Re: Trouble with Sender Authentication

On Nov 8, 2006, at 8:30 PM, Scott Kitterman wrote:

>
> On Wednesday 08 November 2006 14:36, Douglas Otis wrote:
>> On Nov 8, 2006, at 10:10 AM, Scott Kitterman wrote:
>>> On Wed, 8 Nov 2006 09:15:29 -0800 Douglas Otis <dotis@mail-
>>>
>>> abuse.org> wrote:
>>>>> When you say the word script, do you mean SPF records (Please,
>>>>> this is meant to be a yes/no question, there's no need to write a
>>>>> dissertation that repeats the arguements made earlier in the
>>>>> thread.  I read those already.)?
>>>>
>>>> The concern is with libraries that execute scripts labeled as SPF
>>>> 1 or 2 contained within DNS resource records.  A potential attack
>>>> utilizing just the access of these resources records has not been
>>>> described.
>>>
>>> Is that a Yes?
>>
>> This has been succinctly answered.  Record is _not_ synonymous with
>> script.
>>
> OK, then I guess that's no.
>
> Record != Script.  I see from the above that in your view libraries  
> execute
> scripts, so SPF checking library != Script.  I'm not sure what is  
> left.
>
> Rather that rehash your 'succinct' answer, please point me to the  
> page and
> line number(s) of your draft that either is a script or describes  
> what it is
> and I'll look it up there.

Page 11 would be a place to start.  Results vary depending upon the  
library used to execute this script and the starting parameters.  A  
script may invoke other records.  In this case, this script invokes  
10 MX mechanisms defined by a macro with follow-on transactions for  
address records that are perhaps limited by the script processing  
library.  Other scripts, such as in the case of paypal.com invokes 10  
other SPF TXT resource records.  The SPF script defines subsequent  
record transactions.  In this case, the %{l} macro is used to select  
an array of MX RR sets.  The script defines the record set, but in  
converse a record does not define the set comprising the script.   
Processing the script includes initial parameters not found in any  
SPF record as well.

It seems best not to confuse the term script with that of record.   
They are truly different elements.

cert-test.mail-abuse.org.  IN  TXT  "v=spf1
     mx:0.%{l}.%{d} mx:1.%{l}.%{d} mx:2.%{l}.%{d}
     mx:3.%{l}.%{d} mx:4.%{l}.%{d} mx:5.%{l}.%{d}
     mx:6.%{l}.%{d} mx:7.%{l}.%{d} mx:8.%{l}.%{d}
     mx:9.%{l}.%{d} ?all"

-Doug