Re: Harvest netblocks of good MTAs from SPF for whitelisting from greylisting

On 2013-W07-2 21:41 -0500, Stuart D Gathman wrote:
> On Feb 12, Scott Kitterman transmitted in part:
> 
> >This seems way harder than just whitelisting mail from the domains on
> >your list that pass SPF.  You are assuming that all mail from those
> >hosts is as trustworthy as the mail from your list of good domains. I
> >don't think that is a safe assumption.
> 
> He is only whitelisting mail from the domains on his list - but by
> statically compiling the IPs like libspf2 does, except that he is
> coarsening the resolution of the set to netblocks.  I was suggesting
> that he might not want to do the netblocks thing when starting with
> SPF records for the "good" domains.

I now see your misunderstanding.

I never said that I wanted to coarse the SPF data into the resolution 
of netblocks.  That just makes so very little sense on so many levels.

What I meant is, when Google.com provides this:

% dig +short txt gmail.com; dig +short txt _spf.google.com; dig +short txt _netblocks.google.com
"v=spf1 redirect=_spf.google.com"
"v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all"
"v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all"
%
Etc.

And NetBSD provides this:

% dig +short txt netbsd.org ; dig +short mx netbsd.org ; dig +short mail.netbsd.org ; dig +short mail.netbsd.org aaaa
10 mail.netbsd.org.
149.20.53.66
2001:4f8:3:7::25
%

And so and so trusted site provides etc.

Then I want to take all of those exact netblocks, IPv4 and IPv6 
specifications from SPF, and MX resolutions, and harvest them into 
a whitelist of netblocks (again, without any kind of coarsening of 
gathered data), and use such list as a whitelist in my greylisting 
setup, to avoid an unnecessary delay of mail from hosts that are 
very much so unlikely to be spammers, or from whom all mail would 
be accepted anyways, since they would be extremely unlikely not to 
pass the greylisting, so, why delay the inevitable?

But instead of compiling such a list manually, and having it 
become outdated or cumbersome within mere days, or base it on 
he-said-she-said style of information, I'd like to have a script 
that could automatically generate such a list, and automatically 
update it weekly etc.

I hope this clarifies my intentions.

Cheers,
Constantine.