Re: Macros for collecting SPF queries against your SPF record.

Good idea.

I'll just quickly note that some of us here may not trust SPF enough to 
put "-all" because it may end up blocking some of legit emails coming
through forwarders (isn't it also part of what we're trying to determine 
too, how effective it is and how many false positives may happen because 
of its use).

So I'd recommend that those that do not currently publish SPF record
that want to participate in this test, do with "+all" at the end
(instead of "-all")

On Tue, 3 Aug 2004, Andrew W.Donoho wrote:

> Folks,
>
> 	In this morning's ASRG meeting smtp-verify cluster, we proposed 
> several data collection activities. The primary interest was in instrumenting 
> SPF Classic queries. Here is an example of a SPF query that will allow the 
> domain owner to see who is sending mail in your name. From Altavista.com 
> (host -t txt altavista.com):
>
> altavista.com text "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.altavista.com -all"
>
> My reading of this SPF record results in MTAs performing SPF checks to query 
> your DNS server for a domain that will expand into something like the 
> following:
>
> CL.192.168.1.1.FR.spammer@ILuv2spam.com.HE.mail.ILuv2spam.com.null.altav 
> ista.com
>
> My proposal for colleagues who wish to help ASRG collect data in this area 
> would be to replace altavista.com with their domains. I believe it is 
> important to not allow wildcards in the null.spf.example.com domain.
>
> Comments? I expect we also ought to approach altavista.com to see if they 
> could provide us some aggregated data on the effectiveness of these queries?
>
> Andrew
>
> P.S. here is how I would change an example.com zone file to perform this 
> check.
>
> ; example.com. External Zone File
> $TTL 24h
> @       IN      SOA     FW  postmaster (
>                        2004080301 ; serial
>                        4h ; refresh
>                        2h ; retry
>                        1w ; expire
>                        1h ; negative caching ttl
>                        )
>        IN      NS      a.ns.example.com.
>        IN      NS      b.ns.example.com.
>        IN      A       192.168.1.2
>        IN      MX      10      Mail.example.com.
>        IN      TXT     "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com mx a -all"
>
> FW      IN      A       192.168.1.2
>        IN      TXT     "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
> a.ns    IN      A       192.168.1.2
>        IN      TXT     "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
>
> Mail    IN      A       192.168.1.3
>        IN      MX      10      Mail.example.com.   ; Mail is an MX peer.
>        IN      TXT     "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
> SMTP    IN      A       192.168.1.3
>        IN      MX      10      Mail.example.com.   ; SMTP is an MX peer.
>        IN      TXT     "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
> b.ns    IN      A       192.168.1.3
>        IN      TXT     "v=spf1 
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.example.com a -all"
>
> ____________________________________
> Andrew W. Donoho
> [email protected], PGP Key ID: 0x81D0F250
> +1 (512) 453-6652 (o), +1 (512) 750-7596 (m)
>

[demime 0.99d.1 removed an attachment of type APPLICATION/x-pkcs7-signature which had a name of smime.p7s]