror', 550, 'SPF Permanent Error: _spf_netblockso3.tivo.com empty domain:: include:') None _______________________________________________ spfbis mailing list spfbis@ietf.org https://www.ietf.org/mailman/listinfo/spfbis From SRS0=J9znM=4R==stuart@gathman.org Sat Feb 29 13:37:13 2020 Return-Path: X-Original-To: spfbis@ietfa.amsl.com Delivered-To: spfbis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F15D3A140E for ; Sat, 29 Feb 2020 13:37:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.7 X-Spam-Level: X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=gathman.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gn5KR9PQ1pYS for ; Sat, 29 Feb 2020 13:37:12 -0800 (PST) Received: from mail.gathman.org (mail.gathman.org [IPv6:2001:470:8:809::1010]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 019A73A140D for ; Sat, 29 Feb 2020 13:37:11 -0800 (PST) Authentication-Results: mail.gathman.org; iprev=pass policy.iprev="2001:470:8:809::1010" (wiki.gathman.org); auth=pass (CRAM-MD5 sslbits=256) smtp.auth=stuart DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gathman.org; i=@gathman.org; q=dns/txt; s=default; t=1583012226; h=date : from : to : cc : subject : in-reply-to : message-id : references : mime-version : content-type : date : from : subject; bh=jFsiA9BNLf9T3cm9aNYiBBRBbIjnwJakUi+qsnEEQSQ=; b=J/StIPzNF8TIh9DMR/A8ju4OUMMe20ujNnrGjG9BumO/Gjb5vJ3n0uV6 xi1f1lsJtgwj53LRrUi7k0PkH7qiBi8PhjFj1Qyd3W1dRJSOMh1WD3vtfq PcgCRCAX3bwAkoxe4k6Cn21Yyzp7JTUgjNaXn8bcSoa81g9vYRZyBZdZk= Received: from wiki.gathman.org (wiki.gathman.org [IPv6:2001:470:8:809::1010]) (authenticated bits=0) by mail.gathman.org (8.14.7/8.14.7) with ESMTP id 01TLb5De018239 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 29 Feb 2020 16:37:05 -0500 Date: Sat, 29 Feb 2020 16:37:05 -0500 (EST) From: Stuart D Gathman To: Frank Bulk cc: spfbis@ietf.org, "'Scott Kitterman'" In-Reply-To: <001501d5edf8$de80c130$9b824390$@iname.com> Message-ID: References: <000001d5ecb6$106efd90$314cf8b0$@iname.com> <000001d5ed86$6e0b90f0$4a22b2d0$@iname.com> <001501d5edf8$de80c130$9b824390$@iname.com> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [spfbis] SPF-checking tool X-BeenThere: spfbis@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SPFbis discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Feb 2020 21:40:04 -0000 On Thu, 27 Feb 2020, Frank Bulk wrote: > Thanks for you tool and this feedback. > > I accept your 'lint' feedback on deerequipment.com -- but it is helpful to > be made aware of obvious redundancies. I agree. But a separate tool is better for that purpose. It is not the purpose of the spf library. Although maybe a lint util could be added, but I don't know when I would write it... > Regarding visionnetusa.com and ghekkonetworks.com and zayo.com: it looks > like I need to do a plain check of the domain to check to certain errors? > Ideally I would have failures when performing the more complex checks, too. spf.py does not fetch and check every record that could be referenced on a query. In fact, it avoids doing so as much as possible. Using an IP that will fail most of the checks is a heuristic way to exercise most of a policy. A lint utility would in fact fetch all reachable records and check them all. (Maybe I should make time.) > I also understand your feedback billtrust.com -- but it is helpful to be > made aware of this kind of problem. Yes, but even an SPF lint util will not pay attention to DMARC. > Looks like you agree that a simple and complex check that the problems in > tivo.com gets missed? Both Dmarcian and SPF library found different errors in tivo.com. Dmarcian said it was too big (too many lookups). spf.py found a record with a syntax error also. The tivo.com policy is definitely a contender for the worst possible SPF policy contest. But it is disqualified on the grounds of not being actually legal.