Stuart wrote:
If SPF is turing complete, then a DOS attack could serve an SPF record
with a non-terminating, but non-looping program. In that case, the fixed
limit of 20 levels should be mandatory.
No, not the levels should be limited, but the total number of includes and
redirects. If you allow a maximum level of 20, then the execution time could
be billions of years. For example:
a TXT "v=spf1 include:b.xyz.com include:b.xyz.com ..<10 includes>.. -all"
b TXT "v=spf1 include:a.xyz.com include:a.xyz.com ..<10 includes>.. -all"
Roger