Post #2026545
2026-05-01 22:37 UTC
Replies (3)
-
@kasperd@westergaard.social 2026-05-02 00:19
This reminds me of an issue that I saw several years ago with SPF records on some domains. I was using the Python library for validating SPF records, but I think the behavior I observed was according to specification. The domains with problematic records were IPv4-only, but I think the same could happen to IPv6-only domains. While doing validation the library may need to do AAAA or A lookups depending on the source IP of the incoming mail. And the absence of record can cause a failure. The result was that SPF records which were valid as long as mail originated from an IPv4 address would be considered invalid when a mail originated from an IPv6 address. Crucially, the library reports this as the SPF record as being faulty and not as the origin failing SPF validation. In essence by sending spam from an IPv6 address spoofing one of those domains the end result could be that the SPF record was entirely ignored.
-
@namedbird@noc.social 2026-05-02 07:39
@nygren@hachyderm.io @phils@chaos.social Interesting... Would this be worse than when an IPv4-only recursive resolver encounters an IPv6-only authoritative nameserver? (Consistent failure versus inconsistent failure)
-
@Oskar456@mastodon.social 2026-05-04 07:00
@nygren@hachyderm.io @phils@chaos.social Be careful with the wording though. If you say “it is important to have both A and AAAA records,” without explicitly stating that this also means having both IPv4 and IPv6 connectivity, some people get creative and start putting IPv4-mapped IPv6 addresses into AAAA records. https://ripe88.ripe.net/archives/video/1361/