Re: Another Permerror heuristic

Stuart D. Gathman wrote:

> In fact, this would be another tweak for SPFv3: only report
> PermError for exactly 2 SPF records (v3 should not use TXT)
> when the results disagree.  If both records get the same
> result, that is an official result.

As heuristic it is an idea.  Generally I'd consider it as rude
and net abuse when senders burden receivers with unnecessary
DNS queries.  Receivers rejecting PermError should be free to
consider such scenarios as broken.

For spf2.0/mfrom and variations it is arguably acceptable when
there is a "similar" v=spf1 with a hopefully identical result.
In this case a faster heuristic is to follow RFC 4408, and to
ignore the "spf2.0/mfrom" instead of wasting time with "mfrom"
evaluations.

The spf-eai draft proposes to deprecate any "spf2.0/mfrom" in
favour of v=spf1.  For "mfrom" read "mfrom,pra", "pra,mfrom",
or "mfrom", and hopefully at most one these combos.  RFC 4406
is just messy.

 Frank