Unicode characters in spf record valid?

Asked by Tony Grobe

I've run across a domain that has what look like encoded Unicode characters in its spf record (names and ips obfuscated):

"\194\147v=spf1" "ip4:192.168.77.0/24" "ip4:192.168.78.0/24" "include:example.com" "\194\150all\194\148"

Pypolicyd-spf 1.0 chokes on this record with the following logging:

 Traceback (most recent call last):
   File "/usr/bin/policyd-spf", line 684, in <module>
     instance_dict, configData, peruser)
   File "/usr/bin/policyd-spf", line 426, in _spfcheck
     res = spf.check2(ip, helo_fake_sender, helo)
   File "/usr/lib/python2.6/site-packages/spf.py", line 310, in check2
     receiver=receiver,timeout=timeout,verbose=verbose,querytime=querytime).check()
   File "/usr/lib/python2.6/site-packages/spf.py", line 538, in check
     spf = self.dns_spf(self.d)
   File "/usr/lib/python2.6/site-packages/spf.py", line 1094, in dns_spf
     a = [t for t in self.dns_txt(domain) if RE_SPF.match(t)]
   File "/usr/lib/python2.6/site-packages/spf.py", line 1131, in dns_txt
     for a in self.dns(domainname, 'TXT')]
   File "/usr/lib/python2.6/site-packages/spf.py", line 1130, in <genexpr>
     return [''.join(s.decode("ascii") for s in a)
 UnicodeDecodeError: 'ascii' codec can't decode byte 0xc2 in position 0: ordinal not in range(128)

Postfix (2.9.3) sees this as a policy service failure and tempfails the message.

I installed pypolicyd-spf several days ago and ran in testing mode while monitoring logging to look for problems. Nothing seemed to be wrong so I made the switch from the perl based policy server I had been using to pypolicyd-spf. Then this delivery attempt started happening, which makes me wonder whether this record should be seen as invalid and discarded or decoded before interpretation.

I'm tempted to email their postmaster and tell them the record is at best invalid, but was hoping for some clarification on this first.

Question information

Language:
English Edit question
Status:
Solved
For:
pypolicyd-spf Edit question
Assignee:
No assignee Edit question
Solved by:
Scott Kitterman
Solved:
Last query:
Last reply:
Revision history for this message
Best Scott Kitterman (kitterman) said :
#1

Unicode characters are not valid in an SPF record, but the policy server should handle this better. I've created Bug #1009034 to address this.

Revision history for this message
Tony Grobe (tony-grobe+launchpad) said :
#2

Thanks Scott Kitterman, that solved my question.