Re: Problems with spf testsuite and dns specification

Stuart D. Gathman ha scritto:
> On Tue, 12 Jun 2007, Stefano Bagnara wrote:
> 
>> The specification should probably be changed so the permerror is only
>> required if multiple SPF records are found and they are different or
>> multiple TXT records are found and they are different. If 2 TXT or 2 SPF
>> records are found and are identical then it is a matter of server and
>> client implementations to decide wether to consolidate the 2 records
>> into a single record or not, so the SPF specification should not suggest
>> a behaviour depending on the dns client/server used to do the lookup.
> 
> So, you're saying that if I put this in my DNS:
> 
> foo	IN TXT "foobar"
> 	IN TXT "foobar"
> 	IN TXT "foobar"
> 
> That looking up TXT records for "foo" could return anywhere from 1
> to 3 records?  

http://www.dns.net/dnsrd/rfc/rfc2181.html#5.%20Resource%20Record%20Sets

It says "Servers should suppress such duplicates if encountered". Most
servers will return 1 single IN TXT "foobar".

So if they are identical any server could change it, any caching server
could change it. According to Brian Wellington BIND (AFAIK the most
widely adopted dns server) does consolidate similar records.

> Nevertheless, the SPF spec says that when there are multiple TXT
> records beginning with "v=spf1", then the correct result is PermError.  

That's what I'm trying to fix.  IMHO it is correct when the records are
different, but when they are identical it is a matter of what DNS server
(servers) and what dns clients are in the resolution chain to know if
you will receive one or multiple identical records. The SPF spec should
not rely on this: the DNS spec does not allow such distinction to be
made and SPF is a DNS based protocol.

Stefano

PS: please note that I found this issue when I tried to populate my
server with the data needed by the testsuite and even if I placed there
multiple identical IN SPF records it was returing me a single record and
my implementation failed. Then I patched my dns server to return
multiple records and I still had a failure because also my dns client
was consolidating the identical records... I had to patch also the
client and fill the bug report to dnsjava author that as you saw has
good motivation to not change the current behaviour.

-------------------------------------------
-----------------------------------------------------------------------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?member_id=6959932&user_secret=62b4c45f
Powered by Listbox: http://www.listbox.com