Skip to content

Zone11: different handling of root zone, TLD zones and zones in .arpa#1415

Merged
marc-vanderwal merged 6 commits into
zonemaster:developfrom
marc-vanderwal:bugfix/zone11-overhaul
Nov 14, 2025
Merged

Zone11: different handling of root zone, TLD zones and zones in .arpa#1415
marc-vanderwal merged 6 commits into
zonemaster:developfrom
marc-vanderwal:bugfix/zone11-overhaul

Conversation

@marc-vanderwal

@marc-vanderwal marc-vanderwal commented Jul 31, 2025

Copy link
Copy Markdown
Contributor

Purpose

This PR amends the specification for Zone11 so that different message tags of different severity levels are output if Zonemaster is run on the root zone, a TLD zone or a zone inside .arpa. It also cleans up some rough edges and migrates to MethodsV2.

Context

See #1256.

Changes

  • Root zones, TLD zones and zones inside .arpa are tested differently: an INFO is output if no SPF or a null SPF is found, and a message tag of higher level is output if a non-null SPF is found.
  • Use MethodsV2 instead of legacy Methods.
  • Miscellaneous small rewordings

Breaking message tag changes

This PR changes the arguments to the following existing message tags:

Tag Old arguments New arguments
Z11_DIFFERENT_SPF_POLICIES_FOUND ns_ip_list ns_list

This PR replaces the following message tags with new tags:

Old tag Old tag arguments New tag New tag arguments
Z11_SPF1_MULTIPLE_RECORDS ns_ip_list Z11_SPF_MULTIPLE_RECORDS ns_list
Z11_SPF1_SYNTAX_ERROR ns_ip_list Z11_SPF_SYNTAX_ERROR ns_list
Z11_SPF1_SYNTAX_OK ns_ip_list Z11_SPF_SYNTAX_OK ns_list

How to test this PR

Review.

@marc-vanderwal marc-vanderwal added this to the v2025.2 milestone Jul 31, 2025
@marc-vanderwal marc-vanderwal added the A-TestCase Area: Test case specification or implementation of test case label Jul 31, 2025
@matsduf

matsduf commented Aug 1, 2025

Copy link
Copy Markdown
Contributor
* Replace all mentions of “SPF version 1” with plain “SPF”, in text and message tags.

What is the motivation not to mention that is should be version 1? I think it should be kept even though it does not have to be mentioned more than once and not in the tags.

* Add a step stating that the test be skipped if running on the root zone, TLD zone or a zone inside .arpa.

I think it is more reasonable to check for a policy, and expect that it says "no mail" if present. If absent, an info message is reasonable for those kind of zones.

* Replace mentions of legacy Methods with the equivalent methods in MethodsV2.

"Replace legacy Methods with the equivalent methods in MethodsV2." It is not just a mentioning, but an update of the test case that requires an updated implementation.

How to test this PR

N/A. However, reviewers are advised to review this PR commit by commit.

It should be reviewed, isn't that what we mean by testing an update of a document?

Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
@matsduf

matsduf commented Aug 1, 2025

Copy link
Copy Markdown
Contributor

In Objective is says "Sender Policy Framework (SPF), described in [RFC 7208], is a mechanism". I think it should say "defined in".

@marc-vanderwal marc-vanderwal force-pushed the bugfix/zone11-overhaul branch from d3477ec to e235d87 Compare August 4, 2025 08:45
@marc-vanderwal marc-vanderwal changed the title Zone11: skip test if testing root, TLD or zone in .arpa Zone11: different handling of root zone, TLD zones and zones in .arpa Aug 4, 2025
@marc-vanderwal

Copy link
Copy Markdown
Contributor Author

I have changed the approach and addressed your review comments. Please re-review.

@marc-vanderwal marc-vanderwal requested a review from matsduf August 4, 2025 08:57
matsduf
matsduf previously requested changes Aug 4, 2025
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Servers").

4. For each name server in *Name Server IP* do:
4. For each name server in *Name Servers* do:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR has chosen a different approach than #1409 for DNSSEC05. In the implementation the name server IP what counts. In the messages name/IP should be included. I think we should find a wording that we consistently use in all updates where name/IP are expected in the messages.

@marc-vanderwal marc-vanderwal Aug 5, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I’ll reword as “For each name server IP address in Name Server IP do:”

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, there are some aspects of the approach in #1409. First there is the text in

The name server names are assumed to be available at the time when the msgid
is created, if the argument name is "ns" or "ns_list" even when in the
"[Test procedure]" below it is only referred to the IP address of the name
servers.
and then
5. For all messages outputted below, if an IP address in *NS IP* is connected to
more than one name server name, then all names should be included with the
message tag if it is specified that name server name and IP address should
be outputted with the message tag.

I am not sure if the approach in #1409 is the best one. In the implementation you probably want to go by IP address, and should that be reflected in the specification?

@marc-vanderwal marc-vanderwal Aug 6, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, I didn’t notice those bits in the DNSSEC05 proposal.

Yes, it is a recurring pattern that we iterate on name server IPs under the hood but that we report name server name and IP pairs in user-visible messages. And we need to be careful with the edge case where a zone has more than one name server name pointing to the same IP address.

So I think the approach makes sense. Maybe we should keep it somewhere in a template?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not only the edge case when a zone has serveral names to the same IP address, it is also the case when the name in the delegation does not match the name in the zone, but the IP is the same. The latter is probably more common.

We have a template in https://github.com/zonemaster/zonemaster/blob/master/docs/internal/templates/specifications/tests/Template01.md which probably needs some updates.

Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
@marc-vanderwal marc-vanderwal force-pushed the bugfix/zone11-overhaul branch 2 times, most recently from d5b7f29 to ac1dbaa Compare August 5, 2025 07:11
@marc-vanderwal marc-vanderwal requested a review from matsduf August 5, 2025 07:12
@matsduf matsduf dismissed their stale review August 5, 2025 14:52

Looks fine now. Maybe there should be clarification on "ns_list" to catch the situation when more than one NS name has the same IP address.

@marc-vanderwal marc-vanderwal force-pushed the bugfix/zone11-overhaul branch from ac1dbaa to 1290ecd Compare August 6, 2025 07:20
matsduf
matsduf previously approved these changes Aug 6, 2025

@matsduf matsduf left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine. Do you plan to create a scenario PR too?

marc-vanderwal added a commit to marc-vanderwal/zonemaster that referenced this pull request Aug 7, 2025
The overhaul of the test specification for Zone11 (see zonemaster#1415) is a good
opportunity to add some test scenarios for that same test case.

Of note here are the scenarios that perform tests on three different
root zones. They will require three changes to the root hints during
unit testing.
@marc-vanderwal

Copy link
Copy Markdown
Contributor Author

Looks fine. Do you plan to create a scenario PR too?

Yes, I was working on that in parallel but I was waiting for the outline of Zone11’s new test case specification to be stabilized before creating the PR. I’ve just created #1417. Then I’ll follow up with the implementation when the outline of that specification is stabilized.

@matsduf matsduf added the RC-Features Release category: Features. label Aug 10, 2025
marc-vanderwal added a commit to marc-vanderwal/zonemaster that referenced this pull request Aug 13, 2025
The overhaul of the test specification for Zone11 (see zonemaster#1415) is a good
opportunity to add some test scenarios for that same test case.

Of note here are the scenarios that perform tests on three different
root zones. They will require three changes to the root hints during
unit testing.
@tgreenx tgreenx linked an issue Oct 7, 2025 that may be closed by this pull request

@tgreenx tgreenx left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Just one comment.

Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
This commit implements a few miscellaneous minor wording changes.

Firstly, shorten the msgid of Z11_DIFFERENT_SPF_POLICIES_FOUND in order
to reduce redundant information. This tag is always emitted along with
Z11_INCONSISTENT_SPF_POLICIES.

Secondly, remove explicit mentions to “version 1” of SPF except for the
very first occurrence. There is currently no reason to make any
distinctions between versions of SPF, because there is currently only
one version. And despite the current RFC, RFC 7208, being an update to
RFC 4408, SPF stayed at version 1 ever since. This commit alters both
the specification text and the message tags.
The root zone, TLDs and zones in .arpa are not expected to be domains
appropriate for receiving e-mail. They should not be appropriate as
sender e-mail addresses either.

In the current wording of the specification, a NOTICE (Z11_NO_SPF_FOUND)
is output telling the user that no SPF record was found, when running
Zonemaster on such zones. That message tends to stick out like a sore
thumb, especially on well-configured TLD zones. That NOTICE should not
be there.

The specification is amended so that it outputs specific message tags
when the test is being run on such a zone: if there is no SPF record or
it is a null SPF policy, then we output a special message tag of level
INFO, and if it is a non-null SPF policy, it’s another message of a
higher level.

In doing so, this has the effect of squelching the
NOTICE (Z11_NO_SPF_FOUND) that users have been complaining about when
testing root, TLDs and zones inside .arpa.
Since we’ve overhauling Zone11, we might as well do some more
maintenance work on the specification.
Amend the message tags and the specification in order to be able to
report the (name, IP) pairs instead of the IP addresses.

This is a breaking change for the following message tags and will
require a database migration script:

 * Z11_DIFFERENT_SPF_POLICIES_FOUND
 * Z11_SPF_MULTIPLE_RECORDS
 * Z11_SPF_SYNTAX_ERROR
Given our definition of what an ERROR is, it is inappropriate to report
Z11_SPF_MULTIPLE_RECORDS, Z11_SYNTAX_ERROR and
Z11_UNABLE_TO_CHECK_FOR_SPF as errors. These tags do not represent
conditions that prevent correct operation for the zone, but at best,
they are conditions that can cause problems in degraded scenarios. We
have to degrade the messages with ERROR level to WARNING level.

See also: zonemaster/zonemaster-engine#1471.
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated

@matsduf matsduf left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test case has "ns_list" arguments for some tags, and then there is a chance that the same IP address is used by multiple name server names. It should be stated explicitly that "ns_list" includes all such name/IP pairs.

Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
Comment thread docs/public/specifications/tests/Zone-TP/zone11.md Outdated
@marc-vanderwal

Copy link
Copy Markdown
Contributor Author

Step 7 in the test procedure already states:

For all messages outputted below, if an IP address in Name Servers is connected to more than one name server name, then all names should be included with the message tag.

But I found a paragraph in the “Summary” section that was no longer true. I’ve updated it with a similar text. Does this make step 7 in the test procedure redundant?

@tgreenx tgreenx left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Implementation in zonemaster/zonemaster-engine#1477.

marc-vanderwal added a commit to marc-vanderwal/zonemaster that referenced this pull request Nov 5, 2025
The overhaul of the test specification for Zone11 (see zonemaster#1415) is a good
opportunity to add some test scenarios for that same test case.

Of note here are the scenarios that perform tests on three different
root zones. They will require three changes to the root hints during
unit testing.
marc-vanderwal added a commit to marc-vanderwal/zonemaster that referenced this pull request Nov 5, 2025
The overhaul of the test specification for Zone11 (see zonemaster#1415) is a good
opportunity to add some test scenarios for that same test case.

Of note here are the scenarios that perform tests on three different
root zones. They will require three changes to the root hints during
unit testing.
marc-vanderwal added a commit to marc-vanderwal/zonemaster that referenced this pull request Nov 6, 2025
The overhaul of the test specification for Zone11 (see zonemaster#1415) is a good
opportunity to add some test scenarios for that same test case.

Of note here are the scenarios that perform tests on three different
root zones. They will require three changes to the root hints during
unit testing.
@matsduf

matsduf commented Nov 13, 2025

Copy link
Copy Markdown
Contributor

@marc-vanderwal, please merge.

@marc-vanderwal marc-vanderwal merged commit dde4df0 into zonemaster:develop Nov 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-TestCase Area: Test case specification or implementation of test case RC-Features Release category: Features.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SPF warning for TLD (Zone11)

3 participants