-----Original Message-----
From: Scott Kitterman [mailto:spf2(_at_)kitterman(_dot_)com]
Herb asked:
Is there an official one that is both RFC compliant and RFC strict?
SPF is dangerous to implement (due to the way some people use the
results) if there is no way to determine the correctness.
The one I did is the closest thing to it that I know of. If
the are any ways it doesn't align to the current draft,
please let me know and I'll fix it.
http://www.kitterman.com/spf/validate.html
Well, my "main" triplet(s) work: IP/Helo/User
but the "too many lookups" is still pretty worthless
without some debug information.
And things like "mx" -- does that count as TWO lookups?
(One for MX list, and one for a particular Server, or does
each MX server get counted? You could easily get to 5 or
more right there.)
For example: Hotmail.com has 16 MX records alone -- which
would make a minimum of 17 lookups if you count the MX
request and had to check all of them to find the last one.
If there is such a rule as the "10 lookups", it really should
never apply EXCEPT for a particular SPF test.
This 10 lookup rule may destroy what value is left in SPF
-- which has already taken a beating in public perception
due largely to the misuse of SPF by administrators who
didn't understand it's real value.
(I was a strong supporter of SPF until that was brought
to my attention -- now I am re-evaluating that support.)
--
Herb Martin