Re: RE: Need Assistance in SPF resolving error
"Stuart Gathman via spf-discuss" <[email protected]> Thu, 24 Jul 2014 09:52:15 -0400
| Newsgroups | gmane.mail.spam.spf.discuss |
|---|---|
| Organization | BWI Corporation |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------040400070605020201050704
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
On 07/24/2014 08:15 AM, Rasul Sharif .J via spf-discuss wrote:
>
> Checked link- http://www.kitterman.com/getspf2.py
> <http://www.kitterman.com/getspf2.py>
>
> Results - PermError SPF Permanent Error: Void lookup limit of 2 exceeded
>
> But other tools I don't see any error.
>
> My client SPF record- v=spf1 mx ptr mx:mail.sasref.com.sa
> ip4:62.3.44.105 mx:mail2.sasref.com.sa ip4:62.3.44.100 -all
>
> Which point to domain name -- sasref.com.sa
>
>
The new SPF RFC (no longer experimental!) added a limit of 2 void DNS
lookups (i.e. nothing found) to prevent the use of SPF to make mail
servers participate in DDoS attacks.
There is no MX record for the mail.sasref.com.sa and mail2.sasref.com.sa
domains.
That said, that is only *two* void lookups. Unless the ip you gave also
had no PTR record, and I wonder if that is supposed to count against the
2 void lookup limit?
But your SPF record is very bad. The mx:mail... mechanisms are
redundant. You probably meant a:mail.sasref.com.sa, etc, and those are
already listed by your earlier mx mechanism. The ip4: mechanisms are
also redundant - since those are the ips for your 2 mail servers.
However, ip4 is more efficient - but that only helps if it comes first
in your policy.
So here is what your policy should look like:
v=spf1 ip4:62.3.44.105 ip4:62.3.44.100 mx ptr -all
Legit mail will be from one of the 2 ips, and be very fast to validate.
If you change ips, or mail servers, the mx mechanism will help pick up
the new mail servers if the checker hasn't seen your new SPF policy yet.
-------------------------------------------
Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/6959934-50ec8f89
Modify Your Subscription: https://www.listbox.com/member/?member_id=6959934&id_secret=6959934-b7c4528d
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=6959934&id_secret=6959934-edadf31a&post_id=20140724095307:CF3E0F10-1339-11E4-9C4C-ECDA75638004
Powered by Listbox: http://www.listbox.com
--------------040400070605020201050704
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/24/2014 08:15 AM, Rasul Sharif .J
via spf-discuss wrote:<br>
</div>
<blockquote
cite="mid:D147D5E202CE194898F8F1157EAB4CB64A3B7F9B40@AHT-MX-001"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 12 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#002060;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#002060;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#002060;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#002060;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1"><br>
<p class="MsoNormal"><span style="color:#002060">Checked link- <a
moz-do-not-send="true"
href="http://www.kitterman.com/getspf2.py">
http://www.kitterman.com/getspf2.py</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.5pt;color:black">Results
- PermError SPF Permanent Error: Void lookup limit of 2
exceeded<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.5pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">But other tools
I don’t see any error.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">My client SPF
record- v=spf1 mx ptr mx:mail.sasref.com.sa ip4:62.3.44.105
mx:mail2.sasref.com.sa ip4:62.3.44.100 -all <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Which point to
domain name – sasref.com.sa
<o:p></o:p></span></p>
<br>
</div>
</blockquote>
The new SPF RFC (no longer experimental!) added a limit of 2 void
DNS lookups (i.e. nothing found) to prevent the use of SPF to make
mail servers participate in DDoS attacks. <br>
<br>
There is no MX record for the mail.sasref.com.sa and
mail2.sasref.com.sa domains. <br>
<br>
That said, that is only *two* void lookups. Unless the ip you gave
also had no PTR record, and I wonder if that is supposed to count
against the 2 void lookup limit?<br>
<span style="color:#002060"> </span><br>
But your SPF record is very bad. The mx:mail... mechanisms are
redundant. You probably meant a:mail.sasref.com.sa, etc, and those
are already listed by your earlier mx mechanism. The ip4:
mechanisms are also redundant - since those are the ips for your 2
mail servers. However, ip4 is more efficient - but that only helps
if it comes first in your policy. <br>
<br>
So here is what your policy should look like:<br>
<br>
v=spf1 <span style="color:#002060"> ip4:62.3.44.105 </span><span
style="color:#002060">ip4:62.3.44.100 mx ptr -all<br>
<br>
Legit mail will be from one of the 2 ips, and be very fast to
validate. If you change ips, or mail servers, the mx mechanism
will help pick up the new mail servers if the checker hasn't seen
your new SPF policy yet.<br>
<br>
</span>
<div style="width:auto;margin:0;padding:5px;background-color:#fff;clear:both;border-top: 1px solid #ccc;" bgcolor="#ffffff">
<p style='font-family:Arial,sans-serif;margin:0.5em auto'>Sender Policy Framework: <a href="http://www.openspf.net">http://www.openspf.net</a><br>
Modify Your Subscription: <a href="http://www.listbox.com/member/">http://www.listbox.com/member/</a></p>
<table border="0" cellspacing="0" cellpadding="0" width="100%" style="background-color:#fff" bgcolor="#ffffff">
<tr>
<td padding="4px">
<font color="#333333" size="1" style="font-family:helvetica, sans-serif;">
<a style="text-decoration:none;color:#669933;border-bottom: 1px solid #444444"
href="https://www.listbox.com/member/archive/735/=now" title="Go to archives for spf-discuss">Archives</a>
<a border="0" style="text-decoration:none;color:#669933" href="https://www.listbox.com/member/archive/rss/735/6959934-50ec8f89" title="RSS feed for spf-discuss"><img border=0 src="https://www.listbox.com/images/feed-icon-10x10.jpg" /></a>
| <a style="text-decoration:none;color:#669933;border-bottom: 1px solid #444444"
href="https://www.listbox.com/member/?member_id=6959934&id_secret=6959934-b7c4528d" title="">Modify</a>
Your Subscription | <a style="text-decoration:none;color:#669933;border-bottom: 1px solid #444444"
href="https://www.listbox.com/unsubscribe/?member_id=6959934&id_secret=6959934-edadf31a&post_id=20140724095307:CF3E0F10-1339-11E4-9C4C-ECDA75638004" title="">Unsubscribe Now</a>
<td valign="top" align="right"><a style="border-bottom:none;" href="http://www.listbox.com">
<img src="https://www.listbox.com/images/listbox-logo-small.png"
title="Powered by Listbox" border="0" /></a></td>
</font>
</td>
</tr>
</table>
</div>
</body>
</html>
--------------040400070605020201050704--