Re: SPF include backdoors?

On 6 Mar 2014, at 13:52, Marcus Bointon <[email protected]> wrote:

> If you have an SPF record along the lines of "ip4:x.x.x.x. include:exampl=
e.com -all", and the SPF it includes from example.com is like "ip4:x.x.x.x =
?all", is it effectively back-dooring any host into being allowed to send f=
rom your domain because it will match the ?all in the include before it rea=
ches the -all in your own?

The specification says no. http://www.openspf.org/RFC_4408#mech-include

Of course, there=92s no guarantee that any individual implementation will g=
et it right. So, if you=92re publishing, then it=92s out of your hands. If =
you=92re writing, or deploying, an implementation, then test it to be sure.

There is a vulnerability in include, though it=92s not the one you=92ve rai=
sed. If you publish a record including a third party record, then your reco=
rd will fail if the third party record is invalid or non-existant.

=46rom the spec:

A recursive check_host()=20
result of:	Causes the "include" mechanism to:
Pass		match
Fail		not match
SoftFail	not match
Neutral		not match
TempError	throw TempError
PermError	throw PermError
None		throw PermError

--=20
Ian Eiloart
Postmaster, University of Sussex
+44 (0) 1273 87-3148