Subject: [dmarc-ietf] Multiple SPF in a single auth_results

From: "Brotman, Alex" <[email-masked]>
Date: Mon, 14 Dec 2020 15:35:07 +0000

I'm seeing a report where the XML contains two SPF records within a single auth_results entity.  This doesn't seem correct.  I found this thread: http://lists.dmarc.org/pipermail/dmarc-discuss/2016-April/003474.html and it says it's a bug, though, I'm a bit surprised (guess I probably shouldn't be) that this is still happening.  Is there some part of the RFC that makes this appear like it's a legitimate report that could be misconstrued?  Is this something that should perhaps be clarified?

      <auth_results>
         <dkim>
            <domain>email.peacocktv.com</domain>
            <result>pass</result>
         </dkim>
         <spf>
            <domain>bounce.email.peacocktv.com</domain>
            <result>pass</result>
         </spf>
         <spf>
            <domain>mta-218-134.sparkpostmail.com.</domain>
            <result>none</result>
         </spf>
      </auth_results>

Thanks

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

---

From: Henning Krause <[email-masked]>
Date: Mon, 14 Dec 2020 16:10:22 +0000

Perhaps the first one is for the mail-from-domain and  the other is for the EHLO host?

Kind regards,
Henning

> -----Original Message-----
> From: dmarc [mailto:[email-masked]] On Behalf Of Brotman, Alex
> Sent: Montag, 14. Dezember 2020 16:35
> To: [email-masked]
> Subject: [dmarc-ietf] Multiple SPF in a single auth_results
> 
> I'm seeing a report where the XML contains two SPF records within a single
> auth_results entity.  This doesn't seem correct.  I found this thread:
> https://stack01.cloud.nospamproxy.com/link?id=BAgAAAAfpHeh4JGMq5wA
> AABTUQz3QBhcskBhLXvN_sPByIkTUJ_191QbNMs1tjGZXePYW51PlsXJiHzgxa
> 2k95gYKyEvascW0xCd7vkfXGIcW-SMik1X4yMySldQ-
> qHoCA66NmA7TaPPuwEtF7ZPQYLlZqdD7I5R3KNSFh2RaMp6bqp2L8XhNLlAJK
> uMYUKvKSh3RMIePwJj3aMWZVgoSUPgaHbNCkaiscGIUps1  and it says it's a
> bug, though, I'm a bit surprised (guess I probably shouldn't be) that this is still
> happening.  Is there some part of the RFC that makes this appear like it's a
> legitimate report that could be misconstrued?  Is this something that should
> perhaps be clarified?
> 
>       <auth_results>
>          <dkim>
> Sr. Engineer, Anti-Abuse & Messaging Policy Comcast
> 
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc

---

From: "John Levine" <[email-masked]>
Date: 14 Dec 2020 14:17:37 -0500

In article <[email-masked]> you write:
>I'm seeing a report where the XML contains two SPF records within a single auth_results entity.  This doesn't seem correct.

It's specifically allowed in the XML schema. In this case I'd guess it
is checking the From header domain, the org domain, and the bounce
address. I see that bounce.email.peacocktv.com is a CNAME for
sparkpostmail.com so it's plausible.

Checking all those things seems useless but that doesn't mean it's forbidden.

R's,
John

---

From: Todd Herr <[email-masked]>
Date: Mon, 14 Dec 2020 17:14:11 -0500

> >             <domain>mta-218-134.sparkpostmail.com.</domain>

 I would tend to agree with Herr Krause, based on what I remember about
SparkPost's host naming convention and such.

-- 

*Todd Herr* | Sr. Technical Program Manager
*e:* [email-masked]
*p:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 15 Dec 2020 10:09:10 +0100

On Mon 14/Dec/2020 20:17:37 +0100 John Levine wrote:
> It's specifically allowed in the XML schema.

Yup:

        <xs:element name="spf" type="SPFAuthResultType" minOccurs="1"
                    maxOccurs="unbounded"/>

> In this case I'd guess it is checking the From header domain, the org
> domain, and the bounce address. I see that bounce.email.peacocktv.com is a
> CNAME for sparkpostmail.com so it's plausible.

One has to guess because the snippet misses the scope of the checked domains:

        <!-- The scope of the checked domain. -->
        <xs:element name="scope" type="SPFDomainScope" minOccurs="1"/>

>>            <domain>bounce.email.peacocktv.com</domain>
               <scope>mfrom</scope>
>>            <domain>mta-218-134.sparkpostmail.com.</domain>
               <scope>helo</scope>
>>      </auth_results>

Best
Ale
--