Post #2358487

This reminds me of an issue that I saw several years ago with SPF records on some domains. I was using the Python library for validating SPF records, but I think the behavior I observed was according to specification. The domains with problematic records were IPv4-only, but I think the same could happen to IPv6-only domains. While doing validation the library may need to do AAAA or A lookups depending on the source IP of the incoming mail. And the absence of record can cause a failure. The result was that SPF records which were valid as long as mail originated from an IPv4 address would be considered invalid when a mail originated from an IPv6 address. Crucially, the library reports this as the SPF record as being faulty and not as the origin failing SPF validation. In essence by sending spam from an IPv6 address spoofing one of those domains the end result could be that the SPF record was entirely ignored.