draft-schlitt-spf-classic-02.txt

来自「非常好的dns解析软件」· 文本 代码 · 共 1,763 行 · 第 1/5 页

Wong & Schlitt          Expires December 8, 2005               [Page 19]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


   rightmost mechanism in a record to provide an explicit default.

   For example:

      v=spf1 a mx -all

   Mechanisms after "all" will never be tested.  Any "redirect" modifier
   (Section 6.1) has no effect when there is an "all" mechanism.

5.2.  "include"

   include          = "include"  ":" domain-spec

   The "include" mechanism triggers a recursive evaluation of
   check_host().  The domain-spec is expanded as per Section 8.  Then
   check_host() is evaluated with the resulting string as the <domain>.
   The <ip> and <sender> arguments remain the same as in the current
   evaluation of check_host().

   In hindsight, the name "include" was poorly chosen.  Only the
   evaluated result of the referenced SPF record is used, rather than
   acting as if the referenced SPF record was literally included in the
   first.  For example, evaluating a "-all" directive in the referenced
   record does not terminate the overall processing and does not
   necessarily result in an overall "Fail".  (Better names for this
   mechanism would have been "if-pass", "on-pass", etc.)

   The "include" mechanism makes it possible for one domain to designate
   multiple administratively-independent domains.  For example, a vanity
   domain "example.net" might send mail using the servers of
   administratively-independent domains example.com and example.org.

   Example.net could say

      IN TXT "v=spf1 include:example.com include:example.org -all"

   This would direct check_host() to, in effect, check the records of
   example.com and example.org for a "Pass" result.  Only if the host
   were not permitted for either of those domains would the result be
   "Fail".

   Whether this mechanism matches, does not match, or throws an error,
   depends on the result of the recursive evaluation of check_host():








Wong & Schlitt          Expires December 8, 2005               [Page 20]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


   +---------------------------------+---------------------------------+
   | A recursive check_host() result | Causes the "include" mechanism  |
   | of:                             | to:                             |
   +---------------------------------+---------------------------------+
   | Pass                            | match                           |
   |                                 |                                 |
   | Fail                            | not match                       |
   |                                 |                                 |
   | SoftFail                        | not match                       |
   |                                 |                                 |
   | Neutral                         | not match                       |
   |                                 |                                 |
   | TempError                       | throw TempError                 |
   |                                 |                                 |
   | PermError                       | throw PermError                 |
   |                                 |                                 |
   | None                            | throw PermError                 |
   +---------------------------------+---------------------------------+

   The "include" mechanism is intended for crossing administrative
   boundaries.  While it is possible to use includes to consolidate
   multiple domains that share the same set of designated hosts, domains
   are encouraged to use redirects where possible, and to minimize the
   number of includes within a single administrative domain.  For
   example, if example.com and example.org were managed by the same
   entity, and if the permitted set of hosts for both domains were
   "mx:example.com", it would be possible for example.org to specify
   "include:example.com", but it would be preferable to specify
   "redirect=example.com" or even "mx:example.com".

5.3.  "a"

   This mechanism matches if <ip> is one of the <target-name>'s IP
   addresses.

   A                = "a"      [ ":" domain-spec ] [ dual-cidr-length ]

   An address lookup is done on the <target-name>.  The <ip> is compared
   to the returned address(es).  If any address matches, the mechanism
   matches.

5.4.  "mx"

   This mechanism matches if <ip> is one of the MX hosts for a domain
   name.

   MX               = "mx"     [ ":" domain-spec ] [ dual-cidr-length ]




Wong & Schlitt          Expires December 8, 2005               [Page 21]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


   check_host() first performs an MX lookup on the <target-name>.  Then
   it performs an address lookup on each MX name returned.  The <ip> is
   compared to each returned IP address.  To prevent DoS attacks, more
   than 10 MX names MUST NOT be looked up during the evaluation of an
   "mx" mechanism (see Section 10).  If any address matches, the
   mechanism matches.

   Note regarding implicit MXes: If the <target-name> has no MX records,
   check_host() MUST NOT pretend the target is its single MX, and MUST
   NOT default to an A lookup on the <target-name> directly.  This
   behavior breaks with the legacy "implicit MX" rule.  See [RFC2821]
   Section 5.  If such behavior is desired, the publisher should specify
   an "a" directive.

5.5.  "ptr"

   This mechanism tests whether the DNS reverse mapping for <ip> exists
   and correctly points to a domain name within a particular domain.

   PTR              = "ptr"    [ ":" domain-spec ]

   First the <ip>'s name is looked up using this procedure: perform a
   DNS reverse-mapping for <ip>, looking up the corresponding PTR record
   in "in-addr.arpa." if the address is an IPv4 one and in "ip6.arpa."
   if it is an IPv6 address.  For each record returned, validate the
   domain name by looking up its IP address.  To prevent DoS attacks,
   more than 10 PTR names MUST NOT be looked up during the evaluation of
   a "ptr" mechanism (see Section 10).  If <ip> is among the returned IP
   addresses, then that domain name is validated.  In pseudocode:

   sending-domain_names := ptr_lookup(sending-host_IP);
   if more than 10 sending-domain_names are found, use at most 10.
   for each name in (sending-domain_names) {
     IP_addresses := a_lookup(name);
     if the sending-domain_IP is one of the IP_addresses {
       validated-sending-domain_names += name;
     }
   }

   Check all validated domain names to see if they end in the
   <target-name> domain.  If any do, this mechanism matches.  If no
   validated domain name can be found, or if none of the validated
   domain names end in the <target-name>, this mechanism fails to match.
   If a DNS error occurs while doing the PTR RR lookup, then this
   mechanism fails to match.  If a DNS error occurs while doing an A RR
   lookup, then that domain name is skipped and the search continues.





Wong & Schlitt          Expires December 8, 2005               [Page 22]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


   Pseudocode:

   for each name in (validated-sending-domain_names) {
     if name ends in <domain-spec>, return match.
     if name is <domain-spec>, return match.
   }
   return no-match.

   This mechanism matches if the <target-name> is either an ancestor of
   a validated domain name, or if the <target-name> and a validated
   domain name are the same.  For example: "mail.example.com" is within
   the domain "example.com", but "mail.bad-example.com" is not.

   Note: Use of this mechanism is discouraged because it is slow, is not
   as reliable as other mechanisms in cases of DNS errors and it places
   a large burden on the arpa name servers.  If used, proper PTR records
   must be in place for the domain's hosts and the "ptr" mechanism
   should be one of the last mechanisms checked.

5.6.  "ip4" and "ip6"

   These mechanisms test whether <ip> is contained within a given IP
   network.

   IP4              = "ip4"      ":" ip4-network   [ ip4-cidr-length ]
   IP6              = "ip6"      ":" ip6-network   [ ip6-cidr-length ]

   ip4-cidr-length  = "/" 1*DIGIT
   ip6-cidr-length  = "/" 1*DIGIT
   dual-cidr-length = [ ip4-cidr-length ] [ "/" ip6-cidr-length ]

   ip4-network      = qnum "." qnum "." qnum "." qnum
   qnum             = DIGIT                 ; 0-9
                      / %x31-39 DIGIT       ; 10-99
                      / "1" 2DIGIT          ; 100-199
                      / "2" %x30-34 DIGIT   ; 200-249
                      / "25" %x30-35        ; 250-255
             ; as per conventional dotted quad notation.  e.g. 192.0.2.0
   ip6-network      = <as per [RFC 3513], section 2.2>
             ; e.g. 2001:DB8::CD30

   The <ip> is compared to the given network.  If CIDR-length high-order
   bits match, the mechanism matches.

   If ip4-cidr-length is omitted it is taken to be "/32".  If
   ip6-cidr-length is omitted it is taken to be "/128".  It is not
   permitted to omit parts of the IP address instead of using CIDR
   notations.  That is, use 192.0.2.0/24 instead of 192.0.2.



Wong & Schlitt          Expires December 8, 2005               [Page 23]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


5.7.  "exists"

   This mechanism is used to construct an arbitrary domain name that is
   used for a DNS A record query.  It allows for complicated schemes
   involving arbitrary parts of the mail envelope to determine what is
   permitted.

   exists           = "exists"   ":" domain-spec

   The domain-spec is expanded as per Section 8.  The resulting domain
   name is used for a DNS A RR lookup.  If any A record is returned,
   this mechanism matches.  The lookup type is 'A' even when the
   connection type is IPv6.

   Domains can use this mechanism to specify arbitrarily complex
   queries.  For example, suppose example.com publishes the record:

      v=spf1 exists:%{ir}.%{l1r+-}._spf.%{d} -all

   The <target-name> might expand to
   "1.2.0.192.someuser._spf.example.com".  This makes fine-grained
   decisions possible at the level of the user and client IP address.

   This mechanism enables queries that mimic the style of tests that
   existing anti-spam DNS blacklists (DNSBL) use.


























Wong & Schlitt          Expires December 8, 2005               [Page 24]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


6.  Modifier Definitions

   Modifiers are name/value pairs that provide additional information.
   Modifiers always have an "=" separating the name and the value.

   The modifiers defined in this document ("redirect" and "exp") MAY
   appear anywhere in the record, but SHOULD appear at the end, after
   all mechanisms.  Ordering of these two modifiers does not matter.
   These two modifiers MUST NOT appear in a record more than once each.
   If they do, then check_host() exits with a result of "PermError".

   Unrecognized modifiers MUST be ignored no matter where in a record,
   or how often.  This allows implementations of this document to
   gracefully handle records with modifiers that are defined in other
   specifications.

6.1.  redirect: Redirected Query

   If all mechanisms fail to match, and a "redirect" modifier is
   present, then processing proceeds as follows:

   redirect         = "redirect" "=" domain-spec

   The domain-spec portion of the redirect section is expanded as per
   the macro rules in Section 8.  Then check_host() is evaluated with
   the resulting string as the <domain>.  The <ip> and <sender>
   arguments remain the same as current evaluation of check_host().

   The result of this new evaluation of check_host() is then considered
   the result of the current evaluation with the exception that if no
   SPF record is found, or if the target-name is malformed, the result
   is a "PermError" rather than "None".

   Note that the newly-queried domain may itself specify redirect
   processing.

   This facility is intended for use by organizations that wish to apply
   the same record to multiple domains.  For example:

     la.example.com. TXT "v=spf1 redirect=_spf.example.com"
     ny.example.com. TXT "v=spf1 redirect=_spf.example.com"
     sf.example.com. TXT "v=spf1 redirect=_spf.example.com"
   _spf.example.com. TXT "v=spf1 mx:example.com -all"

   In this example, mail from any of the three domains is described by
   the same record.  This can be an administrative advantage.

   Note: In general, the domain "A" cannot reliably use a redirect to



Wong & Schlitt          Expires December 8, 2005               [Page 25]

Internet-Draft        Sender Policy Framework (SPF)            June 2005


   another domain "B" not under the same administrative control.  Since
   the <sender> stays the same, there is no guarantee that the record at
   domain "B" will correctly work for mailboxes in domain "A",
   especially if domain "B" uses mechanisms involving localparts.  An
   "include" directive may be more appropriate.

   For clarity it is RECOMMENDED that any "redirect" modifier appear as
   the very last term in a record.