SPF layering for performant message authorization assertions
Sender Policy Framework (SPF) is a widely used method of distinguishing authorized email from unauthorized email. SPF policies are published into a domain's DNS and then looked up and evaluated by mail receivers. Due to the complexity and limitations of the SPF specification, implementation mistakes and risks are widespread. Embodiments of the present disclosure enable new SPF techniques such as creating a top layer SPF policy for dividing addresses into categories, and multiple second layer SPF policies for identifying IP addresses corresponding to each category. One of the second layer policies is selected as a default policy, such that any IP address that does not correspond to any other of the second layer SPF policies will match the default policy.
1. A method comprising:
generating a Sender Policy Framework (SPF) policy; wherein the SPF policy comprises:
a top layer SPF policy comprising a plurality of terms, each term of the plurality of terms corresponding to a category of a plurality of categories, and
a plurality of second layer SPF policies, each second layer SPF policy corresponding to a particular category, of the plurality of categories, wherein each second layer SPF policy indicates a set of IP addresses in the particular category; and
applying the generated SPF policy to an IP address of a source of a received email message to determine a qualifier associated with the received email message;
wherein each term, of the plurality of terms, comprises:
an SPF mechanism;
an SPF qualifier; and
a reference to a particular one of the plurality of second layer SPF policies; and
wherein the plurality of second layer SPF policies includes a default second layer policy, and wherein the set of IP addresses indicated by the default second layer policy corresponds to one of the following:
a set of all IP addresses, or
an inverse of a union of IP addresses indicated in all other second layer SPF policies.
2. The method of claim 1 , wherein the SPF mechanism comprises one of the following:
an “a” mechanism, or
an “include” mechanism.
3. The method of claim 1 , wherein each qualifier is selected from one of the following:
a pass qualifier,
a neutral qualifier,
a softfail qualifier, or
a fail qualifier.
4. The method of claim 3 , wherein each term of the plurality of terms comprises a unique qualifier.
5. The method of claim 1 , wherein the default second layer SPF policy corresponds to a right-most term in the top layer SPF policy.
6. The method of claim 1 , wherein each of the second layer SPF policies is stored at a unique domain.
7. A method comprising:
publishing a Sender Policy Framework (SPF) policy;
wherein the SPF policy comprises:
a top layer SPF policy comprising a plurality of terms, each term of the plurality of terms corresponding to a category of a plurality of categories, and
a plurality of second layer SPF policies, each second layer SPF policy corresponding to a particular category, of the plurality of categories, wherein each second layer SPF policy indicates a set of IP addresses in the particular category; and
applying the published SPF policy to an IP address of a source of a received email message to determine a qualifier associated with the received email message;
wherein each term, of the plurality of terms, comprises:
an SPF mechanism;
an SPF qualifier; and
a reference to a particular one of the plurality of second layer SPF policies; and
wherein the plurality of second layer SPF policies includes a default second layer policy, and wherein the set of IP addresses indicated by the default second layer policy corresponds to one of the following:
a set of all IP addresses, or
an inverse of a union of IP addresses indicated in all other second layer SPF policies.
8. The method of claim 7 , wherein the SPF mechanism comprises one of the following:
an “a” mechanism, or
an “include” mechanism.
9. The method of claim 7 , wherein each qualifier is selected from one of the following:
a pass qualifier,
a neutral qualifier,
a softfail qualifier, or
a fail qualifier.
10. The method of claim 9 , wherein each term of the plurality of terms comprises a unique qualifier.
11. The method of claim 7 , wherein the default second layer SPF policy corresponds to a right-most term in the top layer SPF policy.
12. The method of claim 7 , wherein each of the second layer SPF policies is stored at a unique domain.
13. A method comprising:
providing a top layer Sender Policy Framework (SPF) policy for inclusion in an SPF policy;
wherein providing the top layer SPF policy comprises providing a plurality of terms, each term of the plurality of terms corresponding to a category of a plurality of categories, and wherein each term, of the plurality of terms, comprises:
an SPF mechanism;
an SPF qualifier; and
a reference to a particular one of a plurality of second layer SPF policies;
wherein each second layer SPF policy indicates a set of IP addresses in a particular category of the plurality of categories;
wherein the plurality of second layer SPF policies includes a default second layer policy, and wherein the set of IP addresses indicated by the default second layer policy corresponds to one of the following:
a set of all IP addresses, or
an inverse of a union of IP addresses indicated in all other second layer SPF policies and
applying the provided top-layer SPF policy to an IP address of a source of a received email message to determine a qualifier associated with the received email message.
14. The method of claim 13 , wherein the SPF mechanism comprises one of the following:
an “a” mechanism, or
an “include” mechanism.
15. The method of claim 13 , wherein each qualifier is selected from one of the following:
a pass qualifier,
a neutral qualifier,
a softfail qualifier, or
a fail qualifier.
16. The method of claim 15 , wherein each term of the plurality of terms comprises a unique qualifier.
17. The method of claim 13 , wherein the default second layer SPF policy corresponds to a right-most term in the top layer SPF policy.