spf-discuss
[Top] [All Lists]

Re: Establishing sanity recommendations for redirect= (related to Managing exploits)

2004-10-20 12:26:55
In 
<1098298543(_dot_)32549(_dot_)117(_dot_)camel(_at_)antitrust(_dot_)6o4(_dot_)ca>
 James Couzens <jcouzens(_at_)6o4(_dot_)ca> writes:

On Wed, 2004-10-20 at 10:49, Commerco WebMaster wrote:

An event last week started me thinking about recursion in redirect= 
statements.

I do not recall reading this in the spec itself, so I thought I would bring 
it up here.  Might it be a good idea to explicitly define and limit the 
number of levels of recursion that a checker of SPF records must go through 
before failing as part of the SPF specification?

Its very blatantly stated!

Section 5.2:

Note: during recursion into an Include mechanism, explanations do not 
   propagate out.  But during execution of a Redirect modifier, the
   explanation string from the target of the redirect is used.

And similar wording is in the oldest SPF spec I have (Nov 2003).

I know of no spf implementation that doesn't already follow the SPF
spec and deal with the situation you describe.

In the last couple of weeks there have been quite a few posts about
far more subtle process limit problems.  libspf2 has dealt with these
more subtle problems for many months.


-wayne