From 29580ed12e92006ae34bf9b98a6783a9d8904b84 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Tue, 8 Sep 2026 13:26:57 +0200 Subject: plan: add Namecheap Private Email to the provider table Its SPF is a tree of includes rather than a flat list: spf.privateemail.com carries no addresses at all, only includes, and one branch nests a further level. Two of the branches live on jellyfish.systems. The entry here is the flattened union of the five leaf records, deduplicated, 18 networks. The re-verification command lists the leaves rather than the top-level name, and a note says why: querying spf.privateemail.com and finding no ip4 entries looks like a stale record and is not one. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R --- docs/plans/2026-09-08-parse.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'docs') diff --git a/docs/plans/2026-09-08-parse.md b/docs/plans/2026-09-08-parse.md index 8d30cae..f400240 100644 --- a/docs/plans/2026-09-08-parse.md +++ b/docs/plans/2026-09-08-parse.md @@ -1789,6 +1789,9 @@ from abusectl import parse # proton dig TXT _spf.protonmail.ch + _spf2.protonmail.ch # outlook dig TXT spf.protection.outlook.com # zoho dig TXT spf.zoho.eu +# privateemail spf.privateemail.com, which is INCLUDES rather than +# addresses: ips1 + ips2 + fbrelay + spf-pe.jellyfish.systems +# + spf-ep-nc.jellyfish.systems, flattened here # # Static rather than read from SPF at runtime: SPF is a DNS lookup, and while # the never-resolve rule is about parsing hostile mail rather than setup, a @@ -1832,6 +1835,29 @@ PROVIDERS: dict[str, list[str]] = { "52.103.0.0/17", "104.47.0.0/17", ], + # Namecheap Private Email. Its SPF is a tree of includes rather than a + # flat list, and two of the branches live on jellyfish.systems, so this + # entry is the flattened union of all of them, deduplicated. + "privateemail": [ + "63.250.43.64/26", + "66.29.159.48/28", + "66.29.159.80/28", + "104.207.68.0/24", + "162.0.218.228/32", + "162.0.218.229/32", + "162.0.218.230/32", + "162.0.218.231/32", + "198.54.118.192/27", + "198.54.122.64/27", + "198.54.122.96/27", + "198.54.122.128/27", + "198.54.127.32/27", + "198.54.127.64/27", + "198.54.127.96/27", + "198.54.127.128/26", + "198.177.127.176/28", + "198.177.127.192/27", + ], "zoho": [ "185.20.209.0/24", "31.186.226.0/24", -- cgit v1.2.3