shevek / libspf2

Implementation of the Sender Policy Framework for SMTP authorization
http://www.libspf2.net/
37 stars 32 forks source link

NS lookup Bug #24

Open Tributh opened 6 years ago

Tributh commented 6 years ago

Hi, I am running exim with libspf2 library. I recognized differences between the spfquery command line tool and the library.

The following example gives a "pass" from the libspf2 library, while it should fail:

spfquery --ip 2a04:cb41:a516:2::1 --id exapmle@team.mobile.de permerror team.mobile.de: Maximum void DNS look-ups limit (2) exceeded Received-SPF: permerror (team.mobile.de: Maximum void DNS look-ups limit (2) exceeded) receiver=www.tributh.net; identity=mailfrom; envelope-from="exapmle@team.mobile.de"; client-ip="2a04:cb41:a516:2::1"

Kind regards Torsten Tributh

kitterma commented 6 years ago

There are three spfquery implementations (that I know of). One shipped with libspf2, one shipped with Mail::SPF, and one shipped with pyspf. The other two have support for DNS look-ups limit, but libspf2 does not (it's a new feature introduced in RFC 7208 based on implementation experience with Mail::SPF). What this means is that you're running one of the other two spfquery implementations.

Tributh commented 6 years ago

Hi, yes I see now that I have compared different implementations. When I use the libspf2 Version it gives me a pass:

/usr/bin/spfquery.libspf2 -ip 2a04:cb41:a516:2::1 -sender team.mobile.de pass

spfquery: domain of team.mobile.de designates 2a04:cb41:a516:2::1 as permitted sender Received-SPF: pass (spfquery: domain of team.mobile.de designates 2a04:cb41:a516:2::1 as permitted sender) client-ip=2a04:cb41:a516:2::1; envelope-from=postmaster@team.mobile.de;

The RFC7208 is not really "new". It's dated April 2014. Will the libspf2 library implement the DNS look-ups limit in the near future?

kitterma commented 6 years ago

I'm not a libspf2 developer, so I can't say. The pace of development has been pretty slow, so I would not be surprised if it took awhile.