Re: RE: Need Assistance in SPF resolving error

ok first off this record violates all best practice rules and Must be fix=
ed asap

second to fix it we need first to know what ips this record should actual=
ly be authorising to send email from [email protected]

but first we can guess that some of the ips implied by the sub-optimal re=
cord are ok so we will first optimise it

rules to be applied
terms=20
externally administered domain =3D=3D a domain that ips cannot be enumera=
ted without use of a:domain mx:domain ptr:domain include:domain or other =
dns lookup as the dns records are changed/modified/updated by another adm=
inistrator without notice to the administrator of the spf record

rules
1 never ever use ptr (its dumb unreliable fails often and is unnecessary =
when not referencing an externally administered domain and impossible to =
cost in advance)
2 never use mx (its wastefull and unnecessary when not referencing an ext=
ernally administered domain)
3 never unneccisarily use a (its unnecessary when not referencing an exte=
rnally administered domain or to compress many single ips into a single r=
ecord when many includes would cost more dns lookups(rare))
4 list lowest cost statements first ie ip4 then a:external then mx:extern=
al then include: etc

original record
v=3Dspf1 mx ptr mx:mail.sasref.com.sa ip4:62.3.44.105 mx:mail2.sasref.com=
.sa ip4:62.3.44.100 -all
(cost 6+ptr)

expanding all implied fields
v=3Dspf1 +mx:sasref.com.sa +ptr:sasref.com.sa +mx:mail.sasref.com.sa +ip4=
:62.3.44.105 +mx:mail2.sasref.com.sa +ip4:62.3.44.100 -all

applying rule 4
v=3Dspf1 +ip4:62.3.44.105 +ip4:62.3.44.100 +mx:sasref.com.sa +mx:mail.sas=
ref.com.sa +mx:mail2.sasref.com.sa +ptr:sasref.com.sa -all

next applying rule 2
first lookup the 3 mx records mentioned in bad spf (all lookups and resul=
ts shown at end of mail)
2 of them flat out fail and are broken thus removing
mx:mail.sasref.com.sa
and
mx:mail2.sasref.com.sa

the one that does work mx:sasref.com.sa is now replaced by the correspond=
ing a records
a:mail.sasref.com.sa
a:mail2.sasref.com.sa

v=3Dspf1 +ip4:62.3.44.105 +ip4:62.3.44.100 +a:mail.sasref.com.sa +a:mail2=
.sasref.com.sa +ptr:sasref.com.sa -all
(cost 3+ptr)

next applying rule 3 looking up the a records give us the 2 ips
+a:mail.sasref.com.sa +a:mail2.sasref.com.sa becomes =3D=3D +ip4:62.3.44.=
105 +ip4:62.3.44.100 thus totally redundant

v=3Dspf1 +ip4:62.3.44.105 +ip4:62.3.44.100 +ptr:sasref.com.sa -all
(cost 1+ptr)

and at this stage it looks like the ptr also serves no purpose so use eit=
her the fixed original

v=3Dspf1 ip4:62.3.44.105 ip4:62.3.44.100 ptr -all

or the more likely correct
v=3Dspf1 ip4:62.3.44.105 ip4:62.3.44.100 -all

thank you


dnslookups made + results
--------------------------------------------
> set type=3Dmx
> sasref.com.sa
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
Non-authoritative answer:
sasref.com.sa   MX preference =3D 100, mail exchanger =3D mail.sasref.com=
.sa
sasref.com.sa   MX preference =3D 10, mail exchanger =3D mail2.sasref.com=
.sa
-------------------------------------------------------------------------=
------
> set type=3Dmx
> mail.sasref.com.sa
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
DNS request timed out.
    timeout was 2 seconds.
sasref.com.sa
        primary name server =3D dns1
        responsible mail addr =3D tim.sky2net.com
        serial  =3D 2005121910
        refresh =3D 900 (15 mins)
        retry   =3D 600 (10 mins)
        expire  =3D 86400 (1 day)
        default TTL =3D 3600 (1 hour)
-------------------------------------------------------------------------=
-----------
> set type=3Dmx
> mail2.sasref.com.sa
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
DNS request timed out.
    timeout was 2 seconds.
sasref.com.sa
        primary name server =3D dns1
        responsible mail addr =3D tim.sky2net.com
        serial  =3D 2005121910
        refresh =3D 900 (15 mins)
        retry   =3D 600 (10 mins)
        expire  =3D 86400 (1 day)
        default TTL =3D 3600 (1 hour)
-------------------------------------------------------------------------=
---------------
> set type=3Da
> mail.sasref.com.sa
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
Non-authoritative answer:
Name:    mail2.sasref.com.sa
Address:  62.3.44.105
-------------------------------------------------------------------------=
------------------
> set type=3Da
> mail2.sasref.com.sa
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
Non-authoritative answer:
Name:    mail2.sasref.com.sa
Address:  62.3.44.100
-------------------------------------------------------------------------=
--------------------

At 13:15 24/07/2014  Thursday, Rasul Sharif .J via spf-discuss wrote:
>Hi,
>=20
>We are a small ISP firm and one of our client SPF record exist in our pu=
blic DNS server and it was working fine but suddenly without making any c=
hanges in the SPF record we are receiving error in result while making SP=
F query in kitterman.com tool so Regarding to remove the below error, you=
r assistance will  be highly appreciated.
>=20
>Checked link- <http://www.kitterman.com/getspf2.py>http://www.kitterman.=
com/getspf2.py
>=20
>Results - PermError SPF Permanent Error: Void lookup limit of 2 exceeded
>=20
>But other tools I don=92t see any error.
>=20
>My client SPF record- v=3Dspf1 mx ptr mx:mail.sasref.com.sa ip4:62.3.44.=
105 mx:mail2.sasref.com.sa ip4:62.3.44.100 -all=20
>=20
>Which point to domain name =96 sasref.com.sa=20
>=20
>=20
>=20
>Regards
>=20
>Rasul=20
>=20
>=20
>=20
>
>
>----------
>Disclaimer: This email and any files transmitted with it are confidentia=
l and intended solely for the use of the addressee(s) named herein. If yo=
u are not the intended recipient or addressee, you should not use, dissem=
inate, distribute, copy or alter this email. Any views or opinions presen=
ted in this email are solely those of the author and might not represent =
those of "Al Harbi Telecom=94 and or its units.
>
>Warning: Although reasonable precautions have been taken to ensure no vi=
ruses are present in this email, the company cannot accept responsibility=
 for any loss or damage arising from the use of this email or attachments=
. If you have received this electronic mail message in error, please cont=
act the sender directly
>
>Sender Policy Framework: <http://www.openspf.net>http://www.openspf.net
>Modify Your Subscription: <http://www.listbox.com/member/>http://www.lis=
tbox.com/member/
><https://www.listbox.com/member/archive/735/=3Dnow>Archives<https://www.=
listbox.com/member/archive/rss/735/13124949-ec5a0568> | <https://www.list=
box.com/member/?&>Modify Your Subscription | <https://www.listbox.com/uns=
ubscribe/?&&post_id=3D20140724081600:3CEBB502-132C-11E4-8B67-820E63FA3163=
>Unsubscribe Now<http://www.listbox.com>=20