		DNSSEC extension to libspf2-x: HOWTO
		========================================

Introduction
------------

The DNSSEC extension to libspf2 provides DNSSEC validation to DNS queries in
libspf2.  This document describes how to install libspf2 with DNSSEC validation
functionality. 

libspf2 can be downloaded from http://www.libspf2.org/download.html
This patch was most recently tested with version libspf2-1.2.9.

Unzip and untar the distribution using the following command 
(replace x by the correct version number):

	tar -xvzf libspf2-x.tar.gz

Now apply the patch by (replace x by the correct version number):

	patch -p 0 -b -z .orig </path/to/patch/libspf2-dnssec.patch

This will apply the patch and store the original files with a .orig suffix.

Before compiling libspf2 with the above patch, you will need to install
the libsres and the libval libraries from http://dnssec-tools.sourceforge.net.

To compile libspf2, first run the following sequence of commands from the main
libspf2 source directory to generate new 'configure' and other files needed
for compilation:

	aclocal
	autoheader
	libtoolize --automake --force
	automake
	autoconf

Next, configure with the --enable-dnssec-support option:

	./configure --enable-dnssec-support

Then, compile and install libspf2 as per the instructions given
in the libspf2 distribution.



DNSSEC extension to libspf2: Developer Guide
=============================================

Additions to libspf2
--------------------

The SPF_dns_lookup function can now return an additional error value:

    DNSSEC_FAILURE

The error code SPF_E_DNSSEC_FAILURE is added to the list of error
codes in the response struct when a DNSSEC validation failure occurs
during SPF processing.

After SPF processing, the SPF_response object/variable is available
to the application.  The application can check the error codes within
this variable to see if any of them matches SPF_E_DNSSEC_FAILURE, and
determine if there was DNSSEC validation failure during SPF processing.

For example, it can do the following:

SPF_request_t *requestp;
SPF_response_t *responsep;

/* initialize and configure requestp ... */

/* SPF-checks */
SPF_request_query_mailfrom(requestp, &responsep);

/* Check for DNSSEC validation failure */
do {
   int i, num_errs;
   SPF_error_t *err;
   SPF_errcode_t errcode;
   char *errmsg;
   
   num_errs = SPF_response_warnings (responsep);

   for (i=0; i<num_errs; i++) {
       err = SPF_response_message (responsep, i);
       if (err) {
	  errcode = SPF_error_code (err);
	  if (errcode == SPF_E_DNSSEC_FAILURE) {
	     errmsg = (char *) SPF_error_message (err);
	     /* Take appropriate action */
	  }
       }
   }  
} while (0);

