[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Trouble with Sender Authentication





On Nov 8, 2006, at 8:30 PM, Scott Kitterman wrote:


On Wednesday 08 November 2006 14:36, Douglas Otis wrote:
On Nov 8, 2006, at 10:10 AM, Scott Kitterman wrote:
On Wed, 8 Nov 2006 09:15:29 -0800 Douglas Otis <dotis@mail-

abuse.org> wrote:
When you say the word script, do you mean SPF records (Please,
this is meant to be a yes/no question, there's no need to write a
dissertation that repeats the arguements made earlier in the
thread.  I read those already.)?

The concern is with libraries that execute scripts labeled as SPF
1 or 2 contained within DNS resource records.  A potential attack
utilizing just the access of these resources records has not been
described.

Is that a Yes?

This has been succinctly answered.  Record is _not_ synonymous with
script.

OK, then I guess that's no.

Record != Script. I see from the above that in your view libraries execute scripts, so SPF checking library != Script. I'm not sure what is left.

Rather that rehash your 'succinct' answer, please point me to the page and line number(s) of your draft that either is a script or describes what it is
and I'll look it up there.

Page 11 would be a place to start. Results vary depending upon the library used to execute this script and the starting parameters. A script may invoke other records. In this case, this script invokes 10 MX mechanisms defined by a macro with follow-on transactions for address records that are perhaps limited by the script processing library. Other scripts, such as in the case of paypal.com invokes 10 other SPF TXT resource records. The SPF script defines subsequent record transactions. In this case, the %{l} macro is used to select an array of MX RR sets. The script defines the record set, but in converse a record does not define the set comprising the script. Processing the script includes initial parameters not found in any SPF record as well.

It seems best not to confuse the term script with that of record. They are truly different elements.

cert-test.mail-abuse.org.  IN  TXT  "v=spf1
    mx:0.%{l}.%{d} mx:1.%{l}.%{d} mx:2.%{l}.%{d}
    mx:3.%{l}.%{d} mx:4.%{l}.%{d} mx:5.%{l}.%{d}
    mx:6.%{l}.%{d} mx:7.%{l}.%{d} mx:8.%{l}.%{d}
    mx:9.%{l}.%{d} ?all"

-Doug