mail/py-checkdmarc 6.0.1 NetBSD

6.0.4 Fixed SPF: concatenate TXT character-strings without removing literal quotes or backslashes before selecting records, so a split within or immediately after v=spf1 is accepted in top-level, include:, and redirect= lookups as required by RFC 7208 section 3.3 DNS: escape literal quotes and backslashes in quoted TXT output so payload characters remain distinct from string boundaries (RFC 1035 section 5.1) DNS: preserve UTF-8 sequences split across TXT byte boundaries, retaining the original string lengths for SPF size warnings (RFC 1035 section 3.3) DNS: escape linefeeds in quoted TXT output so dnspython can parse it back into the original byte strings SPF: decode non-digit DNS escapes in quoted input to parse_spf_record() …

6.0.3 Fixed SPF: a record split into several quoted strings was reported as one oversized string ("appears to be a single N-byte string") whenever it was reached through an include: or redirect=, or looked up with get_spf_record(). Only check_spf() asked the resolver to keep the boundaries between a TXT record's character-strings, so every other caller measured the whole record as one string. The lookup now always keeps them Changed SPF: the quoted_txt_segments argument of query_spf_record() is deprecated and ignored; passing it raises a DeprecationWarning. It never changed the returned record, which always has the quotes stripped SPF: the record size warnings cite RFC 1035 section 3.3 for the 255-byte limit on a single TXT character-string, which is where that limit is defined; …

6.0.1 Fixed SPF: the RFC 6652 reporting modifiers ra=, rp=, and rr=, added in 5.8.0 and removed later, are recognized again; their values are validated against RFC 6652 §3 (rp= per erratum 6579) and surfaced in the parsed result as ra, rp, and rr next to exp, and a malformed value is warned about and ignored instead of failing the record. Warnings also cover the two RFC 6652 §3 semantic rules — rp= and rr= do nothing without ra=, and ra= is ignored in a record reached through an include — and exp= and these modifiers are now honored after all in any order 6.0.0 …

5.17.4 Highlights Checking a domain whose DNS answer holds a chain of names — aws.amazon.com and bka.de were the reported cases — raised AttributeError: 'NoneType' object has no attribute 'name' and aborted the whole run. The DNSSEC code inferred what an answer contained by counting record sets, so a two-record answer with no signature in it was handed to the validator. Records are now selected by name and type.