Subject: [spfbis] Secetion 4.6.4 DNS Lookup Limits

From: "Wayne Doust" <[email-masked]>
Date: Tue, 11 Sep 2012 12:53:14 +1000

I suggest adding the following (or similar) text to this section at an
appropriate location:

"MTAs (or other processors) MUST apply the DNS lookup limit sequentially
as the record is 

evaluated and not prematurely issue a permerror based on potential
lookups. For example, 

an SPF record containing a potential 11 DNS queries should not permerror
unless the evaluation

does not satisfy any of the prior mechanisms that require less than or
equal to 10 DNS queries."

---

From: SM <[email-masked]>
Date: Tue, 11 Sep 2012 11:22:06 -0700

Hi Wayne,
At 19:53 10-09-2012, Wayne Doust wrote:
>I suggest adding the following (or similar) text to this section at 
>an appropriate location:
>
>"MTAs (or other processors) MUST apply the DNS lookup limit 
>sequentially as the record is
>an SPF record containing a potential 11 DNS queries should not 
>permerror unless the evaluation
>does not satisfy any of the prior mechanisms that require less than 
>or equal to 10 DNS queries."

The text adds one more requirement (MUST) to the specification.  The 
question I would ask is why is this change necessary and what is the 
impact on RFC 4408 implementations.

Before proceeding with such a change a person might check whether 
there is already already text in the document about that.  There is, 
for example, the following text in the draft:

   'When evaluating the "mx" and "ptr" mechanisms, or the %{p} macro,
    there MUST be a limit of no more than 10 MX or PTR RRs looked up and
    checked.  If more than 10 "mx" or "ptr" records are returned for this
    further lookup, a permerror MUST be returned.  This limit is per
    mechanism or macro in the record and in addition to the lookup limits
    above.'

and:

   'Minimizing the DNS resources required for SPF lookups can be done by
    choosing directives that require less DNS information and by placing
    lower-cost mechanisms earlier in the SPF record.

              +----------+--------+-----------------+
              | term     | cost   | limit           |
              +----------+--------+-----------------+
              | ip4/ip6  | 0      | -               |
              | a        | 1      | 10              |
              | include  | 1      | 10              |
              | redirect | 1      | 10              |
              | exists   | 1      | 10              |
              | mx       | 1 + N* | 10 and N* <= 10 |
              | ptr/%{p} | 1 + N* | 10 and N* <= 10 |
              | all      | 0      | -               |
              +----------+--------+-----------------+
               * N is the number of RRs found during each term evaluation'

The quoted text, and with the proposed text, can lead to different 
interpretations.

Regards,
-sm