In Section 6.2, the 10 check_host() evaluation limit is way too high and
could allow for easier DoS attacks. In addition, there is no limit for
how large each SPF2 record should be and there should be in order to
limit the impact of each of those 10 check_host() evaluations.
I recommend lowering this unless someone has a reasonable case as to why
10 is needed. 5 seems high enough. Even 8 would be an improvement.
It would be good to have some additional limits -- this is just too wide
open.
--
Daniel Quinlan
http://www.pathname.com/~quinlan/