Subject: [spfbis] clarification on when to lookup IPv6 addresses

From: Tim Draegen <[email-masked]>
Date: Tue, 26 Mar 2013 21:15:14 -0400

Hi, I recently became confused about when IPv6 addresses should be looked up.  I naively thought that the "a" mechanism meant "perform A record lookup and match using any returned addresses".  However, I've come to learn that Section 5 of RFC 4408 mentions this:

   When any mechanism fetches host addresses to compare with <ip>, when
   <ip> is an IPv4 address, A records are fetched, when <ip> is an IPv6
   address, AAAA records are fetched.  Even if the SMTP connection is
   via IPv6, an IPv4-mapped IPv6 IP address (see [RFC3513], Section
   2.5.5) MUST still be considered an IPv4 address.
So, if the incoming connection is over IPv6, the "a:" mechanism should perform AAAA queries.  Neat!  But obfuscated.

I don't exactly understand where else the A vs AAAA consideration should be applied.  Since I wrote a diagnostic tool for doing SPF checking, there is no "incoming connection", hence my oversight.  I'll comb through various reference libraries to find my answer, but I thought I'd bring this up.

How IPv6 fits into SPF can be made clearer.

HTH,
=- Tim

---

From: SM <[email-masked]>
Date: Tue, 26 Mar 2013 18:38:26 -0700

Hi Tim,
At 18:15 26-03-2013, Tim Draegen wrote:
>Hi, I recently became confused about when IPv6 addresses should be 
>looked up.  I naively thought that the "a" mechanism meant "perform 
>A record lookup and match using any returned addresses".  However, 
>I've come to learn that Section 5 of RFC 4408 mentions this:
>
>So, if the incoming connection is over IPv6, the "a:" mechanism 
>should perform AAAA queries.  Neat!  But obfuscated.
>
>I don't exactly understand where else the A vs AAAA consideration 
>should be applied.  Since I wrote a diagnostic tool for doing SPF 
>checking, there is no "incoming connection", hence my 
>oversight.  I'll comb through various reference libraries to find my 
>answer, but I thought I'd bring this up.

There is a thread at 
http://www.ietf.org/mail-archive/web/spfbis/current/msg03217.html 
about the text.

Regards,
-sm

---

From: Scott Kitterman <[email-masked]>
Date: Tue, 26 Mar 2013 22:52:35 -0400

What we have now, from that thread in -13 is:

>    <ip> is an IPv4, "A" records are fetched; when <ip> is an IPv6
>    address, "AAAA" records are fetched.  SPF implementations on IPv6
>    servers need to handle both "AAAA" and "A" secords, for clients on
>    IPv4 mapped IPv6 addresses [RFC4291].  IPv4 <ip> addresses are only
>    listed in an SPF record using the "ip4" mechanism.

Tim:

Is that clearer than RFC 4408 was?  Would that have solved your problem?

Scott K

---

From: Tim Draegen <[email-masked]>
Date: Wed, 27 Mar 2013 09:26:56 -0400

> Is that clearer than RFC 4408 was?  Would that have solved your problem?

It is a bit clearer, but my problem came from not connecting the dots between the "a:" mechanism and doing AAAA lookups.  It would be nice to have (but not necessary) a link in the "a:" mechanism description about this.

=- Tim

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 31 Mar 2013 15:42:41 -0400

On Wednesday, March 27, 2013 09:26:56 AM Tim Draegen wrote:
> It is a bit clearer, but my problem came from not connecting the dots
> between the "a:" mechanism and doing AAAA lookups.  It would be nice to
> have (but not necessary) a link in the "a:" mechanism description about
> this.

OK.  How about this (just committed locally for the next update):

    a                = "a"      [ ":" domain-spec ] [ dual-cidr-length ]

-   An address lookup is done on the <target-name>.  The <ip> is compared
-   to the returned address(es).  If any address matches, the mechanism
-   matches.
+   An address lookup is done on the <target-name> using the type of
+   lookup (A or AAAA) appropriate for the connection type.  The <ip> is
+   compared to the returned address(es).  If any address matches, the
+   mechanism matches.

Scott K

---

From: Commerco WebMaster <[email-masked]>
Date: Sun, 31 Mar 2013 14:29:15 -0600

> +   compared to the returned address(es).  If any address matches, the

+1

Perhaps you might also consider adding parenthetically "(e.g., IPv4 or 
IPv6)" or just "(IPv4 or IPv6)" after "connection type" for explanatory 
emphasis and balance to the parenthetical "(A or AAAA)" after "type of 
lookup".

Alan M.

---

From: Scott Kitterman <[email-masked]>
Date: Sun, 31 Mar 2013 17:00:30 -0400

> emphasis and balance to the parenthetical "(A or AAAA)" after "type of

Done.  Thanks.

Scott K