Re: Harvest netblocks of good MTAs from SPF for whitelisting from greylisting

On 12 February 2013 17:50, Stuart D Gathman <[email protected]> wrote:
> On 02/12/2013 07:19 PM, Constantine A. Murenin wrote:
>>
>> No.  I cannot have my firewall do SPF evaluations, and I'm not
>> attempting to do the same thing as SPF.  I am also not guessing valid
>> MTAs, I'm getting their list deterministically based on static SPF
>> information that is published by relevant entities whose mail I might
>> care to never delay.
>>
> You misunderstood.  My only suggestion was to calculate the *actual* IP set,
> not the "netblock" set.  SPF is much more fine grained than netblocks.  The

I think you're putting distinct meanings into the terms "IP set" and
"netblock", or ignoring the fact that bigger providers actually
publish their IP set as netblocks within SPF.

Else, why would someone specify a netblock in their SPF that's not
their actual IP set?  If they do, then their SPF is broken, and it'll
still be broken regardless whether you do the harvesting like I
contemplate, or implement SPF on your MTA.

> same colocation facility might have both "good" and "evil" domains.  The
> idea of statically compiling the IP set for your type of application is a
> good one, and has already been implemented.

Where has it been implemented?  Please provide me a link, I'm very
interested in applying it to my setup.

C.