Re: misconception in SPF

On 07/12/2012 16:23, Christian Grunfeld wrote:
> 2012/12/7 Paul Smith <[email protected]>:
>
>> This problem is really due to the (IMHO horrible) allowance for an A record
>> to be sufficient for mail delivery. However, it would be quite hard to
>> remove that allowance nowadays. I don't know the stats for how many email
>> addresses use A records for delivery rather than MX, but I'd guess its a
>> significant number.
> I think you are confused about the MX on the receiver side and the A
> record of the sender !
> Mails are sent to MX for a domain but the sender has not to have a MX
> record to send !
Oh, I know that. But a reasonable test is that if a message comes from 
an email address which you cannot reply to, then the sender email 
address is probably forged. (This is how call-back verification (CBV) works)

So, if you could ONLY send to MX addresses, the OP's issue wouldn't be a 
significant problem.

Currently, I could send a message from '[email protected]', and 
even though there are no MX records for 'www.microsoft.com', there is an 
'A' record, so a quick check cannot tell that the sender address is 
invalid. I can look for SPF records, but there is no SPF record for 
'www.microsoft.com', so I assume they don't use SPF, and let the message 
through.

(I could use CBV, but since that would also help with the OP's problem, 
I'll assume we aren't doing that)

If (in the past) it had been mandated that you can only send mail to an 
MX record server, then if a message comes from '[email protected]', 
I can quickly tell that it is probably a bad email address, since there 
is no MX record for www.microsoft.com. This would make it easier at the 
cost of 5 seconds more configuration time per domain. Unfortunately, 
it's too late to change that now.

>> As a random thought, would there be the possibility to add some sort of
>> marker on a parent domain to say 'we understand MX records, so we don't use
>> A records for mail within this domain'? So, if you receive mail from
>> 'bibble.twitter.com', you check the TXT records for 'twitter.com' which tell
>> you that subdomains/hosts without an MX record won't have mail, and since
>> there isn't an MX record for 'bibble.twitter.com', you can reject it/treat
>> it as spoofed.
> same as above. MX for bibble.twitter.com is only to receive emails.
> Nothing prevents [email protected] to send unless you put a
> TXT "v=spf1 -all" for it !
>
But it would help tremendously, without needing to add SPF records for 
each host in a domain.

This is because there would be no MX record for 'bibble.twitter.com', so 
you could assume (because of this 'new rule') that that sender email 
address is invalid, because there is no way of replying to it.

Yes, the MX is for receiving mail only, according to the SMTP standard, 
BUT if you work on the assumption that you have to be able to reply to 
the sender (which is a common enough assumption), then it ALSO has to be 
valid for sending mail.



-

Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53