Macros for collecting SPF queries against your SPF record.

Folks,

	In this morning's ASRG meeting smtp-verify cluster, we proposed  
several data collection activities. The primary interest was in  
instrumenting SPF Classic queries. Here is an example of a SPF query  
that will allow the domain owner to see who is sending mail in your  
name. From Altavista.com (host -t txt altavista.com):

altavista.com text "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.altavista.com -all"

My reading of this SPF record results in MTAs performing SPF checks to  
query your DNS server for a domain that will expand into something like  
the following:

CL.192.168.1.1.FR.spammer@ILuv2spam.com.HE.mail.ILuv2spam.com.null.altav 
ista.com

My proposal for colleagues who wish to help ASRG collect data in this  
area would be to replace altavista.com with their domains. I believe it  
is important to not allow wildcards in the null.spf.example.com domain.

Comments? I expect we also ought to approach altavista.com to see if  
they could provide us some aggregated data on the effectiveness of  
these queries?

Andrew

P.S. here is how I would change an example.com zone file to perform  
this check.

; example.com. External Zone File
$TTL 24h
@       IN      SOA     FW  postmaster (
                         2004080301 ; serial
                         4h ; refresh
                         2h ; retry
                         1w ; expire
                         1h ; negative caching ttl
                         )
         IN      NS      a.ns.example.com.
         IN      NS      b.ns.example.com.
         IN      A       192.168.1.2
         IN      MX      10      Mail.example.com.
         IN      TXT     "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com mx a -all"

FW      IN      A       192.168.1.2
         IN      TXT     "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
a.ns    IN      A       192.168.1.2
         IN      TXT     "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"

Mail    IN      A       192.168.1.3
         IN      MX      10      Mail.example.com.   ; Mail is an MX  
peer.
         IN      TXT     "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
SMTP    IN      A       192.168.1.3
         IN      MX      10      Mail.example.com.   ; SMTP is an MX  
peer.
         IN      TXT     "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
b.ns    IN      A       192.168.1.3
         IN      TXT     "v=spf1  
+exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"

____________________________________
Andrew W. Donoho
[email protected], PGP Key ID: 0x81D0F250
+1 (512) 453-6652 (o), +1 (512) 750-7596 (m)