Re: Harvest netblocks of good MTAs from SPF for whitelisting from greylisting

On 02/12/2013 04:12 PM, Constantine A. Murenin expounded in part:
> Hi,
>
> I'm configuring greylisting with pf(4) and OpenBSD spamd, and one of
> the things I would like to do is explicitly whitelist good MTAs of
> e.g. google.com, apple.com, ebay.com, schwab.com, freebsd.org,
> uwaterloo.ca etc.
>
> It seems like with the proliferation of SPF, this might be relatively
> easy to do: the netblocks of many valid email servers are individually
> published by each respective domain through various SPF-compliant
> records.  (And even when there are no explicit "ip4" or "ip6" records
> with the IP addresses or netblocks, an explicit or implied "v=spf1 a
> mx" could still do the trick.)
>
> What's left is to have a list of "good" domains, and a script that
> will go through all such domains once a week to compile the list of
> good netblocks.  Such netblocks could then be exempt from any kind of
> greylisting, such as to never delay the mail from trustworthy domains
> whatsoever.
>
You are overthinking it.  With SPF, you don't need to mess with 
netblocks at all (and that would not be practical at all with IP6). If 
SPF passes, and the domain is trusted, you are good.  That is the whole 
point of SPF.

I recommend keeping a policy database for *every* SPF result, not just 
Pass.   I use the sendmail access file with a python milter, for example:

# for sysadmins who still refuse to use the correct hostname, and also 
publish an SPF policy prohibiting the bogus name they do use:
HELO-Fail:owa.johnsjames.com    OK
# for "good" domains like you describe
SPF-Pass:smashwords.com WHITELIST
# reject yahoo messages that don't pass DKIM
DKIM-Fail:yahoo.com     REJECT
# reject "evil" domains, even if they do understand SPF (unlike most 
"good" domains)
SPF-Pass:sintys.gov.ar  REJECT
# Send DSN nagging about their stupid syntax error, then use pyspf 
heuristics to guess what they really meant
SPF-PermError:volvocars.com     DSN
# Nag them about their unauthorized MTA, but accept the mail anyway
SPF-Softfail:patriot.net        DSN
# Reject Neutral mail, even though their SPF policy is too timid to use -all
SPF-Neutral:financial.ca        REJECT
# Reject Neutral mail, and add the connect IP to a DNS blacklist!
SPF-Neutral:coca-cola.com       BAN
# Even though the MTA has invalid HELO, invalid PTR, and no SPF record, 
accept mail after verifying the localpart via CallBackValidation
SPF-None:hbham.com CBV