question on a SPF setting

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

question on a SPF setting

Wesley Peng-9
Hello

I saw myrambler.ru has a special setting for SPF:

myrambler.ru.           3599    IN      TXT     "v=spf1
ip4:81.19.78.96/27 ip4:81.19.78.0/27 ip4:81.19.88.0/24
-exists:%{ir}.spf.rambler.ru ~all"

what does it mean for this part:

-exists:%{ir}.spf.rambler.ru

Thank you.
Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

Patrick Proniewski
On 2019-11-27 08:15, Wesley Peng wrote:

> Hello
>
> I saw myrambler.ru has a special setting for SPF:
>
> myrambler.ru.           3599    IN      TXT     "v=spf1
> ip4:81.19.78.96/27 ip4:81.19.78.0/27 ip4:81.19.88.0/24
> -exists:%{ir}.spf.rambler.ru ~all"
>
> what does it mean for this part:
>
> -exists:%{ir}.spf.rambler.ru


You'll find an explanation here:

https://mxtoolbox.com/SuperTool.aspx?action=spf%3amyrambler.ru&run=toolpage

patpro
Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

Wesley Peng-9
Thanks.
While I am still not clear about what the description in mxtoolbox.
Can you give more details?

regards.

on 2019/11/27 16:08, patpro wrote:

> On 2019-11-27 08:15, Wesley Peng wrote:
>> Hello
>>
>> I saw myrambler.ru has a special setting for SPF:
>>
>> myrambler.ru.           3599    IN      TXT     "v=spf1
>> ip4:81.19.78.96/27 ip4:81.19.78.0/27 ip4:81.19.88.0/24
>> -exists:%{ir}.spf.rambler.ru ~all"
>>
>> what does it mean for this part:
>>
>> -exists:%{ir}.spf.rambler.ru
>
>
> You'll find an explanation here:
>
> https://mxtoolbox.com/SuperTool.aspx?action=spf%3amyrambler.ru&run=toolpage
>
> patpro
Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

Patrick Proniewski
On 2019-11-27 09:31, Wesley Peng wrote:
> Thanks.
> While I am still not clear about what the description in mxtoolbox.
> Can you give more details?

I've never used the "exists" keyword, it's for more advanced use case
and rely on SPF macros. You'll find some examples online, like here:
https://scotthelme.co.uk/email-security-spf/
A more complete source can be found in the SPF RFC:
https://tools.ietf.org/html/rfc7208#section-7.2

regards
Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

Gerald Galster
In reply to this post by Wesley Peng-9

> Thanks.
> While I am still not clear about what the description in mxtoolbox.
> Can you give more details?
>
> regards.
>
> on 2019/11/27 16:08, patpro wrote:
>> On 2019-11-27 08:15, Wesley Peng wrote:
>>> Hello
>>>
>>> I saw myrambler.ru has a special setting for SPF:
>>>
>>> myrambler.ru.           3599    IN      TXT     "v=spf1
>>> ip4:81.19.78.96/27 ip4:81.19.78.0/27 ip4:81.19.88.0/24
>>> -exists:%{ir}.spf.rambler.ru ~all"
>>>
>>> what does it mean for this part:
>>>
>>> -exists:%{ir}.spf.rambler.ru
>> You'll find an explanation here:
>> https://mxtoolbox.com/SuperTool.aspx?action=spf%3amyrambler.ru&run=toolpage
>> patpro

The details are here: https://tools.ietf.org/html/rfc4408#page-22
Also see 8. Macros / Page 27

Gerald
Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

@lbutlr
In reply to this post by Wesley Peng-9
On 27 Nov 2019, at 00:15, Wesley Peng <[hidden email]> wrote:
> -exists:%{ir}.spf.rambler.ru

That expands to if the IP address (reverse check) plus /spf/rambler.ru exists…

So, of you see a connection from 1.2.3.444 and 1.2.3.444.spf.rambler.ru exists, pass the spf check.



--
Fairy Tales are more than true; not because they tell us that dragons
        exist, but because they tell us that dragons can be beaten.

Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

@lbutlr
On 27 Nov 2019, at 16:31, @lbutlr <[hidden email]> wrote:
> On 27 Nov 2019, at 00:15, Wesley Peng <[hidden email]> wrote:
>> -exists:%{ir}.spf.rambler.ru
>
> That expands to if the IP address (reverse check) plus /spf/rambler.ru exists…
>
> So, of you see a connection from 1.2.3.444 and 1.2.3.444.spf.rambler.ru exists, pass the spf check.

Sorry, it 444.3.2.1.spf.rembler.ru exists (that’s the ‘r’ in ir).


--
> I miss the old days. I haven't killed anyone in years.
>
That's sad.

Reply | Threaded
Open this post in threaded view
|

Re: question on a SPF setting

Jaroslaw Rafa
Dnia 27.11.2019 o godz. 16:37:39 @lbutlr pisze:
> On 27 Nov 2019, at 16:31, @lbutlr <[hidden email]> wrote:
> > On 27 Nov 2019, at 00:15, Wesley Peng <[hidden email]> wrote:
> >> -exists:%{ir}.spf.rambler.ru
> >
> > That expands to if the IP address (reverse check) plus /spf/rambler.ru exists…
> >
> > So, of you see a connection from 1.2.3.444 and 1.2.3.444.spf.rambler.ru exists, pass the spf check.
>
> Sorry, it 444.3.2.1.spf.rembler.ru exists (that’s the ‘r’ in ir).

There is "-" before "exists", so I guess it should fail SPF check in that
case, not pass?
Looks like they have implemented some sort of RBL under spf.rambler.ru
domain and that entry in the SPF record makes IP addresses that are on that
RBL fail SPF check.
--
Regards,
   Jaroslaw Rafa
   [hidden email]
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."