# Simple tests, used for debugging the testing infrastructure; and some
# additional tests for situations not covered by the other files.
---
description: Simple successes
tests:
test1:
description: Straightforward sucesss
helo: example.net
mailfrom: "foobar@example.net"
host: 1.2.3.4
result: pass
test2:
description: HELO is set, but expected to be ignored
helo: blargh
mailfrom: "foobar@example.net"
host: 1.2.3.4
result: pass
zonedata:
example.net:
- SPF: v=spf1 +all
---
description: Simple failures
tests:
test1:
description: Straightforward failure
helo: example.net
mailfrom: "foobar@example.net"
host: 1.2.3.4
result: fail
test2:
description: HELO is set, but expected to be ignored
helo: blargh
mailfrom: "foobar@example.net"
host: 1.2.3.4
result: fail
zonedata:
example.net:
- SPF: v=spf1 -all
---
description: Regexp edge cases for "a", "mx" and "ptr"
tests:
ipv6-with-a:
description: |
Send from an ip6 address that has "a:" inside. If we incorrectly parse
the "ip6" as "a", this results in a permerror since the host doesn't
match.
mailfrom: "foobar@a1.net"
host: a::a
result: pass
bad-a-mask:
description: |
If we incorrectly parse the "ip6" as "a", this results in a permerror
due to an invalid mask.
mailfrom: "foobar@a2.net"
host: 2001:db8:ff0:100::2
result: softfail
exp-contains-mx:
description: exp= contains mx:, which should be ignored.
mailfrom: "foobar@expmx.net"
host: 1.2.3.4
result: softfail
exp-contains-ptr:
description: |
exp= contains ptr:, which should be ignored.
Note this test case involves unusual/invalid domains.
mailfrom: "foobar@expptr.net"
host: 1.2.3.4
result: softfail
zonedata:
a1.net:
- SPF: v=spf1 ip6:a::a ~all
a2.net:
- SPF: v=spf1 ip6:1a0a:cccc::/29 ~all
expmx.net:
- SPF: v=spf1 exp=mx:mymx.com ~all
- MX: [10, mymx.com]
mymx.com:
- A: 1.2.3.4
expptr.net:
- SPF: v=spf1 exp=ptr:lalala.com ~all
4.3.2.1.in-addr.arpa:
- PTR: ptr:lalala.com.
ptr:lalala.com:
- A: 1.2.3.4
---
description: Error on PTR forward resolution
tests:
broken-ptr-forward:
description: |
Check that if during 'ptr' forward resolution we get an error, we skip
the domain (and consequently fail the check).
mailfrom: "foo@domain.net"
host: 1.2.3.4
result: softfail
zonedata:
domain.net:
- SPF: v=spf1 ptr:lalala.com ~all
4.3.2.1.in-addr.arpa:
- PTR: lalala.com
lalala.com:
- TIMEOUT: true
---
description: Permanent error on 'exists' resolution
tests:
exists-perm-error:
description: |
Check that if, during an 'exists' forward resolution we get an error, we
return temperror.
mailfrom: "foo@domain.net"
host: 1.2.3.4
result: temperror
zonedata:
domain.net:
- SPF: v=spf1 exists:lalala.com ~all
lalala.com:
- SERVFAIL: true
---
description: Resolve H macros correctly
tests:
resolve-h-macros:
description: |
Check that '%{h}' macros are correctly resolved to the HELO/EHLO and not
the sender domain.
mailfrom: "foo@domain.net"
helo: holahola
host: 1.2.3.4
result: pass
zonedata:
domain.net:
- SPF: v=spf1 exists:%{h}.com ~all
holahola.com:
- A: 127.0.0.2
---
description: Only include the first 10 PTR results
tests:
only-first-10-ptr:
description: |
Check that if during 'ptr' forward resolution we only consider the first
10 names, and ignore the rest.
mailfrom: "foo@domain.net"
host: 1.2.3.4
result: softfail
zonedata:
domain.net:
- A: 127.0.0.1
- SPF: v=spf1 ptr ~all
4.3.2.1.in-addr.arpa:
- PTR: dom01.com
- PTR: dom02.com
- PTR: dom03.com
- PTR: dom04.com
- PTR: dom05.com
- PTR: dom06.com
- PTR: dom07.com
- PTR: dom08.com
- PTR: dom09.com
- PTR: dom10.com
# Entries below here should get dropped. They would make it pass.
- PTR: domain.net
dom01.com:
- A: 127.0.0.1
dom02.com:
- A: 127.0.0.2
dom03.com:
- A: 127.0.0.3
dom04.com:
- A: 127.0.0.4
dom05.com:
- A: 127.0.0.5
dom06.com:
- A: 127.0.0.6
dom07.com:
- A: 127.0.0.7
dom08.com:
- A: 127.0.0.8
dom09.com:
- A: 127.0.0.9
dom10.com:
- A: 127.0.0.10
---
description: Resolution limits
tests:
resolution-with-10-lookups:
description: |
Check that a resolution with precisely 10 lookups (the default limit)
works fine.
mailfrom: "foo@okay.com"
host: 1.2.3.4
result: pass
resolution-with-11-lookups:
description: |
Check that a resolution with precisely 11 lookups (over default limit)
fails as expected.
mailfrom: "foo@bad.com"
host: 1.2.3.4
result: permerror
zonedata:
okay.com:
- SPF: v=spf1 include:d11 include:d12 include:d13
include:d14 include:d15 -all
bad.com:
- SPF: v=spf1 include:d00
include:d11 include:d12 include:d13
include:d14 include:d15 -all
d00:
- SPF: v=spf1 -all
d11:
- SPF: v=spf1 include:d21 ~all
d12:
- SPF: v=spf1 include:d22 ~all
d13:
- SPF: v=spf1 include:d23 ~all
d14:
- SPF: v=spf1 include:d24 ~all
d15:
- SPF: v=spf1 include:d25 ~all
d21:
- SPF: v=spf1 -all
d22:
- SPF: v=spf1 -all
d23:
- SPF: v=spf1 -all
d24:
- SPF: v=spf1 -all
d25:
- SPF: v=spf1 all
---
description: MX resolution limits
tests:
mx-resolution-10-terms:
description: |
Check that a resolution with 10 "mx" terms works, because it's within
the limit. Each term will resolve to multiple records, but those
shouldn't be individually counted (there's a limit of 10 MX records per
MX lookup, but that's tested separately).
mailfrom: "foo@mx10"
host: 1.2.3.4
result: pass
mx-resolution-11-terms:
description: |
Check that a resolution with 11 "mx" terms, causes a permerror due to
exceeding lookup limits.
mailfrom: "foo@mx11"
host: 1.2.3.4
result: permerror
zonedata:
mx10:
- SPF: v=spf1 mx:domain mx:domain mx:domain mx:domain mx:domain
mx:domain mx:domain mx:domain mx:domain mx:domain
all
mx11:
- SPF: v=spf1 mx:domain mx:domain mx:domain mx:domain mx:domain
mx:domain mx:domain mx:domain mx:domain mx:domain
mx:domain all
domain:
- MX: [1, blah1]
- MX: [2, blah2]
- MX: [3, blah3]
---
description: NXDOMAIN tests
tests:
one-mx-not-found:
description: |
Check that if one of the MXs is not found, we continue evaluating the
rest.
mailfrom: "foo@d00"
host: 1.2.3.4
result: pass
all-mx-not-found:
description: |
Check that if none of the MXs is not found, we continue evaluating the
rest of the terms.
mailfrom: "foo@d01"
host: 1.2.3.4
result: pass
domain-not-found:
description: |
Check if the top-level domain is not found (which is different that it
existing but having no TXT record).
mailfrom: "foo@doesnotexist"
host: 1.2.3.4
result: none
include-not-found:
description: |
For include, if the recursive check returns None, it should make the
evaluation return PermError.
mailfrom: "foo@d02"
host: 1.2.3.4
result: permerror
redirect-not-found:
description: |
For redirect, if the recursive check returns None, it should make the
evaluation return PermError.
mailfrom: "foo@d03"
host: 1.2.3.4
result: permerror
zonedata:
d00:
- SPF: v=spf1 mx -all
- MX: [10, "doesnotexist"]
- MX: [20, "sender"]
d01:
- SPF: v=spf1 mx ip4:1.2.3.4 -all
- MX: [10, "doesnotexist"]
- MX: [20, "doesnotexist"]
d02:
- SPF: v=spf1 include:doesnotexist all
d03:
- SPF: v=spf1 redirect=doesnotexist
sender:
- A: 1.2.3.4