diff options
| -rw-r--r-- | docs/plans/2026-09-08-parse.md | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/docs/plans/2026-09-08-parse.md b/docs/plans/2026-09-08-parse.md index 8d30cae..f400240 100644 --- a/docs/plans/2026-09-08-parse.md +++ b/docs/plans/2026-09-08-parse.md @@ -1789,6 +1789,9 @@ from abusectl import parse # proton dig TXT _spf.protonmail.ch + _spf2.protonmail.ch # outlook dig TXT spf.protection.outlook.com # zoho dig TXT spf.zoho.eu +# privateemail spf.privateemail.com, which is INCLUDES rather than +# addresses: ips1 + ips2 + fbrelay + spf-pe.jellyfish.systems +# + spf-ep-nc.jellyfish.systems, flattened here # # Static rather than read from SPF at runtime: SPF is a DNS lookup, and while # the never-resolve rule is about parsing hostile mail rather than setup, a @@ -1832,6 +1835,29 @@ PROVIDERS: dict[str, list[str]] = { "52.103.0.0/17", "104.47.0.0/17", ], + # Namecheap Private Email. Its SPF is a tree of includes rather than a + # flat list, and two of the branches live on jellyfish.systems, so this + # entry is the flattened union of all of them, deduplicated. + "privateemail": [ + "63.250.43.64/26", + "66.29.159.48/28", + "66.29.159.80/28", + "104.207.68.0/24", + "162.0.218.228/32", + "162.0.218.229/32", + "162.0.218.230/32", + "162.0.218.231/32", + "198.54.118.192/27", + "198.54.122.64/27", + "198.54.122.96/27", + "198.54.122.128/27", + "198.54.127.32/27", + "198.54.127.64/27", + "198.54.127.96/27", + "198.54.127.128/26", + "198.177.127.176/28", + "198.177.127.192/27", + ], "zoho": [ "185.20.209.0/24", "31.186.226.0/24", |