Re: Harvest netblocks of good MTAs from SPF for whitelisting from greylisting

On Tuesday, February 12, 2013 08:02:15 PM Constantine A. Murenin wrote:
> On 2013-W07-2 21:41 -0500, Stuart D Gathman wrote:
> > On Feb 12, Scott Kitterman transmitted in part:
> > >This seems way harder than just whitelisting mail from the domains on
> > >your list that pass SPF.  You are assuming that all mail from those
> > >hosts is as trustworthy as the mail from your list of good domains. I
> > >don't think that is a safe assumption.
> > 
> > He is only whitelisting mail from the domains on his list - but by
> > statically compiling the IPs like libspf2 does, except that he is
> > coarsening the resolution of the set to netblocks.  I was suggesting
> > that he might not want to do the netblocks thing when starting with
> > SPF records for the "good" domains.
> 
> I now see your misunderstanding.
> 
> I never said that I wanted to coarse the SPF data into the resolution
> of netblocks.  That just makes so very little sense on so many levels.
> 
> What I meant is, when Google.com provides this:
> 
> % dig +short txt gmail.com; dig +short txt _spf.google.com; dig +short txt
> _netblocks.google.com "v=spf1 redirect=_spf.google.com"
> "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com
> include:_netblocks3.google.com ?all" "v=spf1 ip4:216.239.32.0/19
> ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18
> ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20
> ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all" %
> Etc.
> 
> And NetBSD provides this:
> 
> % dig +short txt netbsd.org ; dig +short mx netbsd.org ; dig +short
> mail.netbsd.org ; dig +short mail.netbsd.org aaaa 10 mail.netbsd.org.
> 149.20.53.66
> 2001:4f8:3:7::25
> %
> 
> And so and so trusted site provides etc.
> 
> Then I want to take all of those exact netblocks, IPv4 and IPv6
> specifications from SPF, and MX resolutions, and harvest them into
> a whitelist of netblocks (again, without any kind of coarsening of
> gathered data), and use such list as a whitelist in my greylisting
> setup, to avoid an unnecessary delay of mail from hosts that are
> very much so unlikely to be spammers, or from whom all mail would
> be accepted anyways, since they would be extremely unlikely not to
> pass the greylisting, so, why delay the inevitable?
> 
> But instead of compiling such a list manually, and having it
> become outdated or cumbersome within mere days, or base it on
> he-said-she-said style of information, I'd like to have a script
> that could automatically generate such a list, and automatically
> update it weekly etc.
> 
> I hope this clarifies my intentions.

I understand your intentions. My point is that just because an MTA sends mail 
from one domain that you think is a safe one, doesn't mean it doesn't also 
send mail for other, less savory, domains.  Skipping greylisting on SPF pass 
for one of your 'good' domains would accomplish what your after without also 
giving a free pass to other domain that may not be so friendly.  Tumgreyspf 
does something similar to this.

Scott K