Subject: Re: [spfbis] SPF parsing failure should default to SPF NEUTRAL

From: Stuart Gathman <[email-masked]>
Date: Wed, 27 Mar 2013 10:01:10 -0400

Long ago, Nostradamus foresaw that on 08/03/2012 02:51 AM, Wayne Doust
would write:
>
> This is OT: But I temp-fail on SPF Fail with the reason why and a
> phone number to ring. This gives the sender a chance to call us and
> have them placed in our white-list. I also auto white-list all
> outgoing email addresses. The users know that if someone can't email
> them, then sending the SENDER an email usually "fixes" that.
>
>  
>
> As the adoption of SPF moves forward, I will probably start using an
> initial temp-fail on SPF SoftFail.
>
I apply heuristics to attempt to "fix" the syntax error (e.g. a:1.2.3.4
-> ip4:1.2.3.4) and re-evaluate to result to give a rather more that
usually informed "best guess".  If the heuristic result is Pass, a DSN
with a diagnostic for the syntax error is sent to the sender, and the
message is accepted.  The Received-SPF header still says PermError.

Back to the RFC, it should be very clear that any Received-SPF or
Authentication-Results header should show the *actual* SPF result, and
not any such heuristics.   Example:

Received-SPF: PermError (mail.example.com: permanent error in processing
domain of example.com.br: Use the ip4 mechanism for ip4 addresses)
client-ip=192.0.2.14; envelope-from="[email-masked]";
helo="[198.51.100.207]"; receiver=mail.example.com;
problem="a:203.0.113.73"; mechanism=?all; x-bestguess=neutral;
x-helo-spf=none; identity=mailfrom