Subject: Re: [spfbis] SPF-checking tool

From: "John Levine" <[email-masked]>
Date: 1 Mar 2020 10:09:46 -0500

In article <[email-masked]> you write:
>I also understand your feedback billtrust.com -- but it is helpful to be
>made aware of this kind of problem.

The DMARC record in the wrong place is the least of billtrust's problems:

_dmarc.billtrust.com.	3600	IN	CNAME	www.billtrust.com.
www.billtrust.com.	600	IN	CNAME	www.billtrust.com.cdn.cloudflare.net.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: "Frank Bulk" <[email-masked]>
Date: Mon, 9 Mar 2020 22:32:43 -0500

Thanks for considering it -- I'd be happy to test it again the domains in
our dataset. 

Frank 

-----Original Message-----
From: Stuart D Gathman <[email-masked]> 
Sent: Monday, March 2, 2020 9:41 AM
To: John Levine <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [spfbis] SPF-checking tool

I don't know when I'm going to work on it, but this exchange has
convinced me we need an SPF lint tool.  This would not be in the
the spf.py module - but may import the module to reuse the same 
code as much as possible.

Some features:

  1) Fetch all records reachable from a policy.
  2) Report all syntax errors in reachable records.
  3) Compute worst case number of lookups
  4) Compute an ipset for all SPF results for both IPv4 and IPv6
     (spf.py has a naive implementation of computing the Pass
      set that doesn't handle mechanisms with results other than Pass.
      It was trivial to do and is useful - that's my excuse.)