Regulation of SPF policy terms
Sender Policy Framework (SPF) is a widely used method of distinguishing authorized email from unauthorized email. SPF policies are published into a domain's DNS and then looked up and evaluated by mail receivers. Due to the complexity and limitations of the SPF specification, implementation mistakes and risks are widespread. This problem is compounded by the common practice of nesting SPF policies which introduces hidden risks, particularly exceeding DNS lookup limits. Embodiments of the present disclosure enable new SPF techniques such as selectively inactivating parts of a policy by introducing a virtual-all term, designed to secure against the third-party term inclusions in the policy. When the primary policy is online, the virtual-all term may serve as a terminate policy evaluation much like a traditional “all” term. If the primary policy is offline, a “fail open” may be produced, allowing policy evaluation to proceed into previously inactivated segment of the policy.
1. A method comprising:
generating a virtual all term for inclusion in a Sender Policy Framework (SPF) policy used to manage a domain's policy,
wherein the virtual all term is associated with one of the following:
an inverse of active policy terms in an SPF policy evaluated in out-of-order SPF policy processing, and
every internet protocol address, and
wherein the virtual all term is provided for inclusion into the SPF policy prior to the domain's pre-existing policy term.
2. The method of claim 1 , wherein generating the virtual all term comprises generating an SPF modifier and mechanism associated with one of the following:
an inverse of active policy terms in the SPF policy evaluated in out-of-order SPF policy processing, and
every internet protocol address.
3. The method of claim 1 , wherein generating the virtual all term comprises generating an -include term to be inserted into the SPF policy.
4. The method of claim 1 , wherein generating the virtual all term comprises generating an SPF policy term configured to:
cause a match, and
terminate SPF policy processing.
5. The method of claim 4 , wherein generating the virtual all term comprises generating the virtual all term configured to render any subsequent term in an SPF policy inactive.
6. The method of claim 5 , wherein generating the virtual all term comprises generating the virtual all term configured to inactivate third-party provided include terms in the SPF policy.
7. A method comprising:
publishing a Sender Policy Framework (SPF) policy for a domain, the SPF policy comprising a virtual all term,
wherein the virtual all term is associated with one of the following:
in out-of-order SPF policy processing, an inverse of active policy terms in the SPF policy, and
in left-to-right SPF policy processing, every internet protocol address, and
wherein the virtual all term is included in the SPF policy prior to the domain's pre-existing policy term.
8. The method of claim 7 , wherein publishing the virtual all term comprises publishing an SPF modifier and mechanism associated with one of the following:
the inverse of active policy terms in the SPF policy evaluated in out-of-order SPF policy processing, and
every internet protocol address.
9. The method of claim 7 , wherein publishing the virtual all term comprises publishing an -include term to be inserted into an SPF policy.
10. The method of claim 7 , wherein publishing the virtual all term comprises publishing an SPF policy term configured to cause a match and terminated SPF policy processing.
11. The method of claim 10 , wherein publishing the virtual all term comprises publishing the virtual all term configured to render any subsequent term in the SPF policy inactive.
12. The method of claim 11 , wherein publishing the virtual all term comprises publishing the virtual all term configured to inactivate the processing of third-party provided include terms.
13. A method comprising:
providing a virtual all term for inclusion in an SPF policy of a domain,
wherein providing the virtual all term comprises providing the virtual all term associated with one of the following:
an inverse of active policy terms in the SPF policy for out-of-order SPF policy processing, and
every internet protocol address for left-to-right SPF policy processing, and
wherein the virtual all term is provided for insertion into the SPF policy prior to the domain's pre-existing policy term.
14. The method of claim 13 , wherein providing the virtual all term comprises providing an SPF modifier and mechanism associated with one of the following:
the inverse of active policy terms in the SPF policy evaluated in out-of-order SPF policy processing, and
every internet protocol address.
15. The method of claim 13 , wherein providing the virtual all term comprises providing a -include term to be inserted into the SPF policy.
16. The method of claim 13 , wherein providing the virtual all term comprises providing an SPF policy term configured to:
cause a match, and
terminate subsequent SPF policy processing.
17. The method of claim 16 , wherein providing the virtual all term comprises providing the virtual all term configured to render any subsequent term in the SPF policy inactive.
18. The method of claim 17 , wherein providing the virtual all term comprises providing the virtual all term configured to inactivate a processing of third-party provided include terms in the SPF policy.