spf-discuss
[Top] [All Lists]

Re: how to avoid receiving email w. sender forged to be a host in my domain

2004-08-12 11:07:58
On Thu, 12 Aug 2004, Tom wrote:

The problem that I am experiencing currently is with having a wildcard TXT 
record:

...
Aug 12 17:49:55 vhost4 named[5522]: zone 2urx.com/IN: loaded serial 
2004081201
Aug 12 17:49:55 vhost4 named[5522]: zone 2yourx.com/IN: loaded serial 
2004081201
Aug 12 17:49:55 vhost4 named[5522]: dns_master_load: corwine.com.zone:24: 
*.corwine.com: CNAME and other data
Aug 12 17:49:55 vhost4 named[5522]: zone corwine.com/IN: loading master file 
corwine.com.zone: CNAME and other data
Aug 12 17:49:55 vhost4 named[5522]: zone longshipsandredherrings.com/IN: 
loaded serial 2004081202
Aug 12 17:49:55 vhost4 named[5522]: zone ncfintergroup.com/IN: loaded serial 
2004081202
...

You have a CNAME conflicting with another record type.  For instance,
you might have something like this:

foo.corwine.com IN CNAME        bar.example.com.
*.corwine.com   IN TXT "v=spf1 -all"

DNS does not allow there to be both a CNAME and a TXT (or any other type)
record for a name.  You would think bind would be smart enough to 
realize that a CNAME counts as a specific definition overriding a wildcard
of any other record type.  But then, bind is bind.

If you must have the CNAME on the same level as the wildcard, then
you'll have to use another authoritative DNS server.  Using a CNAME
effectively blocks use of a wildcard at the same level in bind.

-- 
              Stuart D. Gathman <stuart(_at_)bmsi(_dot_)com>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flamis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.