Re: Macros for collecting SPF queries against your SPF record.

Andrew W. Donoho wrote:

> Folks,
>
>     In this morning's ASRG meeting smtp-verify cluster, we proposed  
> several data collection activities. The primary interest was in  
> instrumenting SPF Classic queries. Here is an example of a SPF query  
> that will allow the domain owner to see who is sending mail in your  
> name. From Altavista.com (host -t txt altavista.com):
>
> altavista.com text "v=spf1  
> +exists:CL.%{i}.FR.%{s}.HE.%{h}.null.spf.altavista.com -all"
>
> My reading of this SPF record results in MTAs performing SPF checks 
> to  query your DNS server for a domain that will expand into something 
> like  the following:
>
> CL.192.168.1.1.FR.spammer@ILuv2spam.com.HE.mail.ILuv2spam.com.null.altav 
> ista.com
>
> My proposal for colleagues who wish to help ASRG collect data in this  
> area would be to replace altavista.com with their domains. I believe 
> it  is important to not allow wildcards in the null.spf.example.com 
> domain.
>
> Comments? I expect we also ought to approach altavista.com to see if  
> they could provide us some aggregated data on the effectiveness of  
> these queries?
>
> Andrew
>
Is there a means of verifying that we have done this correctly?


Many thanks,


Jeff