| Subject: | SPF/Mech/PTR.pm blows up with certain SPF records |
| Date: | Thu, 5 Oct 2006 12:38:41 -0700 (PDT) |
| To: | bug-Mail-SPF [...] rt.cpan.org |
| From: | Andrew Daviel <advax [...] triumf.ca> |
We have used Mail-SPF-Query-1.996 in perl v5.6.1 for some time to track
SPF records in incoming mail. We just upgraded to a new machine running
v5.8.5 and I installed Mail-SPF-2.00
The mail system just blew up and delivered a 1Gbyte delivery failure
message. It starts off:
Final-Recipient: RFC822; Tootsie@anchorinsulation.com
Action: failed
Status: 5.2.2
Remote-MTA: DNS; anchorinsulation.com.s5a2.psmtp.com
Diagnostic-Code: SMTP; 552 Message too large - psmtp
Show quoted text
----- Transcript of session follows -----
PTR/A: Unexpected RR type PTR at
/usr/lib/perl5/site_perl/5.8.5/Mail/SPF/Mech/PTR.pm line 59.
Query anchorinsulation.com TXT
$VAR1 = bless( {
'Value' => '',
'Qualifier' => '',
'ParseValue' => ''
}, 'Mail::SPF::Mech::A' );
$VAR1 = bless( {
'Value' => '',
'Qualifier' => '',
'ParseValue' => ''
}, 'Mail::SPF::Mech::MX' );
.
.
match_in_domain(anchorinsulation.com, A)
Query anchorinsulation.com A
anchorinsulation.com. 3599 IN A 208.239.169.92
match_in_domain(anchorinsulation.com, AAAA)
Query anchorinsulation.com AAAA
Query anchorinsulation.com MX
match_in_domain(anchorinsulation.com.s5b1.psmtp.com, A)
Query anchorinsulation.com.s5b1.psmtp.com A
anchorinsulation.com.s5b1.psmtp.com. 14400 IN A
64.18.4.13
match_in_domain(anchorinsulation.com.s5b1.psmtp.com, AAAA)
Query anchorinsulation.com.s5b1.psmtp.com AAAA
...
and so on.
Undoubtedly the original message was spam of some kind.
And perhaps the anchorinsulation SPF or DNS records are malformed.
But clearly there is a serious problem here with unconstrained resource
consumption.
$ host -t txt anchorinsulation.com
anchorinsulation.com text "v=spf1 a mx ptr include:anchorinsulation.com ?all"
--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376 (Pacific Time)
security@triumf.ca