minvws / nl-kat-coordination

Repo nl-kat-coordination for minvws
European Union Public License 1.2
125 stars 56 forks source link

Empty hostnames are accepted when parsing exotic DNS records #957

Open Donnype opened 1 year ago

Donnype commented 1 year ago

See:

Image

Might be caused by this DNS record:

$ dig TXT ultradns.org

; <<>> DiG 9.16.1-Ubuntu <<>> TXT ultradns.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46771
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;ultradns.org.          IN  TXT

;; ANSWER SECTION:
ultradns.org.       260 IN  TXT "v=spf1 exists:%{i}._i.%{d}._d.espf.agari.com include:%{d}.79.spf-protect.agari.com -all"

;; Query time: 4 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: do mei 11 10:19:03 CEST 2023
;; MSG SIZE  rcvd: 141
underdarknl commented 1 year ago

The domains listed in that spf record are not in their final form, the contain macros as defined here: https://datatracker.ietf.org/doc/html/rfc7208#section-7

What can you do with marcos?

https://www.jamieweb.net/blog/using-spf-macros-to-solve-the-operational-challenges-of-spf/

underdarknl commented 1 year ago

Lets keep this Issue confined to the adding of hostnames. If a hostname if deemed invalid we should add a finding on the originating object. (eg, this spf record contains a hostname which is invalid). In another issue we can tackle not adding hostnames containing marco stanzas as hostnames and instead add them as spfMarcoHostnames or something similar.