Regulation of SPF policy terms
Sender Policy Framework (SPF) is a widely used method of distinguishing authorized email from unauthorized email. SPF policies are published into a domain's DNS and then looked up and evaluated by mail receivers. Due to the complexity and limitations of the SPF specification, implementation mistakes and risks are widespread. This problem is compounded by the common practice of nesting SPF policies which introduces hidden risks, particularly exceeding DNS lookup limits. Embodiments of the present disclosure enable new SPF techniques such as selectively inactivating parts of a policy by introducing a virtual-all term, designed to secure against the third-party term inclusions in the policy. When the primary policy is online, the virtual-all term may serve as a terminate policy evaluation much like a traditional “all” term. If the primary policy is offline, a “fail open” may be produced, allowing policy evaluation to proceed into previously inactivated segment of the policy.
1. A method comprising:
generating a virtual all term for inclusion in a sender policy framework (SPF) policy used to manage a domain's policy,
wherein the virtual all term comprises a term configured to render any subsequent term in an SPF policy inactive, and
wherein the virtual all term is provided for inclusion into the SPF policy prior to the domain's pre-existing policy terms.
2. The method of claim 1 , wherein generating the virtual all term comprises generating a term associated with one of the following:
an inverse of active policy terms in the SPF policy evaluated in out-of-order SPF policy processing, or
every internet protocol address.
3. The method of claim 2 , wherein the virtual all term is associated with the inverse of the active policy terms in the SPF policy for out-of-order SPF policy processing, and wherein the virtual all term is associated with every internet protocol address for left-to-right SPF policy processing.
4. The method of claim 2 , wherein generating the virtual all term comprises selecting an SPF mechanism and a qualifier.
5. The method of claim 4 , wherein generating the virtual all term comprises selecting the qualifier from one of the following:
a pass qualifier,
a fail qualifier,
a softfail qualifier, or
a neutral qualifier.
6. The method of claim 4 , wherein generating the virtual all term comprises selecting the mechanism from one of the following:
an “include” mechanism,
an “a” mechanism,
an “exists” mechanism,
an “mx” mechanism,
an “ip4” mechanism, or
an “ip6” mechanism.
7. The method of claim 1 , wherein generating the virtual all term comprises generating the virtual all term configured to inactivate include terms in the SPF policy positioned to the right of the virtual all term.
8. A method comprising:
publishing a Sender Policy Framework (SPF) policy for a domain, the SPF policy comprising a virtual all term,
wherein the virtual all term comprises a term configured to render any subsequent term in an SPF policy inactive, and
wherein the virtual all term is provided for inclusion into the SPF policy prior to the domain's pre-existing policy terms.
9. The method of claim 8 , wherein the virtual all term comprises a term associated with one of the following:
an inverse of active policy terms in the SPF policy evaluated in out-of-order SPF policy processing, or
every internet protocol address.
10. The method of claim 9 , wherein the virtual all term is associated with the inverse of the active policy terms in the SPF policy for out-of-order SPF policy processing, and wherein the virtual all term is associated with every internet protocol address for left-to-right SPF policy processing.
11. The method of claim 8 , wherein the virtual all term includes an SPF mechanism and a qualifier.
12. The method of claim 11 , wherein the qualifier is selected from one of the following:
a pass qualifier,
a fail qualifier,
a softfail qualifier, or
a neutral qualifier.
13. The method of claim 11 , wherein the mechanism is selected from one of the following:
an “include” mechanism,
an “a” mechanism,
an “exists” mechanism,
an “mx” mechanism,
an “ip4” mechanism, or
an “ip6” mechanism.
14. The method of claim 8 , wherein the virtual all term is configured to inactivate include terms in the SPF policy positioned to the right of the virtual all term.
15. A method comprising:
providing a virtual all term for inclusion in an SPF policy of a domain,
wherein providing the virtual all term comprises providing a term configured to render any subsequent term in an SPF policy inactive, and
wherein the virtual all term is provided for inclusion into the SPF policy prior to the domain's pre-existing policy terms.
16. The method of claim 15 , wherein providing the virtual all term comprises providing a term associated with one of the following:
an inverse of active policy terms in the SPF policy evaluated in out-of-order SPF policy processing, or
every internet protocol address.
17. The method of claim 16 , wherein the virtual all term is associated with the inverse of the active policy terms in the SPF policy for out-of-order SPF policy processing, and wherein the virtual all term is associated with every internet protocol address for left-to-right SPF policy processing.
18. The method of claim 15 , wherein providing the virtual all term comprises selecting an SPF mechanism and a qualifier.
19. The method of claim 18 , wherein providing the virtual all term comprises:
selecting the qualifier from one of the following:
a pass qualifier,
a fail qualifier,
a softfail qualifier, or
a neutral qualifier; and
selecting the mechanism from one of the following:
an “include” mechanism,
an “a” mechanism,
an “exist” mechanism,
an “mx” mechanism,
an “ip4” mechanism, or
an “ip6” mechanism.
20. The method of claim 15 , wherein generating the virtual all term comprises generating the virtual all term configured to inactivate third-party provided include terms in the SPF policy.