On Fri, 11 Aug 2017 17:25:59 +0100 RW wrote: > On Fri, 11 Aug 2017 11:49:29 -0400 > Dianne Skoll wrote: > > > On Fri, 11 Aug 2017 15:27:52 +0000 > > hospice admin <hospice...@outlook.com> wrote: > > > > > text = "v=spf1 exists:%{i}._spf.xyz.com ~all" > > > What I'd like to do is turn this into an RBL check, but > > > eval:check_rbl('Evil-ESP','_spf.xyz.com') > > > > I understand what you're trying to do, but have you thought about > > the implications? You are allowing an evil (your word) > > organization to be an RBL for you. They may very well put every > > possible IPv4 address in their exists: SPF record which would not > > bode well for your spam filtering... > > > > If you still want to do it, I suspect it'd have to be done outside > > of SpamAssassin in the glue code you're using. > > It's not quite the questioned asked, but it is possible to run a regex > match on the actual text record using AskDNS. See the documentation > for Mail::SpamAssassin::Plugin::AskDNS.
or if you want to get a hit with domains that don't use that style of SPF but use the same addresses, you can do the IP lookup using AskDNS with the _LASTEXTERNALIP_ tag.