albertito / spf

100%

master: 100%

push

ptr: Make reverse DNS lookup errors fail to match

Currently, when processing a ptr mechanism, if the reverse DNS lookup
fails (with other than NXDOMAIN), then it returns temperror.

However, the standard is clear that we should just fail to match
instead:

> Check all validated domain names to see if they either match the
> <target-name> domain or are a subdomain of the <target-name> domain.
> If any do, this mechanism matches.  If no validated domain name can
> be found, or if none of the validated domain names match or are a
> subdomain of the <target-name>, this mechanism fails to match.  If a
> DNS error occurs while doing the PTR RR lookup, then this mechanism
> fails to match.  If a DNS error occurs while doing an A RR lookup,
> then that domain name is skipped and the search continues.

https://tools.ietf.org/html/rfc7208#section-5.5

This patch fixes this by making those lookup errors fail to match as
described by the standard.

2 of 2 new or added lines in 1 file covered. (100.0%)

569 of 570 relevant lines covered (99.82%)

2591.37 hits per line