Re: SPF Record Issue

On Friday, September 13, 2013 00:20:25 you wrote:
> >> The SPF standard does not _require_ that an smtp-receiver that is
> >> claimed to "support SPF" (or "honor SPF," whatever) do anything with
> >> the HELO. The standard only requires that the domain of the envelope
> >> sender be checked, but also _recommends_ that a receiver checks HELO.
> > 
> > In one special case it does.  If mail from is empty (it's a bounce), the
> > mail from check is performed with the pseudo mail from
> > postmaster@hostname.
> I actually was deliberately skipping when the HELO is checked as a
> fallback mechanism w/null sender... only so much you can cram into one
> already-overdone e-mail! But I should've been clear that HELO is
> always recommended and in some cases required.
> 
> >> Regardless, you must be prepared, if you as a sender claim to "use
> >> SPF" (or "publish SPF," or whatever terminology that implies that you
> >> think SPF is useful) to have your HELO hostname looked up. The HELO
> >> lookup amounts to checking if postmaster@<hostname> would be allowed
> >> to send from the sender IP.
> > 
> > There is a subtle distinction here.  The postmaster@ construct is a
> > synthetic mail from used for bounces.  When doing an independent HELO
> > check as is recommended in RFC 4408 and the current draft of 4408bis,
> > there is no localpart.  It's the hostname only.
> 
> Well clarified, just goes to show how even someone who's been on this
> list since the beginning can be out of touch with the details.
> 
> When I gave 4408 a quick recheck before sending, I thought 4.3 -- "If
> the <sender> has no localpart, substitute the string "postmaster" for
> the localpart." -- applied to the independent and null-sender HELO
> checks. I still don't exactly see where in 4408bis you clarify
> otherwise, but I'll definitely take your word on it.

No.  You shouldn't.

I went back and looked (I was working from memory).  Since the <sender> input 
to check_host() can be either a Mail From or HELO identity, the postmaster@ 
applies to both.

I probably have code I need to fix now (not that it's likely to matter, the 
local part is only relevant to macros which aren't commonly used).

Scott K